From b86bf8382e4e1149885401a9a4e8ed1cc0c9da49 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20S=C3=A1nchez?= <davidsansol92@gmail.com>
Date: Wed, 13 Oct 2021 16:44:55 +0200
Subject: [PATCH 01/71] [Security Solution] [Endpoint] Fleet summary card
 adjustments (#114291)

* Fix API call and refactor component to show different summary when size is small

* Refactored fleet trusted app card with new m design

* Removed unused code

* fix ts error

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../components/exception_items_summary.tsx    | 37 ++++++-----
 .../components/fleet_trusted_apps_card.tsx    | 64 ++++++++++++++-----
 .../components/styled_components.tsx          | 11 ++--
 3 files changed, 76 insertions(+), 36 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/endpoint_package_custom_extension/components/exception_items_summary.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/endpoint_package_custom_extension/components/exception_items_summary.tsx
index 5f0c5cca0ad2ca..59de05415f86b6 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/endpoint_package_custom_extension/components/exception_items_summary.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/endpoint_package_custom_extension/components/exception_items_summary.tsx
@@ -60,18 +60,23 @@ interface ExceptionItemsSummaryProps {
 export const ExceptionItemsSummary = memo<ExceptionItemsSummaryProps>(
   ({ stats, isSmall = false }) => {
     const getItem = useCallback(
-      (stat: keyof GetExceptionSummaryResponse) => (
-        <EuiFlexItem key={stat}>
-          <SummaryStat
-            value={stats?.[stat] ?? 0}
-            color={stat === 'total' ? 'primary' : 'default'}
-            key={stat}
-            isSmall={isSmall}
-          >
-            {SUMMARY_LABELS[stat]}
-          </SummaryStat>
-        </EuiFlexItem>
-      ),
+      (stat: keyof GetExceptionSummaryResponse) => {
+        if (stat !== 'total' && isSmall) {
+          return null;
+        }
+        return (
+          <EuiFlexItem key={stat}>
+            <SummaryStat
+              value={stats?.[stat] ?? 0}
+              color={stat === 'total' && !isSmall ? 'primary' : 'default'}
+              key={stat}
+              isSmall={isSmall}
+            >
+              {SUMMARY_LABELS[stat]}
+            </SummaryStat>
+          </EuiFlexItem>
+        );
+      },
       [stats, isSmall]
     );
 
@@ -100,9 +105,11 @@ const SummaryStat: FC<{ value: number; color?: EuiBadgeProps['color']; isSmall?:
           gutterSize={isSmall ? 'xs' : 'l'}
           isSmall={isSmall}
         >
-          <EuiFlexItem grow={false} style={color === 'primary' ? CSS_BOLD : undefined}>
-            {children}
-          </EuiFlexItem>
+          {!isSmall ? (
+            <EuiFlexItem grow={false} style={color === 'primary' ? CSS_BOLD : undefined}>
+              {children}
+            </EuiFlexItem>
+          ) : null}
           <EuiFlexItem grow={false}>
             <EuiBadge color={color}>{value}</EuiBadge>
           </EuiFlexItem>
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/endpoint_package_custom_extension/components/fleet_trusted_apps_card.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/endpoint_package_custom_extension/components/fleet_trusted_apps_card.tsx
index 08e8ec39dbaa83..54b1c37c7093f3 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/endpoint_package_custom_extension/components/fleet_trusted_apps_card.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/endpoint_package_custom_extension/components/fleet_trusted_apps_card.tsx
@@ -6,7 +6,7 @@
  */
 
 import React, { memo, useMemo, useState, useEffect, useRef } from 'react';
-import { EuiPanel, EuiText } from '@elastic/eui';
+import { EuiPanel, EuiText, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { GetExceptionSummaryResponse } from '../../../../../../../../common/endpoint/types';
@@ -14,7 +14,11 @@ import { GetExceptionSummaryResponse } from '../../../../../../../../common/endp
 import { useKibana, useToasts } from '../../../../../../../common/lib/kibana';
 import { ExceptionItemsSummary } from './exception_items_summary';
 import { TrustedAppsHttpService } from '../../../../../trusted_apps/service';
-import { StyledEuiFlexGridGroup, StyledEuiFlexGridItem } from './styled_components';
+import {
+  StyledEuiFlexGridGroup,
+  StyledEuiFlexGridItem,
+  StyledEuiFlexItem,
+} from './styled_components';
 
 interface FleetTrustedAppsCardProps {
   customLink: React.ReactNode;
@@ -38,7 +42,7 @@ export const FleetTrustedAppsCard = memo<FleetTrustedAppsCardProps>(
         try {
           const response = await trustedAppsApi.getTrustedAppsSummary({
             kuery: policyId
-              ? `exception-list-agnostic.attributes.tags:"policy:${policyId}" OR exception-list-agnostic.attributes.tags:"policy:all"`
+              ? `(exception-list-agnostic.attributes.tags:"policy:${policyId}" OR exception-list-agnostic.attributes.tags:"policy:all")`
               : undefined,
           });
           if (isMounted) {
@@ -72,21 +76,49 @@ export const FleetTrustedAppsCard = memo<FleetTrustedAppsCardProps>(
       />
     );
 
+    const cardGrid = useMemo(() => {
+      if (cardSize === 'm') {
+        return (
+          <EuiFlexGroup
+            alignItems="baseline"
+            justifyContent="flexStart"
+            gutterSize="s"
+            direction="row"
+            responsive={false}
+          >
+            <EuiFlexItem grow={false}>
+              <EuiText>
+                <h5>{getTitleMessage()}</h5>
+              </EuiText>
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <ExceptionItemsSummary stats={stats} isSmall={true} />
+            </EuiFlexItem>
+            <StyledEuiFlexItem grow={1}>{customLink}</StyledEuiFlexItem>
+          </EuiFlexGroup>
+        );
+      } else {
+        return (
+          <StyledEuiFlexGridGroup alignItems="baseline" justifyContent="center">
+            <StyledEuiFlexGridItem gridarea="title" alignitems="flex-start">
+              <EuiText>
+                <h4>{getTitleMessage()}</h4>
+              </EuiText>
+            </StyledEuiFlexGridItem>
+            <StyledEuiFlexGridItem gridarea="summary" alignitems={'center'}>
+              <ExceptionItemsSummary stats={stats} isSmall={false} />
+            </StyledEuiFlexGridItem>
+            <StyledEuiFlexGridItem gridarea="link" alignitems="flex-end">
+              {customLink}
+            </StyledEuiFlexGridItem>
+          </StyledEuiFlexGridGroup>
+        );
+      }
+    }, [cardSize, customLink, stats]);
+
     return (
       <EuiPanel hasShadow={false} paddingSize="l" hasBorder data-test-subj="fleetTrustedAppsCard">
-        <StyledEuiFlexGridGroup alignItems="baseline" justifyContent="center" cardSize={cardSize}>
-          <StyledEuiFlexGridItem gridarea="title" alignitems="flex-start">
-            <EuiText>
-              {cardSize === 'l' ? <h4>{getTitleMessage()}</h4> : <h5>{getTitleMessage()}</h5>}
-            </EuiText>
-          </StyledEuiFlexGridItem>
-          <StyledEuiFlexGridItem gridarea="summary">
-            <ExceptionItemsSummary stats={stats} isSmall={cardSize === 'm'} />
-          </StyledEuiFlexGridItem>
-          <StyledEuiFlexGridItem gridarea="link" alignitems="flex-end">
-            {customLink}
-          </StyledEuiFlexGridItem>
-        </StyledEuiFlexGridGroup>
+        {cardGrid}
       </EuiPanel>
     );
   }
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/endpoint_package_custom_extension/components/styled_components.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/endpoint_package_custom_extension/components/styled_components.tsx
index d2d5de5d43a3f4..ad1d823677f223 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/endpoint_package_custom_extension/components/styled_components.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/endpoint_package_custom_extension/components/styled_components.tsx
@@ -7,12 +7,9 @@
 import styled from 'styled-components';
 import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 
-export const StyledEuiFlexGridGroup = styled(EuiFlexGroup)<{
-  cardSize?: 'm' | 'l';
-}>`
+export const StyledEuiFlexGridGroup = styled(EuiFlexGroup)`
   display: grid;
-  grid-template-columns: ${({ cardSize = 'l' }) =>
-    cardSize === 'l' ? '25% 45% 30%' : '30% 35% 35%'};
+  grid-template-columns: 25% 45% 30%;
   grid-template-areas: 'title summary link';
 `;
 
@@ -25,3 +22,7 @@ export const StyledEuiFlexGridItem = styled(EuiFlexItem)<{
   margin: 0px;
   padding: 12px;
 `;
+
+export const StyledEuiFlexItem = styled(EuiFlexItem)`
+  flex-direction: row-reverse;
+`;

From c49374138852832a8c872495e1c20e70d78702f5 Mon Sep 17 00:00:00 2001
From: Josh Dover <1813008+joshdover@users.noreply.github.com>
Date: Wed, 13 Oct 2021 08:49:04 -0600
Subject: [PATCH 02/71] Bump EPR snapshot version used for tests (#114529)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 x-pack/test/fleet_api_integration/config.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/test/fleet_api_integration/config.ts b/x-pack/test/fleet_api_integration/config.ts
index d1c6c3c3f6b1ee..d2b61a3f5c3214 100644
--- a/x-pack/test/fleet_api_integration/config.ts
+++ b/x-pack/test/fleet_api_integration/config.ts
@@ -15,7 +15,7 @@ import { defineDockerServersConfig } from '@kbn/test';
 // example: https://beats-ci.elastic.co/blue/organizations/jenkins/Ingest-manager%2Fpackage-storage/detail/snapshot/74/pipeline/257#step-302-log-1.
 // It should be updated any time there is a new Docker image published for the Snapshot Distribution of the Package Registry.
 export const dockerImage =
-  'docker.elastic.co/package-registry/distribution@sha256:35cedaaa6adac547947321fa0c3b60a63eba153ba09524b9c1a21f1247a09bd2';
+  'docker.elastic.co/package-registry/distribution@sha256:42dbdbb7fbc7ea61d0c38c0df6dad977ca2ad9cf01e247543054377aef33d377';
 
 export default async function ({ readConfigFile }: FtrConfigProviderContext) {
   const xPackAPITestsConfig = await readConfigFile(require.resolve('../api_integration/config.ts'));

From d0a6e51d970a1d39df6ae43dc2ded169edfa25a1 Mon Sep 17 00:00:00 2001
From: Kaarina Tungseth <kaarina.tungseth@elastic.co>
Date: Wed, 13 Oct 2021 09:51:04 -0500
Subject: [PATCH 03/71] [DOCS] Adds Logstash pipeline settings (#114648)

---
 .../create-logstash.asciidoc                          | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/docs/api/logstash-configuration-management/create-logstash.asciidoc b/docs/api/logstash-configuration-management/create-logstash.asciidoc
index 9bd5a9028ee9af..ffbbf182249ec9 100644
--- a/docs/api/logstash-configuration-management/create-logstash.asciidoc
+++ b/docs/api/logstash-configuration-management/create-logstash.asciidoc
@@ -27,7 +27,16 @@ experimental[] Create a centrally-managed Logstash pipeline, or update an existi
   (Required, string) The pipeline definition.
 
 `settings`::
-  (Optional, object) The pipeline settings. Supported settings, represented as object keys, are `pipeline.workers`, `pipeline.batch.size`, `pipeline.batch.delay`, `queue.type`, `queue.max_bytes`, and `queue.checkpoint.writes`.
+  (Optional, object) The pipeline settings. Supported settings, represented as object keys, include the following:
+  
+  * `pipeline.workers`
+  * `pipeline.batch.size`
+  * `pipeline.batch.delay`
+  * `pipeline.ecs_compatibility`
+  * `pipeline.ordered`
+  * `queue.type`
+  * `queue.max_bytes`
+  * `queue.checkpoint.writes`
 
 [[logstash-configuration-management-api-create-codes]]
 ==== Response code

From 767f007bb35b9014aa7813c451bf2b504884e432 Mon Sep 17 00:00:00 2001
From: Giorgos Bamparopoulos <georgios.bamparopoulos@elastic.co>
Date: Wed, 13 Oct 2021 15:57:31 +0100
Subject: [PATCH 04/71] Update namespace for indices (#114612)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Update namespace for indices

* Update default index for transactions

Co-authored-by: Søren Louv-Jansen <sorenlouv@gmail.com>
---
 docs/apm/troubleshooting.asciidoc   |  2 +-
 docs/settings/apm-settings.asciidoc | 20 ++++++++++----------
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/docs/apm/troubleshooting.asciidoc b/docs/apm/troubleshooting.asciidoc
index 6e0c3b1decda8f..3736d21f44a5bb 100644
--- a/docs/apm/troubleshooting.asciidoc
+++ b/docs/apm/troubleshooting.asciidoc
@@ -76,7 +76,7 @@ If you change the default, you must also configure the `setup.template.name` and
 See {apm-server-ref}/configuration-template.html[Load the Elasticsearch index template].
 If the Elasticsearch index template has already been successfully loaded to the index,
 you can customize the indices that the APM app uses to display data.
-Navigate to *APM* > *Settings* > *Indices*, and change all `apm_oss.*Pattern` values to
+Navigate to *APM* > *Settings* > *Indices*, and change all `xpack.apm.*Pattern` values to
 include the new index pattern. For example: `customIndexName-*`.
 
 [float]
diff --git a/docs/settings/apm-settings.asciidoc b/docs/settings/apm-settings.asciidoc
index fb96f683553301..fc20685885df7b 100644
--- a/docs/settings/apm-settings.asciidoc
+++ b/docs/settings/apm-settings.asciidoc
@@ -87,22 +87,22 @@ Changing these settings may disable features of the APM App.
 | `xpack.apm.agent.migrations.enabled` {ess-icon}
   | Set to `false` to disable cloud APM migrations. Defaults to `true`.
 
-| `xpack.apm.errorIndices` {ess-icon}
-  | Matcher for all {apm-server-ref}/error-indices.html[error indices]. Defaults to `apm-*`.
+| `xpack.apm.indices.error` {ess-icon}
+  | Matcher for all {apm-server-ref}/error-indices.html[error indices]. Defaults to `logs-apm*,apm-*`.
 
-| `xpack.apm.onboardingIndices` {ess-icon}
+| `xpack.apm.indices.onboarding` {ess-icon}
   | Matcher for all onboarding indices. Defaults to `apm-*`.
 
-| `xpack.apm.spanIndices` {ess-icon}
-  | Matcher for all {apm-server-ref}/span-indices.html[span indices]. Defaults to `apm-*`.
+| `xpack.apm.indices.span` {ess-icon}
+  | Matcher for all {apm-server-ref}/span-indices.html[span indices]. Defaults to `traces-apm*,apm-*`.
 
-| `xpack.apm.transactionIndices` {ess-icon}
-  | Matcher for all {apm-server-ref}/transaction-indices.html[transaction indices]. Defaults to `apm-*`.
+| `xpack.apm.indices.transaction` {ess-icon}
+  | Matcher for all {apm-server-ref}/transaction-indices.html[transaction indices]. Defaults to `traces-apm*,apm-*`.
 
-| `xpack.apm.metricsIndices` {ess-icon}
-  | Matcher for all {apm-server-ref}/metricset-indices.html[metrics indices]. Defaults to `apm-*`.
+| `xpack.apm.indices.metric` {ess-icon}
+  | Matcher for all {apm-server-ref}/metricset-indices.html[metrics indices]. Defaults to `metrics-apm*,apm-*`.
 
-| `xpack.apm.sourcemapIndices` {ess-icon}
+| `xpack.apm.indices.sourcemap` {ess-icon}
   | Matcher for all {apm-server-ref}/sourcemap-indices.html[source map indices]. Defaults to `apm-*`.
 
 |===

From fdc0ce749a1f602c16c8fa9c1b842842255f0648 Mon Sep 17 00:00:00 2001
From: Kaarina Tungseth <kaarina.tungseth@elastic.co>
Date: Wed, 13 Oct 2021 09:59:50 -0500
Subject: [PATCH 05/71] [DOCS] Indicate reports are a subscription feature
 (#114653)

---
 docs/user/reporting/index.asciidoc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/user/reporting/index.asciidoc b/docs/user/reporting/index.asciidoc
index 148e9f8ee14a5b..c1e131cc057e08 100644
--- a/docs/user/reporting/index.asciidoc
+++ b/docs/user/reporting/index.asciidoc
@@ -13,9 +13,9 @@
 
 You access the options from the *Share* menu in the toolbar. The sharing options include the following:
 
-* *PDF Reports* &mdash; Generate and download a PDF file of a dashboard, visualization, or *Canvas* workpad.
+* *PDF Reports* &mdash; Generate and download a PDF file of a dashboard, visualization, or *Canvas* workpad. PDF reports are a link:https://www.elastic.co/subscriptions[subscription feature].
 
-* *PNG Reports* &mdash; Generate and download a PNG file of a dashboard or visualization.
+* *PNG Reports* &mdash; Generate and download a PNG file of a dashboard or visualization. PNG reports are a link:https://www.elastic.co/subscriptions[subscription feature].
 
 * *CSV Reports* &mdash; Generate and download a CSV file of a *Discover* saved search.
 

From da8264f26a08abf47a50035549f8cccb30fc5875 Mon Sep 17 00:00:00 2001
From: Zacqary Adam Xeper <Zacqary@users.noreply.github.com>
Date: Wed, 13 Oct 2021 10:36:07 -0500
Subject: [PATCH 06/71] [Stack Monitoring] Fix hashchange detection on sidenav
 link (#114727)

---
 x-pack/plugins/monitoring/public/application/index.tsx | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/x-pack/plugins/monitoring/public/application/index.tsx b/x-pack/plugins/monitoring/public/application/index.tsx
index 7b4c73475338f5..2caead4f963a1e 100644
--- a/x-pack/plugins/monitoring/public/application/index.tsx
+++ b/x-pack/plugins/monitoring/public/application/index.tsx
@@ -59,9 +59,15 @@ import { LogStashNodePipelinesPage } from './pages/logstash/node_pipelines';
 export const renderApp = (
   core: CoreStart,
   plugins: MonitoringStartPluginDependencies,
-  { element, setHeaderActionMenu }: AppMountParameters,
+  { element, history, setHeaderActionMenu }: AppMountParameters,
   externalConfig: ExternalConfig
 ) => {
+  // dispatch synthetic hash change event to update hash history objects
+  // this is necessary because hash updates triggered by using popState won't trigger this event naturally.
+  const unlistenParentHistory = history.listen(() => {
+    window.dispatchEvent(new HashChangeEvent('hashchange'));
+  });
+
   ReactDOM.render(
     <MonitoringApp
       core={core}
@@ -74,6 +80,7 @@ export const renderApp = (
 
   return () => {
     ReactDOM.unmountComponentAtNode(element);
+    unlistenParentHistory();
   };
 };
 

From 6c5dd08712ac741a45a2732bf53084daae783abe Mon Sep 17 00:00:00 2001
From: Spencer <email@spalger.com>
Date: Wed, 13 Oct 2021 10:45:27 -0500
Subject: [PATCH 07/71] [ts] Check .d.ts files for all projects in typeCheck
 (#114295)

* enable --skip-lib-check for all projects in typeCheck and fix existing issues

* fix graph types

* transpile TS to ES2019, but not all the way back to es5

Co-authored-by: spalger <spalger@users.noreply.github.com>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 src/dev/typescript/run_type_check_cli.ts      | 19 ++-----------------
 .../workspace/graph_client_workspace.d.ts     |  2 +-
 x-pack/plugins/reporting/server/lib/puid.d.ts |  2 +-
 .../security_solution/cypress/tsconfig.json   |  7 +++----
 4 files changed, 7 insertions(+), 23 deletions(-)

diff --git a/src/dev/typescript/run_type_check_cli.ts b/src/dev/typescript/run_type_check_cli.ts
index 472b9c04757ca0..27998f881a03d0 100644
--- a/src/dev/typescript/run_type_check_cli.ts
+++ b/src/dev/typescript/run_type_check_cli.ts
@@ -53,23 +53,8 @@ export async function runTypeCheckCli() {
         }
       }
 
-      const nonCompositeProjects = projects.filter((p) => !p.isCompositeProject());
-      if (!nonCompositeProjects.length) {
-        if (projectFilter) {
-          log.success(
-            `${flags.project} is a composite project so its types are validated by scripts/build_ts_refs`
-          );
-        } else {
-          log.success(
-            `All projects are composite so their types are validated by scripts/build_ts_refs`
-          );
-        }
-
-        return;
-      }
-
       const concurrency = Math.min(4, Math.round((Os.cpus() || []).length / 2) || 1) || 1;
-      log.info('running type check in', nonCompositeProjects.length, 'non-composite projects');
+      log.info('running type check in', projects.length, 'projects');
 
       const tscArgs = [
         ...['--emitDeclarationOnly', 'false'],
@@ -81,7 +66,7 @@ export async function runTypeCheckCli() {
       ];
 
       const failureCount = await lastValueFrom(
-        Rx.from(nonCompositeProjects).pipe(
+        Rx.from(projects).pipe(
           mergeMap(async (p) => {
             const relativePath = Path.relative(process.cwd(), p.tsConfigPath);
 
diff --git a/x-pack/plugins/graph/public/services/workspace/graph_client_workspace.d.ts b/x-pack/plugins/graph/public/services/workspace/graph_client_workspace.d.ts
index b369ec6c5762cc..18d08d8da31d82 100644
--- a/x-pack/plugins/graph/public/services/workspace/graph_client_workspace.d.ts
+++ b/x-pack/plugins/graph/public/services/workspace/graph_client_workspace.d.ts
@@ -5,6 +5,6 @@
  * 2.0.
  */
 
-import { Workspace, WorkspaceOptions } from '../types';
+import { Workspace, WorkspaceOptions } from '../../types';
 
 declare function createWorkspace(options: WorkspaceOptions): Workspace;
diff --git a/x-pack/plugins/reporting/server/lib/puid.d.ts b/x-pack/plugins/reporting/server/lib/puid.d.ts
index 2cf7dad67d06e3..4ac240157971f7 100644
--- a/x-pack/plugins/reporting/server/lib/puid.d.ts
+++ b/x-pack/plugins/reporting/server/lib/puid.d.ts
@@ -6,7 +6,7 @@
  */
 
 declare module 'puid' {
-  declare class Puid {
+  class Puid {
     generate(): string;
   }
 
diff --git a/x-pack/plugins/security_solution/cypress/tsconfig.json b/x-pack/plugins/security_solution/cypress/tsconfig.json
index 4efb4c5c562962..a779c3f48d3461 100644
--- a/x-pack/plugins/security_solution/cypress/tsconfig.json
+++ b/x-pack/plugins/security_solution/cypress/tsconfig.json
@@ -8,15 +8,14 @@
     "target/**/*"
   ],
   "compilerOptions": {
-    "target": "es5",
-    "lib": ["es5", "dom"],
+    "target": "ES2019",
     "outDir": "target/types",
     "types": [
       "cypress",
       "cypress-pipe",
-      "node"
+      "node",
+      "resize-observer-polyfill",
     ],
-    "resolveJsonModule": true,
   },
   "references": [
     { "path": "../tsconfig.json" }

From 330fd83aaf8750fc090722a3cbbb011cf3574be5 Mon Sep 17 00:00:00 2001
From: Paul Tavares <56442535+paul-tavares@users.noreply.github.com>
Date: Wed, 13 Oct 2021 12:00:21 -0400
Subject: [PATCH 08/71] [Security Solution][Endpoint] Policy Details Trusted
 Apps tab Remove action for single card (#114207)

* Remove modal for removing a policy from card
* new `assignPolicyToTrustedApps()` and `removePolicyFromTrustedApps()` methods for TrustedAppsService
* Additional tests for the policy details Trusted Apps List page/tab
* several tests for RemoveTrustedAppFromPolicyModal (but not all)
---
 .../management/pages/mocks/fleet_mocks.ts     |   5 +-
 .../action/policy_trusted_apps_action.ts      |  20 ++-
 .../policy_trusted_apps_middleware.ts         | 131 ++++++++-------
 .../reducer/initial_policy_details_state.ts   |   1 +
 .../reducer/trusted_apps_reducer.ts           |  20 +++
 .../selectors/trusted_apps_selectors.ts       |  21 +++
 .../pages/policy/test_utils/mocks.ts          |   3 +-
 .../public/management/pages/policy/types.ts   |   9 +
 .../pages/policy/view/policy_hooks.ts         |  25 ++-
 .../policy_trusted_apps_flyout.test.tsx       |   5 +
 .../flyout/policy_trusted_apps_flyout.tsx     |  14 +-
 .../list/policy_trusted_apps_list.test.tsx    | 107 ++++++++----
 .../list/policy_trusted_apps_list.tsx         |  50 +++++-
 ...ove_trusted_app_from_policy_modal.test.tsx | 156 ++++++++++++++++++
 .../remove_trusted_app_from_policy_modal.tsx  | 155 +++++++++++++++++
 .../pages/trusted_apps/service/index.ts       |  97 ++++++++++-
 .../trusted_apps/store/middleware.test.ts     |   2 +
 17 files changed, 710 insertions(+), 111 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/remove_trusted_app_from_policy_modal.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/remove_trusted_app_from_policy_modal.tsx

diff --git a/x-pack/plugins/security_solution/public/management/pages/mocks/fleet_mocks.ts b/x-pack/plugins/security_solution/public/management/pages/mocks/fleet_mocks.ts
index c9a972ce29e4cc..8f1530c3632dc6 100644
--- a/x-pack/plugins/security_solution/public/management/pages/mocks/fleet_mocks.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/mocks/fleet_mocks.ts
@@ -52,9 +52,10 @@ export const fleetGetEndpointPackagePolicyHttpMock =
       path: PACKAGE_POLICY_API_ROUTES.INFO_PATTERN,
       method: 'get',
       handler: () => {
-        return {
-          items: new EndpointDocGenerator('seed').generatePolicyPackagePolicy(),
+        const response: GetPolicyResponse = {
+          item: new EndpointDocGenerator('seed').generatePolicyPackagePolicy(),
         };
+        return response;
       },
     },
   ]);
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/action/policy_trusted_apps_action.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/action/policy_trusted_apps_action.ts
index 479452968df7a7..b3bdfe32ef0914 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/action/policy_trusted_apps_action.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/action/policy_trusted_apps_action.ts
@@ -8,8 +8,10 @@
 import { Action } from 'redux';
 import { AsyncResourceState } from '../../../../../state';
 import {
-  PostTrustedAppCreateResponse,
+  PutTrustedAppUpdateResponse,
   GetTrustedAppsListResponse,
+  TrustedApp,
+  MaybeImmutable,
 } from '../../../../../../../common/endpoint/types';
 import { PolicyArtifactsState } from '../../../types';
 
@@ -21,13 +23,14 @@ export interface PolicyArtifactsAssignableListPageDataChanged {
 export interface PolicyArtifactsUpdateTrustedApps {
   type: 'policyArtifactsUpdateTrustedApps';
   payload: {
-    trustedAppIds: string[];
+    action: 'assign' | 'remove';
+    artifacts: MaybeImmutable<TrustedApp[]>;
   };
 }
 
 export interface PolicyArtifactsUpdateTrustedAppsChanged {
   type: 'policyArtifactsUpdateTrustedAppsChanged';
-  payload: AsyncResourceState<PostTrustedAppCreateResponse[]>;
+  payload: AsyncResourceState<PutTrustedAppUpdateResponse[]>;
 }
 
 export interface PolicyArtifactsAssignableListExistDataChanged {
@@ -58,6 +61,13 @@ export interface PolicyDetailsListOfAllPoliciesStateChanged
 export type PolicyDetailsTrustedAppsForceListDataRefresh =
   Action<'policyDetailsTrustedAppsForceListDataRefresh'>;
 
+export type PolicyDetailsArtifactsResetRemove = Action<'policyDetailsArtifactsResetRemove'>;
+
+export interface PolicyDetailsTrustedAppsRemoveListStateChanged
+  extends Action<'policyDetailsTrustedAppsRemoveListStateChanged'> {
+  payload: PolicyArtifactsState['removeList'];
+}
+
 /**
  * All of the possible actions for Trusted Apps under the Policy Details store
  */
@@ -70,4 +80,6 @@ export type PolicyTrustedAppsAction =
   | PolicyArtifactsDeosAnyTrustedAppExists
   | AssignedTrustedAppsListStateChanged
   | PolicyDetailsListOfAllPoliciesStateChanged
-  | PolicyDetailsTrustedAppsForceListDataRefresh;
+  | PolicyDetailsTrustedAppsForceListDataRefresh
+  | PolicyDetailsTrustedAppsRemoveListStateChanged
+  | PolicyDetailsArtifactsResetRemove;
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware/policy_trusted_apps_middleware.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware/policy_trusted_apps_middleware.ts
index 360fe9fb99b8d6..f50eb342acba11 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware/policy_trusted_apps_middleware.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware/policy_trusted_apps_middleware.ts
@@ -5,43 +5,44 @@
  * 2.0.
  */
 
-import pMap from 'p-map';
-import { find, isEmpty } from 'lodash/fp';
+import { isEmpty } from 'lodash/fp';
 import {
-  PolicyDetailsState,
-  MiddlewareRunner,
   GetPolicyListResponse,
+  MiddlewareRunner,
   MiddlewareRunnerContext,
   PolicyAssignedTrustedApps,
+  PolicyDetailsState,
   PolicyDetailsStore,
+  PolicyRemoveTrustedApps,
 } from '../../../types';
 import {
-  policyIdFromParams,
-  getAssignableArtifactsList,
   doesPolicyTrustedAppsListNeedUpdate,
+  getCurrentArtifactsLocation,
   getCurrentPolicyAssignedTrustedAppsState,
+  getCurrentTrustedAppsRemoveListState,
+  getCurrentUrlLocationPaginationParams,
   getLatestLoadedPolicyAssignedTrustedAppsState,
+  getTrustedAppsIsRemoving,
   getTrustedAppsPolicyListState,
-  isPolicyTrustedAppListLoading,
-  getCurrentArtifactsLocation,
   isOnPolicyTrustedAppsView,
-  getCurrentUrlLocationPaginationParams,
+  isPolicyTrustedAppListLoading,
+  licensedPolicy,
+  policyIdFromParams,
   getDoesAnyTrustedAppExistsIsLoading,
 } from '../selectors';
 import {
-  ImmutableArray,
-  ImmutableObject,
-  PostTrustedAppCreateRequest,
-  TrustedApp,
   Immutable,
+  MaybeImmutable,
+  PutTrustedAppUpdateResponse,
+  TrustedApp,
 } from '../../../../../../../common/endpoint/types';
 import { ImmutableMiddlewareAPI } from '../../../../../../common/store';
 import { TrustedAppsService } from '../../../../trusted_apps/service';
 import {
+  createFailedResourceState,
   createLoadedResourceState,
   createLoadingResourceState,
   createUninitialisedResourceState,
-  createFailedResourceState,
   isLoadingResourceState,
   isUninitialisedResourceState,
 } from '../../../../../state';
@@ -83,8 +84,13 @@ export const policyTrustedAppsMiddlewareRunner: MiddlewareRunner = async (
       break;
 
     case 'policyArtifactsUpdateTrustedApps':
-      if (getCurrentArtifactsLocation(state).show === 'list') {
-        await updateTrustedApps(store, trustedAppsService, action.payload.trustedAppIds);
+      if (
+        getCurrentArtifactsLocation(state).show === 'list' &&
+        action.payload.action === 'assign'
+      ) {
+        await updateTrustedApps(store, trustedAppsService, action.payload.artifacts);
+      } else if (action.payload.action === 'remove') {
+        removeTrustedAppsFromPolicy(context, store, action.payload.artifacts);
       }
 
       break;
@@ -213,58 +219,26 @@ const searchTrustedApps = async (
   }
 };
 
-interface UpdateTrustedAppWrapperProps {
-  entry: ImmutableObject<TrustedApp>;
-  policies: ImmutableArray<string>;
-}
-
 const updateTrustedApps = async (
   store: ImmutableMiddlewareAPI<PolicyDetailsState, PolicyDetailsAction>,
   trustedAppsService: TrustedAppsService,
-  trustedAppsIds: ImmutableArray<string>
+  trustedApps: MaybeImmutable<TrustedApp[]>
 ) => {
   const state = store.getState();
   const policyId = policyIdFromParams(state);
-  const availavleArtifacts = getAssignableArtifactsList(state);
-
-  if (!availavleArtifacts || !availavleArtifacts.data.length) {
-    return;
-  }
 
   store.dispatch({
     type: 'policyArtifactsUpdateTrustedAppsChanged',
     // Ignore will be fixed with when AsyncResourceState is refactored (#830)
-    // @ts-ignore
+    // @ts-expect-error
     payload: createLoadingResourceState({ previousState: createUninitialisedResourceState() }),
   });
 
   try {
-    const trustedAppsUpdateActions = [];
-
-    const updateTrustedApp = async ({ entry, policies }: UpdateTrustedAppWrapperProps) =>
-      trustedAppsService.updateTrustedApp({ id: entry.id }, {
-        effectScope: { type: 'policy', policies: [...policies, policyId] },
-        name: entry.name,
-        entries: entry.entries,
-        os: entry.os,
-        description: entry.description,
-        version: entry.version,
-      } as PostTrustedAppCreateRequest);
-
-    for (const entryId of trustedAppsIds) {
-      const entry = find({ id: entryId }, availavleArtifacts.data) as ImmutableObject<TrustedApp>;
-      if (entry) {
-        const policies = entry.effectScope.type === 'policy' ? entry.effectScope.policies : [];
-        trustedAppsUpdateActions.push({ entry, policies });
-      }
-    }
-
-    const updatedTrustedApps = await pMap(trustedAppsUpdateActions, updateTrustedApp, {
-      concurrency: 5,
-      /** When set to false, instead of stopping when a promise rejects, it will wait for all the promises to settle
-       * and then reject with an aggregated error containing all the errors from the rejected promises. */
-      stopOnError: false,
-    });
+    const updatedTrustedApps = await trustedAppsService.assignPolicyToTrustedApps(
+      policyId,
+      trustedApps
+    );
 
     store.dispatch({
       type: 'policyArtifactsUpdateTrustedAppsChanged',
@@ -275,9 +249,7 @@ const updateTrustedApps = async (
   } catch (err) {
     store.dispatch({
       type: 'policyArtifactsUpdateTrustedAppsChanged',
-      // Ignore will be fixed with when AsyncResourceState is refactored (#830)
-      // @ts-ignore
-      payload: createFailedResourceState(err.body ?? err),
+      payload: createFailedResourceState<PutTrustedAppUpdateResponse[]>(err.body ?? err),
     });
   }
 };
@@ -371,3 +343,48 @@ const fetchAllPoliciesIfNeeded = async (
     });
   }
 };
+
+const removeTrustedAppsFromPolicy = async (
+  { trustedAppsService }: MiddlewareRunnerContext,
+  { getState, dispatch }: PolicyDetailsStore,
+  trustedApps: MaybeImmutable<TrustedApp[]>
+): Promise<void> => {
+  const state = getState();
+
+  if (getTrustedAppsIsRemoving(state)) {
+    return;
+  }
+
+  dispatch({
+    type: 'policyDetailsTrustedAppsRemoveListStateChanged',
+    // @ts-expect-error will be fixed when AsyncResourceState is refactored (#830)
+    payload: createLoadingResourceState(getCurrentTrustedAppsRemoveListState(state)),
+  });
+
+  try {
+    const currentPolicyId = licensedPolicy(state)?.id;
+
+    if (!currentPolicyId) {
+      throw new Error('current policy id not found');
+    }
+
+    const response = await trustedAppsService.removePolicyFromTrustedApps(
+      currentPolicyId,
+      trustedApps
+    );
+
+    dispatch({
+      type: 'policyDetailsTrustedAppsRemoveListStateChanged',
+      payload: createLoadedResourceState({ artifacts: trustedApps, response }),
+    });
+
+    dispatch({
+      type: 'policyDetailsTrustedAppsForceListDataRefresh',
+    });
+  } catch (error) {
+    dispatch({
+      type: 'policyDetailsTrustedAppsRemoveListStateChanged',
+      payload: createFailedResourceState<PolicyRemoveTrustedApps>(error.body || error),
+    });
+  }
+};
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer/initial_policy_details_state.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer/initial_policy_details_state.ts
index 2ad7ac9c06dac1..008bcd262ceff8 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer/initial_policy_details_state.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer/initial_policy_details_state.ts
@@ -40,5 +40,6 @@ export const initialPolicyDetailsState: () => Immutable<PolicyDetailsState> = ()
     doesAnyTrustedAppExists: createUninitialisedResourceState(),
     assignedList: createUninitialisedResourceState(),
     policies: createUninitialisedResourceState(),
+    removeList: createUninitialisedResourceState(),
   },
 });
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer/trusted_apps_reducer.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer/trusted_apps_reducer.ts
index fbf498797e804a..f9d090647b1b5b 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer/trusted_apps_reducer.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer/trusted_apps_reducer.ts
@@ -90,5 +90,25 @@ export const policyTrustedAppsReducer: ImmutableReducer<PolicyDetailsState, AppA
     };
   }
 
+  if (action.type === 'policyDetailsTrustedAppsRemoveListStateChanged') {
+    return {
+      ...state,
+      artifacts: {
+        ...state.artifacts,
+        removeList: action.payload,
+      },
+    };
+  }
+
+  if (action.type === 'policyDetailsArtifactsResetRemove') {
+    return {
+      ...state,
+      artifacts: {
+        ...state.artifacts,
+        removeList: initialPolicyDetailsState().artifacts.removeList,
+      },
+    };
+  }
+
   return state;
 };
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors/trusted_apps_selectors.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors/trusted_apps_selectors.ts
index 3177f13ae77e81..8ddf38fbb32e79 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors/trusted_apps_selectors.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors/trusted_apps_selectors.ts
@@ -221,3 +221,24 @@ export const getPolicyTrustedAppListError: PolicyDetailsSelector<
     return currentAssignedTrustedAppsState.error;
   }
 });
+
+export const getCurrentTrustedAppsRemoveListState: PolicyDetailsSelector<
+  PolicyArtifactsState['removeList']
+> = (state) => state.artifacts.removeList;
+
+export const getTrustedAppsIsRemoving: PolicyDetailsSelector<boolean> = createSelector(
+  getCurrentTrustedAppsRemoveListState,
+  (removeListState) => isLoadingResourceState(removeListState)
+);
+
+export const getTrustedAppsRemovalError: PolicyDetailsSelector<ServerApiError | undefined> =
+  createSelector(getCurrentTrustedAppsRemoveListState, (removeListState) => {
+    if (isFailedResourceState(removeListState)) {
+      return removeListState.error;
+    }
+  });
+
+export const getTrustedAppsWasRemoveSuccessful: PolicyDetailsSelector<boolean> = createSelector(
+  getCurrentTrustedAppsRemoveListState,
+  (removeListState) => isLoadedResourceState(removeListState)
+);
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/test_utils/mocks.ts b/x-pack/plugins/security_solution/public/management/pages/policy/test_utils/mocks.ts
index be38e591dd9da8..aca09716218634 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/test_utils/mocks.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/test_utils/mocks.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { HttpFetchOptionsWithPath } from 'kibana/public';
 import {
   composeHttpHandlerMocks,
   httpHandlerMockFactory,
@@ -71,7 +72,7 @@ export const getAPIError = () => ({
 });
 
 type PolicyDetailsTrustedAppsHttpMocksInterface = ResponseProvidersInterface<{
-  policyTrustedAppsList: () => GetTrustedAppsListResponse;
+  policyTrustedAppsList: (options: HttpFetchOptionsWithPath) => GetTrustedAppsListResponse;
 }>;
 
 /**
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/types.ts b/x-pack/plugins/security_solution/public/management/pages/policy/types.ts
index 7f8bf9c3872ea8..283c3afb573b65 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/types.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/types.ts
@@ -16,6 +16,8 @@ import {
   PostTrustedAppCreateResponse,
   MaybeImmutable,
   GetTrustedAppsListResponse,
+  TrustedApp,
+  PutTrustedAppUpdateResponse,
 } from '../../../../common/endpoint/types';
 import { ServerApiError } from '../../../common/types';
 import {
@@ -78,6 +80,11 @@ export interface PolicyAssignedTrustedApps {
   artifacts: GetTrustedAppsListResponse;
 }
 
+export interface PolicyRemoveTrustedApps {
+  artifacts: TrustedApp[];
+  response: PutTrustedAppUpdateResponse[];
+}
+
 /**
  * Policy artifacts store state
  */
@@ -96,6 +103,8 @@ export interface PolicyArtifactsState {
   assignedList: AsyncResourceState<PolicyAssignedTrustedApps>;
   /** A list of all available polices */
   policies: AsyncResourceState<GetPolicyListResponse>;
+  /** list of artifacts to remove. Holds the ids that were removed and the API response */
+  removeList: AsyncResourceState<PolicyRemoveTrustedApps>;
 }
 
 export enum OS {
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_hooks.ts b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_hooks.ts
index 82296730af686f..c6b89b4137cc48 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_hooks.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_hooks.ts
@@ -71,6 +71,8 @@ export const usePolicyTrustedAppsNotification = () => {
 
   if (updateSuccessfull && updatedArtifacts && !wasAlreadyHandled.has(updatedArtifacts)) {
     wasAlreadyHandled.add(updatedArtifacts);
+    const updateCount = updatedArtifacts.length;
+
     toasts.addSuccess({
       title: i18n.translate(
         'xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.toastSuccess.title',
@@ -78,13 +80,22 @@ export const usePolicyTrustedAppsNotification = () => {
           defaultMessage: 'Success',
         }
       ),
-      text: i18n.translate(
-        'xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.toastSuccess.text',
-        {
-          defaultMessage: '"{names}" has been added to your trusted applications list.',
-          values: { names: updatedArtifacts.map((artifact) => artifact.data.name).join(', ') },
-        }
-      ),
+      text:
+        updateCount > 1
+          ? i18n.translate(
+              'xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.toastSuccess.textMultiples',
+              {
+                defaultMessage: '{count} trusted applications have been added to your list.',
+                values: { count: updateCount },
+              }
+            )
+          : i18n.translate(
+              'xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.toastSuccess.textSingle',
+              {
+                defaultMessage: '"{name}" has been added to your trusted applications list.',
+                values: { name: updatedArtifacts[0]!.data.name },
+              }
+            ),
     });
   } else if (updateFailed) {
     toasts.addDanger(
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.test.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.test.tsx
index b07005908ed1e2..c1d00f7a3f99bb 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.test.tsx
@@ -38,6 +38,11 @@ describe('Policy trusted apps flyout', () => {
         updateTrustedApp: () => ({
           data: getMockCreateResponse(),
         }),
+        assignPolicyToTrustedApps: () => [
+          {
+            data: getMockCreateResponse(),
+          },
+        ],
       };
     });
     mockedContext = createAppRootMockRenderer();
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.tsx
index cd291ed9f6eb0f..63c7d5375476cc 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.tsx
@@ -25,6 +25,7 @@ import {
   EuiCallOut,
   EuiEmptyPrompt,
 } from '@elastic/eui';
+import { Dispatch } from 'redux';
 import {
   policyDetails,
   getCurrentArtifactsLocation,
@@ -42,10 +43,12 @@ import {
 } from '../../policy_hooks';
 import { PolicyArtifactsAssignableList } from '../../artifacts/assignable';
 import { SearchExceptions } from '../../../../../components/search_exceptions';
+import { AppAction } from '../../../../../../common/store/actions';
+import { MaybeImmutable, TrustedApp } from '../../../../../../../common/endpoint/types';
 
 export const PolicyTrustedAppsFlyout = React.memo(() => {
   usePolicyTrustedAppsNotification();
-  const dispatch = useDispatch();
+  const dispatch = useDispatch<Dispatch<AppAction>>();
   const [selectedArtifactIds, setSelectedArtifactIds] = useState<string[]>([]);
   const location = usePolicyDetailsSelector(getCurrentArtifactsLocation);
   const policyItem = usePolicyDetailsSelector(policyDetails);
@@ -85,9 +88,14 @@ export const PolicyTrustedAppsFlyout = React.memo(() => {
   const handleOnConfirmAction = useCallback(() => {
     dispatch({
       type: 'policyArtifactsUpdateTrustedApps',
-      payload: { trustedAppIds: selectedArtifactIds },
+      payload: {
+        action: 'assign',
+        artifacts: selectedArtifactIds.map<MaybeImmutable<TrustedApp>>((selectedId) => {
+          return assignableArtifactsList?.data?.find((trustedApp) => trustedApp.id === selectedId)!;
+        }),
+      },
     });
-  }, [dispatch, selectedArtifactIds]);
+  }, [assignableArtifactsList?.data, dispatch, selectedArtifactIds]);
 
   const handleOnSearch = useCallback(
     (filter) => {
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.test.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.test.tsx
index 07b62d13e8edca..83709c50b76fa5 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.test.tsx
@@ -13,11 +13,19 @@ import { getPolicyDetailsArtifactsListPath } from '../../../../../common/routing
 import { PolicyTrustedAppsList } from './policy_trusted_apps_list';
 import React from 'react';
 import { policyDetailsPageAllApiHttpMocks } from '../../../test_utils';
-import { isFailedResourceState, isLoadedResourceState } from '../../../../../state';
+import {
+  createLoadingResourceState,
+  createUninitialisedResourceState,
+  isFailedResourceState,
+  isLoadedResourceState,
+} from '../../../../../state';
 import { fireEvent, within, act, waitFor } from '@testing-library/react';
 import { APP_ID } from '../../../../../../../common/constants';
 
 describe('when rendering the PolicyTrustedAppsList', () => {
+  // The index (zero based) of the card created by the generator that is policy specific
+  const POLICY_SPECIFIC_CARD_INDEX = 2;
+
   let appTestContext: AppContextTestRender;
   let renderResult: ReturnType<AppContextTestRender['render']>;
   let render: (waitForLoadedState?: boolean) => Promise<ReturnType<AppContextTestRender['render']>>;
@@ -84,8 +92,19 @@ describe('when rendering the PolicyTrustedAppsList', () => {
     };
   });
 
-  // FIXME: implement this test once PR #113802 is merged
-  it.todo('should show loading spinner if checking to see if trusted apps exist');
+  it('should show loading spinner if checking to see if trusted apps exist', async () => {
+    await render();
+    act(() => {
+      appTestContext.store.dispatch({
+        type: 'policyArtifactsDeosAnyTrustedAppExists',
+        // Ignore will be fixed with when AsyncResourceState is refactored (#830)
+        // @ts-ignore
+        payload: createLoadingResourceState({ previousState: createUninitialisedResourceState() }),
+      });
+    });
+
+    expect(renderResult.getByTestId('policyTrustedAppsGrid-loading')).not.toBeNull();
+  });
 
   it('should show total number of of items being displayed', async () => {
     await render();
@@ -163,40 +182,68 @@ describe('when rendering the PolicyTrustedAppsList', () => {
     );
   });
 
-  it('should display policy names on assignment context menu', async () => {
-    const retrieveAllPolicies = waitForAction('policyDetailsListOfAllPoliciesStateChanged', {
-      validate({ payload }) {
-        return isLoadedResourceState(payload);
-      },
-    });
+  it('should show dialog when remove action is clicked', async () => {
     await render();
-    await retrieveAllPolicies;
+    await toggleCardActionMenu(POLICY_SPECIFIC_CARD_INDEX);
     act(() => {
-      fireEvent.click(
-        within(getCardByIndexPosition(2)).getByTestId(
-          'policyTrustedAppsGrid-card-header-effectScope-popupMenu-button'
+      fireEvent.click(renderResult.getByTestId('policyTrustedAppsGrid-removeAction'));
+    });
+
+    await waitFor(() => expect(renderResult.getByTestId('confirmModalBodyText')));
+  });
+
+  describe('and artifact is policy specific', () => {
+    const renderAndClickOnEffectScopePopupButton = async () => {
+      const retrieveAllPolicies = waitForAction('policyDetailsListOfAllPoliciesStateChanged', {
+        validate({ payload }) {
+          return isLoadedResourceState(payload);
+        },
+      });
+      await render();
+      await retrieveAllPolicies;
+      act(() => {
+        fireEvent.click(
+          within(getCardByIndexPosition(POLICY_SPECIFIC_CARD_INDEX)).getByTestId(
+            'policyTrustedAppsGrid-card-header-effectScope-popupMenu-button'
+          )
+        );
+      });
+      await waitFor(() =>
+        expect(
+          renderResult.getByTestId(
+            'policyTrustedAppsGrid-card-header-effectScope-popupMenu-popoverPanel'
+          )
         )
       );
-    });
-    await waitFor(() =>
+    };
+
+    it('should display policy names on assignment context menu', async () => {
+      await renderAndClickOnEffectScopePopupButton();
+
       expect(
-        renderResult.getByTestId(
-          'policyTrustedAppsGrid-card-header-effectScope-popupMenu-popoverPanel'
-        )
-      )
-    );
+        renderResult.getByTestId('policyTrustedAppsGrid-card-header-effectScope-popupMenu-item-0')
+          .textContent
+      ).toEqual('Endpoint Policy 0');
+      expect(
+        renderResult.getByTestId('policyTrustedAppsGrid-card-header-effectScope-popupMenu-item-1')
+          .textContent
+      ).toEqual('Endpoint Policy 1');
+    });
 
-    expect(
-      renderResult.getByTestId('policyTrustedAppsGrid-card-header-effectScope-popupMenu-item-0')
-        .textContent
-    ).toEqual('Endpoint Policy 0');
-    expect(
-      renderResult.getByTestId('policyTrustedAppsGrid-card-header-effectScope-popupMenu-item-1')
-        .textContent
-    ).toEqual('Endpoint Policy 1');
-  });
+    it('should navigate to policy details when clicking policy on assignment context menu', async () => {
+      await renderAndClickOnEffectScopePopupButton();
+
+      act(() => {
+        fireEvent.click(
+          renderResult.getByTestId('policyTrustedAppsGrid-card-header-effectScope-popupMenu-item-0')
+        );
+      });
 
-  it.todo('should navigate to policy details when clicking policy on assignment context menu');
+      expect(appTestContext.history.location.pathname).toEqual(
+        '/administration/policy/ddf6570b-9175-4a6d-b288-61a09771c647/settings'
+      );
+    });
+  });
 
   it('should handle pagination changes', async () => {
     await render();
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.tsx
index 6793bee9c3c01b..cb29d0ff868ace 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.tsx
@@ -37,6 +37,7 @@ import { APP_ID } from '../../../../../../../common/constants';
 import { ContextMenuItemNavByRouterProps } from '../../../../../components/context_menu_with_router_support/context_menu_item_nav_by_router';
 import { ArtifactEntryCollapsibleCardProps } from '../../../../../components/artifact_entry_card';
 import { useTestIdGenerator } from '../../../../../components/hooks/use_test_id_generator';
+import { RemoveTrustedAppFromPolicyModal } from './remove_trusted_app_from_policy_modal';
 
 const DATA_TEST_SUBJ = 'policyTrustedAppsGrid';
 
@@ -56,6 +57,8 @@ export const PolicyTrustedAppsList = memo(() => {
   const trustedAppsApiError = usePolicyDetailsSelector(getPolicyTrustedAppListError);
 
   const [isCardExpanded, setCardExpanded] = useState<Record<string, boolean>>({});
+  const [trustedAppsForRemoval, setTrustedAppsForRemoval] = useState<typeof trustedAppItems>([]);
+  const [showRemovalModal, setShowRemovalModal] = useState<boolean>(false);
 
   const handlePageChange = useCallback<ArtifactCardGridProps['onPageChange']>(
     ({ pageIndex, pageSize }) => {
@@ -100,6 +103,7 @@ export const PolicyTrustedAppsList = memo(() => {
     const newCardProps = new Map();
 
     for (const trustedApp of trustedAppItems) {
+      const isGlobal = trustedApp.effectScope.type === 'global';
       const viewUrlPath = getTrustedAppsListPath({ id: trustedApp.id, show: 'edit' });
       const assignedPoliciesMenuItems: ArtifactEntryCollapsibleCardProps['policies'] =
         trustedApp.effectScope.type === 'global'
@@ -142,6 +146,29 @@ export const PolicyTrustedAppsList = memo(() => {
             navigateOptions: { path: viewUrlPath },
             'data-test-subj': getTestId('viewFullDetailsAction'),
           },
+          {
+            icon: 'trash',
+            children: i18n.translate(
+              'xpack.securitySolution.endpoint.policy.trustedApps.list.removeAction',
+              { defaultMessage: 'Remove from policy' }
+            ),
+            onClick: () => {
+              setTrustedAppsForRemoval([trustedApp]);
+              setShowRemovalModal(true);
+            },
+            disabled: isGlobal,
+            toolTipContent: isGlobal
+              ? i18n.translate(
+                  'xpack.securitySolution.endpoint.policy.trustedApps.list.removeActionNotAllowed',
+                  {
+                    defaultMessage:
+                      'Globally applied trusted applications cannot be removed from policy.',
+                  }
+                )
+              : undefined,
+            toolTipPosition: 'top',
+            'data-test-subj': getTestId('removeAction'),
+          },
         ],
         policies: assignedPoliciesMenuItems,
       };
@@ -159,6 +186,15 @@ export const PolicyTrustedAppsList = memo(() => {
     [cardProps]
   );
 
+  const handleRemoveModalClose = useCallback(() => {
+    setShowRemovalModal(false);
+  }, []);
+
+  // Anytime a new set of data (trusted apps) is retrieved, reset the card expand state
+  useEffect(() => {
+    setCardExpanded({});
+  }, [trustedAppItems]);
+
   // if an error occurred while loading the data, show toast
   useEffect(() => {
     if (trustedAppsApiError) {
@@ -170,18 +206,13 @@ export const PolicyTrustedAppsList = memo(() => {
     }
   }, [toasts, trustedAppsApiError]);
 
-  // Anytime a new set of data (trusted apps) is retrieved, reset the card expand state
-  useEffect(() => {
-    setCardExpanded({});
-  }, [trustedAppItems]);
-
   if (hasTrustedApps.loading || isTrustedAppExistsCheckLoading) {
     return (
       <EuiPageTemplate template="centeredContent">
         <EuiLoadingSpinner
           className="essentialAnimation"
           size="xl"
-          data-test-subj={DATA_TEST_SUBJ}
+          data-test-subj={getTestId('loading')}
         />
       </EuiPageTemplate>
     );
@@ -205,6 +236,13 @@ export const PolicyTrustedAppsList = memo(() => {
         pagination={pagination as Pagination}
         data-test-subj={DATA_TEST_SUBJ}
       />
+
+      {showRemovalModal && (
+        <RemoveTrustedAppFromPolicyModal
+          trustedApps={trustedAppsForRemoval}
+          onClose={handleRemoveModalClose}
+        />
+      )}
     </>
   );
 });
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/remove_trusted_app_from_policy_modal.test.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/remove_trusted_app_from_policy_modal.test.tsx
new file mode 100644
index 00000000000000..fc2926bc65d3a3
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/remove_trusted_app_from_policy_modal.test.tsx
@@ -0,0 +1,156 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  AppContextTestRender,
+  createAppRootMockRenderer,
+} from '../../../../../../common/mock/endpoint';
+import { getPolicyDetailsArtifactsListPath } from '../../../../../common/routing';
+import { isLoadedResourceState } from '../../../../../state';
+import React from 'react';
+import { fireEvent, act } from '@testing-library/react';
+import { policyDetailsPageAllApiHttpMocks } from '../../../test_utils';
+import {
+  RemoveTrustedAppFromPolicyModal,
+  RemoveTrustedAppFromPolicyModalProps,
+} from './remove_trusted_app_from_policy_modal';
+import { PolicyArtifactsUpdateTrustedApps } from '../../../store/policy_details/action/policy_trusted_apps_action';
+import { Immutable } from '../../../../../../../common/endpoint/types';
+import { HttpFetchOptionsWithPath } from 'kibana/public';
+
+describe('When using the RemoveTrustedAppFromPolicyModal component', () => {
+  let appTestContext: AppContextTestRender;
+  let renderResult: ReturnType<AppContextTestRender['render']>;
+  let render: (waitForLoadedState?: boolean) => Promise<ReturnType<AppContextTestRender['render']>>;
+  let waitForAction: AppContextTestRender['middlewareSpy']['waitForAction'];
+  let mockedApis: ReturnType<typeof policyDetailsPageAllApiHttpMocks>;
+  let onCloseHandler: jest.MockedFunction<RemoveTrustedAppFromPolicyModalProps['onClose']>;
+  let trustedApps: RemoveTrustedAppFromPolicyModalProps['trustedApps'];
+
+  beforeEach(() => {
+    appTestContext = createAppRootMockRenderer();
+    waitForAction = appTestContext.middlewareSpy.waitForAction;
+    onCloseHandler = jest.fn();
+    mockedApis = policyDetailsPageAllApiHttpMocks(appTestContext.coreStart.http);
+    trustedApps = [
+      mockedApis.responseProvider.policyTrustedAppsList({ query: {} } as HttpFetchOptionsWithPath)
+        .data[0],
+    ];
+
+    render = async (waitForLoadedState: boolean = true) => {
+      const pendingDataLoadState = waitForLoadedState
+        ? Promise.all([
+            waitForAction('serverReturnedPolicyDetailsData'),
+            waitForAction('assignedTrustedAppsListStateChanged', {
+              validate({ payload }) {
+                return isLoadedResourceState(payload);
+              },
+            }),
+          ])
+        : Promise.resolve();
+
+      appTestContext.history.push(
+        getPolicyDetailsArtifactsListPath('ddf6570b-9175-4a6d-b288-61a09771c647')
+      );
+      renderResult = appTestContext.render(
+        <RemoveTrustedAppFromPolicyModal trustedApps={trustedApps} onClose={onCloseHandler} />
+      );
+
+      await pendingDataLoadState;
+
+      return renderResult;
+    };
+  });
+
+  const getConfirmButton = (): HTMLButtonElement =>
+    renderResult.getByTestId('confirmModalConfirmButton') as HTMLButtonElement;
+
+  const clickConfirmButton = async (
+    waitForActionDispatch: boolean = false
+  ): Promise<Immutable<PolicyArtifactsUpdateTrustedApps> | undefined> => {
+    const pendingConfirmStoreAction = waitForAction('policyArtifactsUpdateTrustedApps');
+
+    act(() => {
+      fireEvent.click(getConfirmButton());
+    });
+
+    let response: PolicyArtifactsUpdateTrustedApps | undefined;
+
+    if (waitForActionDispatch) {
+      await act(async () => {
+        response = await pendingConfirmStoreAction;
+      });
+    }
+
+    return response;
+  };
+
+  const clickCancelButton = () => {
+    act(() => {
+      fireEvent.click(renderResult.getByTestId('confirmModalCancelButton'));
+    });
+  };
+
+  const clickCloseButton = () => {
+    act(() => {
+      fireEvent.click(renderResult.baseElement.querySelector('button.euiModal__closeIcon')!);
+    });
+  };
+
+  it.each([
+    ['cancel', clickCancelButton],
+    ['close', clickCloseButton],
+  ])('should call `onClose` callback when %s button is clicked', async (__, clickButton) => {
+    await render();
+    clickButton();
+
+    expect(onCloseHandler).toHaveBeenCalled();
+  });
+
+  it('should dispatch action when confirmed', async () => {
+    await render();
+    const confirmedAction = await clickConfirmButton(true);
+
+    expect(confirmedAction!.payload).toEqual({
+      action: 'remove',
+      artifacts: trustedApps,
+    });
+  });
+
+  it.skip('should disable and show loading state on confirm button while update is underway', async () => {
+    await render();
+    await clickConfirmButton(true);
+    const confirmButton = getConfirmButton();
+
+    // FIXME:PT will finish test in a subsequent PR (issue created #1876)
+    //  GETTING ERROR:
+    //  Error: current policy id not found
+    //     //     at removeTrustedAppsFromPolicy (.../x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware/policy_trusted_apps_middleware.ts:368:13)
+    //     //     at policyTrustedAppsMiddlewareRunner (.../x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware/policy_trusted_apps_middleware.ts:93:9)
+
+    expect(confirmButton.disabled).toBe(true);
+    expect(confirmButton.querySelector('.euiLoadingSpinner')).not.toBeNull();
+  });
+
+  it.each([
+    ['cancel', clickCancelButton],
+    ['close', clickCloseButton],
+  ])(
+    'should prevent dialog dismissal if %s button is clicked while update is underway',
+    (__, clickButton) => {
+      // TODO: implement test
+    }
+  );
+
+  it.todo('should show error toast if removal failed');
+
+  it.todo('should show success toast and close modal when removed is successful');
+
+  it.todo('should show single removal success message');
+
+  it.todo('should show multiples removal success message');
+});
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/remove_trusted_app_from_policy_modal.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/remove_trusted_app_from_policy_modal.tsx
new file mode 100644
index 00000000000000..c43c28ec828290
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/remove_trusted_app_from_policy_modal.tsx
@@ -0,0 +1,155 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { memo, useCallback, useEffect, useMemo } from 'react';
+import { EuiCallOut, EuiConfirmModal, EuiSpacer, EuiText } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { useDispatch } from 'react-redux';
+import { Dispatch } from 'redux';
+import { Immutable, TrustedApp } from '../../../../../../../common/endpoint/types';
+import { AppAction } from '../../../../../../common/store/actions';
+import { usePolicyDetailsSelector } from '../../policy_hooks';
+import {
+  getTrustedAppsIsRemoving,
+  getTrustedAppsRemovalError,
+  getTrustedAppsWasRemoveSuccessful,
+  policyDetails,
+} from '../../../store/policy_details/selectors';
+import { useToasts } from '../../../../../../common/lib/kibana';
+
+export interface RemoveTrustedAppFromPolicyModalProps {
+  trustedApps: Immutable<TrustedApp[]>;
+  onClose: () => void;
+}
+
+export const RemoveTrustedAppFromPolicyModal = memo<RemoveTrustedAppFromPolicyModalProps>(
+  ({ trustedApps, onClose }) => {
+    const toasts = useToasts();
+    const dispatch = useDispatch<Dispatch<AppAction>>();
+
+    const policyName = usePolicyDetailsSelector(policyDetails)?.name;
+    const isRemoving = usePolicyDetailsSelector(getTrustedAppsIsRemoving);
+    const removeError = usePolicyDetailsSelector(getTrustedAppsRemovalError);
+    const wasSuccessful = usePolicyDetailsSelector(getTrustedAppsWasRemoveSuccessful);
+
+    const removedToastMessage: string = useMemo(() => {
+      const count = trustedApps.length;
+
+      if (count === 0) {
+        return '';
+      }
+
+      if (count > 1) {
+        return i18n.translate(
+          'xpack.securitySolution.endpoint.policy.trustedApps.list.removeDialog.successMultiplesToastText',
+          {
+            defaultMessage: '{count} trusted apps have been removed from {policyName} policy',
+            values: { count, policyName },
+          }
+        );
+      }
+
+      return i18n.translate(
+        'xpack.securitySolution.endpoint.policy.trustedApps.list.removeDialog.successToastText',
+        {
+          defaultMessage: '"{trustedAppName}" has been removed from "{policyName}" policy',
+          values: { trustedAppName: trustedApps[0].name, policyName },
+        }
+      );
+    }, [policyName, trustedApps]);
+
+    const handleModalClose = useCallback(() => {
+      if (!isRemoving) {
+        onClose();
+      }
+    }, [isRemoving, onClose]);
+
+    const handleModalConfirm = useCallback(() => {
+      dispatch({
+        type: 'policyArtifactsUpdateTrustedApps',
+        payload: { action: 'remove', artifacts: trustedApps },
+      });
+    }, [dispatch, trustedApps]);
+
+    useEffect(() => {
+      // When component is un-mounted, reset the state for remove in the store
+      return () => {
+        dispatch({ type: 'policyDetailsArtifactsResetRemove' });
+      };
+    }, [dispatch]);
+
+    useEffect(() => {
+      if (removeError) {
+        toasts.addError(removeError as unknown as Error, {
+          title: i18n.translate(
+            'xpack.securitySolution.endpoint.policy.trustedApps.list.removeDialog.errorToastTitle',
+            {
+              defaultMessage: 'Error while attempt to remove trusted application',
+            }
+          ),
+        });
+      }
+    }, [removeError, toasts]);
+
+    useEffect(() => {
+      if (wasSuccessful) {
+        toasts.addSuccess({
+          title: i18n.translate(
+            'xpack.securitySolution.endpoint.policy.trustedApps.list.removeDialog.successToastTitle',
+            { defaultMessage: 'Successfully removed' }
+          ),
+          text: removedToastMessage,
+        });
+        handleModalClose();
+      }
+    }, [handleModalClose, policyName, removedToastMessage, toasts, trustedApps, wasSuccessful]);
+
+    return (
+      <EuiConfirmModal
+        onCancel={handleModalClose}
+        onConfirm={handleModalConfirm}
+        title={i18n.translate(
+          'xpack.securitySolution.endpoint.policy.trustedApps.list.removeDialog.title',
+          { defaultMessage: 'Remove trusted application from policy' }
+        )}
+        cancelButtonText={i18n.translate(
+          'xpack.securitySolution.endpoint.policy.trustedApps.list.removeDialog.cancelLabel',
+          { defaultMessage: 'Cancel' }
+        )}
+        confirmButtonText={i18n.translate(
+          'xpack.securitySolution.endpoint.policy.trustedApps.list.removeDialog.confirmLabel',
+          {
+            defaultMessage: 'Remove from policy',
+          }
+        )}
+        isLoading={isRemoving}
+      >
+        <EuiCallOut color="warning" iconType="help">
+          <p>
+            <FormattedMessage
+              id="xpack.securitySolution.endpoint.policy.trustedApps.list.removeDialog.messageCallout"
+              defaultMessage="This trusted application will be removed only from this policy and can still be found and managed from the trusted applications page."
+            />
+          </p>
+        </EuiCallOut>
+
+        <EuiSpacer />
+
+        <EuiText size="s">
+          <p>
+            <FormattedMessage
+              id="xpack.securitySolution.endpoint.policy.trustedApps.list.removeDialog.message"
+              defaultMessage="Are you sure you wish to continue?"
+            />
+          </p>
+        </EuiText>
+      </EuiConfirmModal>
+    );
+  }
+);
+RemoveTrustedAppFromPolicyModal.displayName = 'RemoveTrustedAppFromPolicyModal';
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/service/index.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/service/index.ts
index 09aa80ffae495b..b59fb6cfdd2f77 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/service/index.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/service/index.ts
@@ -7,6 +7,7 @@
 
 import { HttpStart } from 'kibana/public';
 
+import pMap from 'p-map';
 import {
   TRUSTED_APPS_CREATE_API,
   TRUSTED_APPS_DELETE_API,
@@ -29,10 +30,14 @@ import {
   GetOneTrustedAppRequestParams,
   GetOneTrustedAppResponse,
   GetTrustedAppsSummaryRequest,
-} from '../../../../../common/endpoint/types/trusted_apps';
+  TrustedApp,
+  MaybeImmutable,
+} from '../../../../../common/endpoint/types';
 import { resolvePathVariables } from '../../../../common/utils/resolve_path_variables';
 
 import { sendGetEndpointSpecificPackagePolicies } from '../../policy/store/services/ingest';
+import { toUpdateTrustedApp } from '../../../../../common/endpoint/service/trusted_apps/to_update_trusted_app';
+import { isGlobalEffectScope } from '../state/type_guards';
 
 export interface TrustedAppsService {
   getTrustedApp(params: GetOneTrustedAppRequestParams): Promise<GetOneTrustedAppResponse>;
@@ -46,8 +51,23 @@ export interface TrustedAppsService {
   getPolicyList(
     options?: Parameters<typeof sendGetEndpointSpecificPackagePolicies>[1]
   ): ReturnType<typeof sendGetEndpointSpecificPackagePolicies>;
+  assignPolicyToTrustedApps(
+    policyId: string,
+    trustedApps: MaybeImmutable<TrustedApp[]>
+  ): Promise<PutTrustedAppUpdateResponse[]>;
+  removePolicyFromTrustedApps(
+    policyId: string,
+    trustedApps: MaybeImmutable<TrustedApp[]>
+  ): Promise<PutTrustedAppUpdateResponse[]>;
 }
 
+const P_MAP_OPTIONS = Object.freeze<pMap.Options>({
+  concurrency: 5,
+  /** When set to false, instead of stopping when a promise rejects, it will wait for all the promises to settle
+   * and then reject with an aggregated error containing all the errors from the rejected promises. */
+  stopOnError: false,
+});
+
 export class TrustedAppsHttpService implements TrustedAppsService {
   constructor(private http: HttpStart) {}
 
@@ -92,4 +112,79 @@ export class TrustedAppsHttpService implements TrustedAppsService {
   getPolicyList(options?: Parameters<typeof sendGetEndpointSpecificPackagePolicies>[1]) {
     return sendGetEndpointSpecificPackagePolicies(this.http, options);
   }
+
+  /**
+   * Assign a policy to trusted apps. Note that Trusted Apps MUST NOT be global
+   *
+   * @param policyId
+   * @param trustedApps[]
+   */
+  assignPolicyToTrustedApps(
+    policyId: string,
+    trustedApps: MaybeImmutable<TrustedApp[]>
+  ): Promise<PutTrustedAppUpdateResponse[]> {
+    return this._handleAssignOrRemovePolicyId('assign', policyId, trustedApps);
+  }
+
+  /**
+   * Remove a policy from trusted apps. Note that Trusted Apps MUST NOT be global
+   *
+   * @param policyId
+   * @param trustedApps[]
+   */
+  removePolicyFromTrustedApps(
+    policyId: string,
+    trustedApps: MaybeImmutable<TrustedApp[]>
+  ): Promise<PutTrustedAppUpdateResponse[]> {
+    return this._handleAssignOrRemovePolicyId('remove', policyId, trustedApps);
+  }
+
+  private _handleAssignOrRemovePolicyId(
+    action: 'assign' | 'remove',
+    policyId: string,
+    trustedApps: MaybeImmutable<TrustedApp[]>
+  ): Promise<PutTrustedAppUpdateResponse[]> {
+    if (policyId.trim() === '') {
+      throw new Error('policy ID is required');
+    }
+
+    if (trustedApps.length === 0) {
+      throw new Error('at least one trusted app is required');
+    }
+
+    return pMap(
+      trustedApps,
+      async (trustedApp) => {
+        if (isGlobalEffectScope(trustedApp.effectScope)) {
+          throw new Error(
+            `Unable to update trusted app [${trustedApp.id}] policy assignment. It's effectScope is 'global'`
+          );
+        }
+
+        const policies: string[] = !isGlobalEffectScope(trustedApp.effectScope)
+          ? [...trustedApp.effectScope.policies]
+          : [];
+
+        const indexOfPolicyId = policies.indexOf(policyId);
+
+        if (action === 'assign' && indexOfPolicyId === -1) {
+          policies.push(policyId);
+        } else if (action === 'remove' && indexOfPolicyId !== -1) {
+          policies.splice(indexOfPolicyId, 1);
+        }
+
+        return this.updateTrustedApp(
+          { id: trustedApp.id },
+          {
+            ...toUpdateTrustedApp(trustedApp),
+            effectScope: {
+              type: 'policy',
+              policies,
+            },
+          }
+        );
+      },
+      P_MAP_OPTIONS
+    );
+  }
 }
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.test.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.test.ts
index f64003ec6ad910..4455baddb047c0 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.test.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.test.ts
@@ -54,6 +54,8 @@ const createTrustedAppsServiceMock = (): jest.Mocked<TrustedAppsService> => ({
   getPolicyList: jest.fn(),
   updateTrustedApp: jest.fn(),
   getTrustedApp: jest.fn(),
+  assignPolicyToTrustedApps: jest.fn(),
+  removePolicyFromTrustedApps: jest.fn(),
 });
 
 const createStoreSetup = (trustedAppsService: TrustedAppsService) => {

From eeed2ca6ae6af0b2ffcde9beccf166e1462a31c9 Mon Sep 17 00:00:00 2001
From: Spencer <email@spalger.com>
Date: Wed, 13 Oct 2021 11:03:04 -0500
Subject: [PATCH 09/71] [ci] filter out proc-runner logs from stdout on CI
 (#114568)

Co-authored-by: spalger <spalger@users.noreply.github.com>
---
 .../src/ci_stats_reporter/ci_stats_config.ts  | 10 +++
 .../src/ci_stats_reporter/index.ts            |  1 +
 .../src/proc_runner/proc_runner.ts            |  2 +
 packages/kbn-dev-utils/src/run/cleanup.ts     |  4 +
 packages/kbn-dev-utils/src/run/index.ts       |  1 +
 .../__snapshots__/tooling_log.test.ts.snap    | 19 +++++
 .../kbn-dev-utils/src/tooling_log/index.ts    |  3 +
 .../kbn-dev-utils/src/tooling_log/message.ts  |  8 ++
 .../src/tooling_log/tooling_log.test.ts       | 37 +++++++++
 .../src/tooling_log/tooling_log.ts            | 66 ++++++++++++----
 .../tooling_log_collecting_writer.ts          | 15 ++++
 .../tooling_log/tooling_log_text_writer.ts    | 19 +++++
 .../kbn-dev-utils/src/tooling_log/writer.ts   |  9 +++
 packages/kbn-es/src/cluster.js                |  2 +-
 .../src/integration_tests/cluster.test.js     | 68 +++++++++++++----
 packages/kbn-pm/dist/index.js                 | 75 +++++++++++++++----
 .../lib/mocha/reporter/reporter.js            |  3 +-
 .../kbn-test/src/functional_tests/tasks.ts    |  7 +-
 test/functional/services/remote/remote.ts     |  2 +-
 19 files changed, 303 insertions(+), 48 deletions(-)

diff --git a/packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_config.ts b/packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_config.ts
index 9af52ae8d2df0d..f73b9c830a2aba 100644
--- a/packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_config.ts
+++ b/packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_config.ts
@@ -8,8 +8,18 @@
 
 import type { ToolingLog } from '../tooling_log';
 
+/**
+ * Information about how CiStatsReporter should talk to the ci-stats service. Normally
+ * it is read from a JSON environment variable using the `parseConfig()` function
+ * exported by this module.
+ */
 export interface Config {
+  /** ApiToken necessary for writing build data to ci-stats service */
   apiToken: string;
+  /**
+   * uuid which should be obtained by first creating a build with the
+   * ci-stats service and then passing it to all subsequent steps
+   */
   buildId: string;
 }
 
diff --git a/packages/kbn-dev-utils/src/ci_stats_reporter/index.ts b/packages/kbn-dev-utils/src/ci_stats_reporter/index.ts
index 9cb05608526eb4..318a2921517f10 100644
--- a/packages/kbn-dev-utils/src/ci_stats_reporter/index.ts
+++ b/packages/kbn-dev-utils/src/ci_stats_reporter/index.ts
@@ -7,5 +7,6 @@
  */
 
 export * from './ci_stats_reporter';
+export type { Config } from './ci_stats_config';
 export * from './ship_ci_stats_cli';
 export { getTimeReporter } from './report_time';
diff --git a/packages/kbn-dev-utils/src/proc_runner/proc_runner.ts b/packages/kbn-dev-utils/src/proc_runner/proc_runner.ts
index 35c910c911105b..8ef32411621f8d 100644
--- a/packages/kbn-dev-utils/src/proc_runner/proc_runner.ts
+++ b/packages/kbn-dev-utils/src/proc_runner/proc_runner.ts
@@ -37,6 +37,8 @@ export class ProcRunner {
   private signalUnsubscribe: () => void;
 
   constructor(private log: ToolingLog) {
+    this.log = log.withType('ProcRunner');
+
     this.signalUnsubscribe = exitHook(() => {
       this.teardown().catch((error) => {
         log.error(`ProcRunner teardown error: ${error.stack}`);
diff --git a/packages/kbn-dev-utils/src/run/cleanup.ts b/packages/kbn-dev-utils/src/run/cleanup.ts
index 26a6f5c632c466..ba0b762a562adf 100644
--- a/packages/kbn-dev-utils/src/run/cleanup.ts
+++ b/packages/kbn-dev-utils/src/run/cleanup.ts
@@ -13,6 +13,10 @@ import exitHook from 'exit-hook';
 import { ToolingLog } from '../tooling_log';
 import { isFailError } from './fail';
 
+/**
+ * A function which will be called when the CLI is torn-down which should
+ * quickly cleanup whatever it needs.
+ */
 export type CleanupTask = () => void;
 
 export class Cleanup {
diff --git a/packages/kbn-dev-utils/src/run/index.ts b/packages/kbn-dev-utils/src/run/index.ts
index f3c364c774d305..505ef4ee264d69 100644
--- a/packages/kbn-dev-utils/src/run/index.ts
+++ b/packages/kbn-dev-utils/src/run/index.ts
@@ -10,3 +10,4 @@ export * from './run';
 export * from './run_with_commands';
 export * from './flags';
 export * from './fail';
+export type { CleanupTask } from './cleanup';
diff --git a/packages/kbn-dev-utils/src/tooling_log/__snapshots__/tooling_log.test.ts.snap b/packages/kbn-dev-utils/src/tooling_log/__snapshots__/tooling_log.test.ts.snap
index 059e3d49c36882..7742c2bb681d0a 100644
--- a/packages/kbn-dev-utils/src/tooling_log/__snapshots__/tooling_log.test.ts.snap
+++ b/packages/kbn-dev-utils/src/tooling_log/__snapshots__/tooling_log.test.ts.snap
@@ -10,6 +10,7 @@ Array [
         "baz",
       ],
       "indent": 0,
+      "source": undefined,
       "type": "debug",
     },
   ],
@@ -24,6 +25,7 @@ Array [
         [Error: error message],
       ],
       "indent": 0,
+      "source": undefined,
       "type": "error",
     },
   ],
@@ -33,6 +35,7 @@ Array [
         "string message",
       ],
       "indent": 0,
+      "source": undefined,
       "type": "error",
     },
   ],
@@ -50,6 +53,7 @@ Array [
       "foo",
     ],
     "indent": 0,
+    "source": undefined,
     "type": "debug",
   },
   Object {
@@ -57,6 +61,7 @@ Array [
       "bar",
     ],
     "indent": 0,
+    "source": undefined,
     "type": "info",
   },
   Object {
@@ -64,6 +69,7 @@ Array [
       "baz",
     ],
     "indent": 0,
+    "source": undefined,
     "type": "verbose",
   },
 ]
@@ -76,6 +82,7 @@ Array [
       "foo",
     ],
     "indent": 0,
+    "source": undefined,
     "type": "debug",
   },
   Object {
@@ -83,6 +90,7 @@ Array [
       "bar",
     ],
     "indent": 0,
+    "source": undefined,
     "type": "info",
   },
   Object {
@@ -90,6 +98,7 @@ Array [
       "baz",
     ],
     "indent": 0,
+    "source": undefined,
     "type": "verbose",
   },
 ]
@@ -103,6 +112,7 @@ Array [
         "foo",
       ],
       "indent": 1,
+      "source": undefined,
       "type": "debug",
     },
   ],
@@ -112,6 +122,7 @@ Array [
         "bar",
       ],
       "indent": 3,
+      "source": undefined,
       "type": "debug",
     },
   ],
@@ -121,6 +132,7 @@ Array [
         "baz",
       ],
       "indent": 6,
+      "source": undefined,
       "type": "debug",
     },
   ],
@@ -130,6 +142,7 @@ Array [
         "box",
       ],
       "indent": 4,
+      "source": undefined,
       "type": "debug",
     },
   ],
@@ -139,6 +152,7 @@ Array [
         "foo",
       ],
       "indent": 0,
+      "source": undefined,
       "type": "debug",
     },
   ],
@@ -155,6 +169,7 @@ Array [
         "baz",
       ],
       "indent": 0,
+      "source": undefined,
       "type": "info",
     },
   ],
@@ -171,6 +186,7 @@ Array [
         "baz",
       ],
       "indent": 0,
+      "source": undefined,
       "type": "success",
     },
   ],
@@ -187,6 +203,7 @@ Array [
         "baz",
       ],
       "indent": 0,
+      "source": undefined,
       "type": "verbose",
     },
   ],
@@ -203,6 +220,7 @@ Array [
         "baz",
       ],
       "indent": 0,
+      "source": undefined,
       "type": "warning",
     },
   ],
@@ -219,6 +237,7 @@ Array [
         "baz",
       ],
       "indent": 0,
+      "source": undefined,
       "type": "write",
     },
   ],
diff --git a/packages/kbn-dev-utils/src/tooling_log/index.ts b/packages/kbn-dev-utils/src/tooling_log/index.ts
index 65dcd3054ef935..4da54ee9bfeaed 100644
--- a/packages/kbn-dev-utils/src/tooling_log/index.ts
+++ b/packages/kbn-dev-utils/src/tooling_log/index.ts
@@ -7,6 +7,9 @@
  */
 
 export { ToolingLog } from './tooling_log';
+export type { ToolingLogOptions } from './tooling_log';
 export { ToolingLogTextWriter, ToolingLogTextWriterConfig } from './tooling_log_text_writer';
 export { pickLevelFromFlags, parseLogLevel, LogLevel, ParsedLogLevel } from './log_levels';
 export { ToolingLogCollectingWriter } from './tooling_log_collecting_writer';
+export type { Writer } from './writer';
+export type { Message } from './message';
diff --git a/packages/kbn-dev-utils/src/tooling_log/message.ts b/packages/kbn-dev-utils/src/tooling_log/message.ts
index ebd3a255a73a42..082c0e65d48b23 100644
--- a/packages/kbn-dev-utils/src/tooling_log/message.ts
+++ b/packages/kbn-dev-utils/src/tooling_log/message.ts
@@ -8,8 +8,16 @@
 
 export type MessageTypes = 'verbose' | 'debug' | 'info' | 'success' | 'warning' | 'error' | 'write';
 
+/**
+ * The object shape passed to ToolingLog writers each time the log is used.
+ */
 export interface Message {
+  /** level/type of message */
   type: MessageTypes;
+  /** indentation intended when message written to a text log */
   indent: number;
+  /** type of logger this message came from */
+  source?: string;
+  /** args passed to the logging method */
   args: any[];
 }
diff --git a/packages/kbn-dev-utils/src/tooling_log/tooling_log.test.ts b/packages/kbn-dev-utils/src/tooling_log/tooling_log.test.ts
index ec63a9fb7e6f2e..506f89786917f0 100644
--- a/packages/kbn-dev-utils/src/tooling_log/tooling_log.test.ts
+++ b/packages/kbn-dev-utils/src/tooling_log/tooling_log.test.ts
@@ -155,3 +155,40 @@ describe('#getWritten$()', () => {
     await testWrittenMsgs([{ write: jest.fn(() => false) }, { write: jest.fn(() => false) }]);
   });
 });
+
+describe('#withType()', () => {
+  it('creates a child logger with a unique type that respects all other settings', () => {
+    const writerA = new ToolingLogCollectingWriter();
+    const writerB = new ToolingLogCollectingWriter();
+    const log = new ToolingLog();
+    log.setWriters([writerA]);
+
+    const fork = log.withType('someType');
+    log.info('hello');
+    fork.info('world');
+    fork.indent(2);
+    log.debug('indented');
+    fork.indent(-2);
+    log.debug('not-indented');
+
+    log.setWriters([writerB]);
+    fork.info('to new writer');
+    fork.indent(5);
+    log.info('also to new writer');
+
+    expect(writerA.messages).toMatchInlineSnapshot(`
+      Array [
+        " info hello",
+        " info source[someType] world",
+        " │ debg indented",
+        " debg not-indented",
+      ]
+    `);
+    expect(writerB.messages).toMatchInlineSnapshot(`
+      Array [
+        " info source[someType] to new writer",
+        "    │ info also to new writer",
+      ]
+    `);
+  });
+});
diff --git a/packages/kbn-dev-utils/src/tooling_log/tooling_log.ts b/packages/kbn-dev-utils/src/tooling_log/tooling_log.ts
index e9fd15afefe4e9..84e9159dfcd415 100644
--- a/packages/kbn-dev-utils/src/tooling_log/tooling_log.ts
+++ b/packages/kbn-dev-utils/src/tooling_log/tooling_log.ts
@@ -12,21 +12,45 @@ import { ToolingLogTextWriter, ToolingLogTextWriterConfig } from './tooling_log_
 import { Writer } from './writer';
 import { Message, MessageTypes } from './message';
 
+export interface ToolingLogOptions {
+  /**
+   * type name for this logger, will be assigned to the "source"
+   * properties of messages produced by this logger
+   */
+  type?: string;
+  /**
+   * parent ToolingLog. When a ToolingLog has a parent they will both
+   * share indent and writers state. Changing the indent width or
+   * writers on either log will update the other too.
+   */
+  parent?: ToolingLog;
+}
+
 export class ToolingLog {
-  private indentWidth = 0;
-  private writers: Writer[];
+  private indentWidth$: Rx.BehaviorSubject<number>;
+  private writers$: Rx.BehaviorSubject<Writer[]>;
   private readonly written$: Rx.Subject<Message>;
+  private readonly type: string | undefined;
+
+  constructor(writerConfig?: ToolingLogTextWriterConfig, options?: ToolingLogOptions) {
+    this.indentWidth$ = options?.parent ? options.parent.indentWidth$ : new Rx.BehaviorSubject(0);
 
-  constructor(writerConfig?: ToolingLogTextWriterConfig) {
-    this.writers = writerConfig ? [new ToolingLogTextWriter(writerConfig)] : [];
-    this.written$ = new Rx.Subject();
+    this.writers$ = options?.parent
+      ? options.parent.writers$
+      : new Rx.BehaviorSubject<Writer[]>([]);
+    if (!options?.parent && writerConfig) {
+      this.writers$.next([new ToolingLogTextWriter(writerConfig)]);
+    }
+
+    this.written$ = options?.parent ? options.parent.written$ : new Rx.Subject();
+    this.type = options?.type;
   }
 
   /**
    * Get the current indentation level of the ToolingLog
    */
   public getIndent() {
-    return this.indentWidth;
+    return this.indentWidth$.getValue();
   }
 
   /**
@@ -39,8 +63,8 @@ export class ToolingLog {
    * @param block a function to run and reset any indentation changes after
    */
   public indent<T>(delta = 0, block?: () => Promise<T>) {
-    const originalWidth = this.indentWidth;
-    this.indentWidth = Math.max(this.indentWidth + delta, 0);
+    const originalWidth = this.indentWidth$.getValue();
+    this.indentWidth$.next(Math.max(originalWidth + delta, 0));
     if (!block) {
       return;
     }
@@ -49,7 +73,7 @@ export class ToolingLog {
       try {
         return await block();
       } finally {
-        this.indentWidth = originalWidth;
+        this.indentWidth$.next(originalWidth);
       }
     })();
   }
@@ -83,26 +107,40 @@ export class ToolingLog {
   }
 
   public getWriters() {
-    return this.writers.slice(0);
+    return [...this.writers$.getValue()];
   }
 
   public setWriters(writers: Writer[]) {
-    this.writers = [...writers];
+    this.writers$.next([...writers]);
   }
 
   public getWritten$() {
     return this.written$.asObservable();
   }
 
+  /**
+   * Create a new ToolingLog which sets a different "type", allowing messages to be filtered out by "source"
+   * @param type A string that will be passed along with messages from this logger which can be used to filter messages with `ignoreSources`
+   */
+  public withType(type: string) {
+    return new ToolingLog(undefined, {
+      type,
+      parent: this,
+    });
+  }
+
   private sendToWriters(type: MessageTypes, args: any[]) {
-    const msg = {
+    const indent = this.indentWidth$.getValue();
+    const writers = this.writers$.getValue();
+    const msg: Message = {
       type,
-      indent: this.indentWidth,
+      indent,
+      source: this.type,
       args,
     };
 
     let written = false;
-    for (const writer of this.writers) {
+    for (const writer of writers) {
       if (writer.write(msg)) {
         written = true;
       }
diff --git a/packages/kbn-dev-utils/src/tooling_log/tooling_log_collecting_writer.ts b/packages/kbn-dev-utils/src/tooling_log/tooling_log_collecting_writer.ts
index cc399e40d2cb49..6f73563f4a2c59 100644
--- a/packages/kbn-dev-utils/src/tooling_log/tooling_log_collecting_writer.ts
+++ b/packages/kbn-dev-utils/src/tooling_log/tooling_log_collecting_writer.ts
@@ -8,6 +8,7 @@
 
 import { ToolingLogTextWriter } from './tooling_log_text_writer';
 import { LogLevel } from './log_levels';
+import { Message } from './message';
 
 export class ToolingLogCollectingWriter extends ToolingLogTextWriter {
   messages: string[] = [];
@@ -23,4 +24,18 @@ export class ToolingLogCollectingWriter extends ToolingLogTextWriter {
       },
     });
   }
+
+  /**
+   * Called by ToolingLog, extends messages with the source if message includes one.
+   */
+  write(msg: Message) {
+    if (msg.source) {
+      return super.write({
+        ...msg,
+        args: [`source[${msg.source}]`, ...msg.args],
+      });
+    }
+
+    return super.write(msg);
+  }
 }
diff --git a/packages/kbn-dev-utils/src/tooling_log/tooling_log_text_writer.ts b/packages/kbn-dev-utils/src/tooling_log/tooling_log_text_writer.ts
index 2b1806eb4b9a28..660dae3fa1f559 100644
--- a/packages/kbn-dev-utils/src/tooling_log/tooling_log_text_writer.ts
+++ b/packages/kbn-dev-utils/src/tooling_log/tooling_log_text_writer.ts
@@ -28,7 +28,20 @@ const MSG_PREFIXES = {
 const has = <T extends object>(obj: T, key: any): key is keyof T => obj.hasOwnProperty(key);
 
 export interface ToolingLogTextWriterConfig {
+  /**
+   * Log level, messages below this level will be ignored
+   */
   level: LogLevel;
+  /**
+   * List of message sources/ToolingLog types which will be ignored. Create
+   * a logger with `ToolingLog#withType()` to create messages with a specific
+   * source. Ignored messages will be dropped without writing.
+   */
+  ignoreSources?: string[];
+  /**
+   * Target which will receive formatted message lines, a common value for `writeTo`
+   * is process.stdout
+   */
   writeTo: {
     write(s: string): void;
   };
@@ -59,10 +72,12 @@ export class ToolingLogTextWriter implements Writer {
   public readonly writeTo: {
     write(msg: string): void;
   };
+  private readonly ignoreSources?: string[];
 
   constructor(config: ToolingLogTextWriterConfig) {
     this.level = parseLogLevel(config.level);
     this.writeTo = config.writeTo;
+    this.ignoreSources = config.ignoreSources;
 
     if (!this.writeTo || typeof this.writeTo.write !== 'function') {
       throw new Error(
@@ -76,6 +91,10 @@ export class ToolingLogTextWriter implements Writer {
       return false;
     }
 
+    if (this.ignoreSources && msg.source && this.ignoreSources.includes(msg.source)) {
+      return false;
+    }
+
     const prefix = has(MSG_PREFIXES, msg.type) ? MSG_PREFIXES[msg.type] : '';
     ToolingLogTextWriter.write(this.writeTo, prefix, msg);
     return true;
diff --git a/packages/kbn-dev-utils/src/tooling_log/writer.ts b/packages/kbn-dev-utils/src/tooling_log/writer.ts
index fd56f4fe3d3a64..26fec6a7806945 100644
--- a/packages/kbn-dev-utils/src/tooling_log/writer.ts
+++ b/packages/kbn-dev-utils/src/tooling_log/writer.ts
@@ -8,6 +8,15 @@
 
 import { Message } from './message';
 
+/**
+ * An object which received ToolingLog `Messages` and sends them to
+ * some interface for collecting logs like stdio, or a file
+ */
 export interface Writer {
+  /**
+   * Called with every log message, should return true if the message
+   * was written and false if it was ignored.
+   * @param msg The log message to write
+   */
   write(msg: Message): boolean;
 }
diff --git a/packages/kbn-es/src/cluster.js b/packages/kbn-es/src/cluster.js
index 0866b14f4ade8c..dd9c17055fb187 100644
--- a/packages/kbn-es/src/cluster.js
+++ b/packages/kbn-es/src/cluster.js
@@ -36,7 +36,7 @@ const first = (stream, map) =>
 
 exports.Cluster = class Cluster {
   constructor({ log = defaultLog, ssl = false } = {}) {
-    this._log = log;
+    this._log = log.withType('@kbn/es Cluster');
     this._ssl = ssl;
     this._caCertPromise = ssl ? readFile(CA_CERT_PATH) : undefined;
   }
diff --git a/packages/kbn-es/src/integration_tests/cluster.test.js b/packages/kbn-es/src/integration_tests/cluster.test.js
index c196a89a6b0908..0cdbac310bbb15 100644
--- a/packages/kbn-es/src/integration_tests/cluster.test.js
+++ b/packages/kbn-es/src/integration_tests/cluster.test.js
@@ -8,9 +8,11 @@
 
 const {
   ToolingLog,
+  ToolingLogCollectingWriter,
   ES_P12_PATH,
   ES_P12_PASSWORD,
   createAnyInstanceSerializer,
+  createStripAnsiSerializer,
 } = require('@kbn/dev-utils');
 const execa = require('execa');
 const { Cluster } = require('../cluster');
@@ -18,6 +20,7 @@ const { installSource, installSnapshot, installArchive } = require('../install')
 const { extractConfigFiles } = require('../utils/extract_config_files');
 
 expect.addSnapshotSerializer(createAnyInstanceSerializer(ToolingLog));
+expect.addSnapshotSerializer(createStripAnsiSerializer());
 
 jest.mock('../install', () => ({
   installSource: jest.fn(),
@@ -31,6 +34,8 @@ jest.mock('../utils/extract_config_files', () => ({
 }));
 
 const log = new ToolingLog();
+const logWriter = new ToolingLogCollectingWriter();
+log.setWriters([logWriter]);
 
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
@@ -76,6 +81,8 @@ const initialEnv = { ...process.env };
 beforeEach(() => {
   jest.resetAllMocks();
   extractConfigFiles.mockImplementation((config) => config);
+  log.indent(-log.getIndent());
+  logWriter.messages.length = 0;
 });
 
 afterEach(() => {
@@ -107,11 +114,21 @@ describe('#installSource()', () => {
     installSource.mockResolvedValue({});
     const cluster = new Cluster({ log });
     await cluster.installSource({ foo: 'bar' });
-    expect(installSource).toHaveBeenCalledTimes(1);
-    expect(installSource).toHaveBeenCalledWith({
-      log,
-      foo: 'bar',
-    });
+    expect(installSource.mock.calls).toMatchInlineSnapshot(`
+      Array [
+        Array [
+          Object {
+            "foo": "bar",
+            "log": <ToolingLog>,
+          },
+        ],
+      ]
+    `);
+    expect(logWriter.messages).toMatchInlineSnapshot(`
+      Array [
+        " info source[@kbn/es Cluster] Installing from source",
+      ]
+    `);
   });
 
   it('rejects if installSource() rejects', async () => {
@@ -146,11 +163,21 @@ describe('#installSnapshot()', () => {
     installSnapshot.mockResolvedValue({});
     const cluster = new Cluster({ log });
     await cluster.installSnapshot({ foo: 'bar' });
-    expect(installSnapshot).toHaveBeenCalledTimes(1);
-    expect(installSnapshot).toHaveBeenCalledWith({
-      log,
-      foo: 'bar',
-    });
+    expect(installSnapshot.mock.calls).toMatchInlineSnapshot(`
+      Array [
+        Array [
+          Object {
+            "foo": "bar",
+            "log": <ToolingLog>,
+          },
+        ],
+      ]
+    `);
+    expect(logWriter.messages).toMatchInlineSnapshot(`
+      Array [
+        " info source[@kbn/es Cluster] Installing from snapshot",
+      ]
+    `);
   });
 
   it('rejects if installSnapshot() rejects', async () => {
@@ -185,11 +212,22 @@ describe('#installArchive(path)', () => {
     installArchive.mockResolvedValue({});
     const cluster = new Cluster({ log });
     await cluster.installArchive('path', { foo: 'bar' });
-    expect(installArchive).toHaveBeenCalledTimes(1);
-    expect(installArchive).toHaveBeenCalledWith('path', {
-      log,
-      foo: 'bar',
-    });
+    expect(installArchive.mock.calls).toMatchInlineSnapshot(`
+      Array [
+        Array [
+          "path",
+          Object {
+            "foo": "bar",
+            "log": <ToolingLog>,
+          },
+        ],
+      ]
+    `);
+    expect(logWriter.messages).toMatchInlineSnapshot(`
+      Array [
+        " info source[@kbn/es Cluster] Installing from an archive",
+      ]
+    `);
   });
 
   it('rejects if installArchive() rejects', async () => {
diff --git a/packages/kbn-pm/dist/index.js b/packages/kbn-pm/dist/index.js
index 595b619a7f2a4d..721072d9e899b4 100644
--- a/packages/kbn-pm/dist/index.js
+++ b/packages/kbn-pm/dist/index.js
@@ -625,12 +625,20 @@ function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj &&
  * Side Public License, v 1.
  */
 class ToolingLog {
-  constructor(writerConfig) {
-    (0, _defineProperty2.default)(this, "indentWidth", 0);
-    (0, _defineProperty2.default)(this, "writers", void 0);
+  constructor(writerConfig, options) {
+    (0, _defineProperty2.default)(this, "indentWidth$", void 0);
+    (0, _defineProperty2.default)(this, "writers$", void 0);
     (0, _defineProperty2.default)(this, "written$", void 0);
-    this.writers = writerConfig ? [new _tooling_log_text_writer.ToolingLogTextWriter(writerConfig)] : [];
-    this.written$ = new Rx.Subject();
+    (0, _defineProperty2.default)(this, "type", void 0);
+    this.indentWidth$ = options !== null && options !== void 0 && options.parent ? options.parent.indentWidth$ : new Rx.BehaviorSubject(0);
+    this.writers$ = options !== null && options !== void 0 && options.parent ? options.parent.writers$ : new Rx.BehaviorSubject([]);
+
+    if (!(options !== null && options !== void 0 && options.parent) && writerConfig) {
+      this.writers$.next([new _tooling_log_text_writer.ToolingLogTextWriter(writerConfig)]);
+    }
+
+    this.written$ = options !== null && options !== void 0 && options.parent ? options.parent.written$ : new Rx.Subject();
+    this.type = options === null || options === void 0 ? void 0 : options.type;
   }
   /**
    * Get the current indentation level of the ToolingLog
@@ -638,7 +646,7 @@ class ToolingLog {
 
 
   getIndent() {
-    return this.indentWidth;
+    return this.indentWidth$.getValue();
   }
   /**
    * Indent the output of the ToolingLog by some character (4 is a good choice usually).
@@ -652,8 +660,8 @@ class ToolingLog {
 
 
   indent(delta = 0, block) {
-    const originalWidth = this.indentWidth;
-    this.indentWidth = Math.max(this.indentWidth + delta, 0);
+    const originalWidth = this.indentWidth$.getValue();
+    this.indentWidth$.next(Math.max(originalWidth + delta, 0));
 
     if (!block) {
       return;
@@ -663,7 +671,7 @@ class ToolingLog {
       try {
         return await block();
       } finally {
-        this.indentWidth = originalWidth;
+        this.indentWidth$.next(originalWidth);
       }
     })();
   }
@@ -697,26 +705,41 @@ class ToolingLog {
   }
 
   getWriters() {
-    return this.writers.slice(0);
+    return [...this.writers$.getValue()];
   }
 
   setWriters(writers) {
-    this.writers = [...writers];
+    this.writers$.next([...writers]);
   }
 
   getWritten$() {
     return this.written$.asObservable();
   }
+  /**
+   * Create a new ToolingLog which sets a different "type", allowing messages to be filtered out by "source"
+   * @param type A string that will be passed along with messages from this logger which can be used to filter messages with `ignoreSources`
+   */
+
+
+  withType(type) {
+    return new ToolingLog(undefined, {
+      type,
+      parent: this
+    });
+  }
 
   sendToWriters(type, args) {
+    const indent = this.indentWidth$.getValue();
+    const writers = this.writers$.getValue();
     const msg = {
       type,
-      indent: this.indentWidth,
+      indent,
+      source: this.type,
       args
     };
     let written = false;
 
-    for (const writer of this.writers) {
+    for (const writer of writers) {
       if (writer.write(msg)) {
         written = true;
       }
@@ -6618,8 +6641,10 @@ class ToolingLogTextWriter {
   constructor(config) {
     (0, _defineProperty2.default)(this, "level", void 0);
     (0, _defineProperty2.default)(this, "writeTo", void 0);
+    (0, _defineProperty2.default)(this, "ignoreSources", void 0);
     this.level = (0, _log_levels.parseLogLevel)(config.level);
     this.writeTo = config.writeTo;
+    this.ignoreSources = config.ignoreSources;
 
     if (!this.writeTo || typeof this.writeTo.write !== 'function') {
       throw new Error('ToolingLogTextWriter requires the `writeTo` option be set to a stream (like process.stdout)');
@@ -6631,6 +6656,10 @@ class ToolingLogTextWriter {
       return false;
     }
 
+    if (this.ignoreSources && msg.source && this.ignoreSources.includes(msg.source)) {
+      return false;
+    }
+
     const prefix = has(MSG_PREFIXES, msg.type) ? MSG_PREFIXES[msg.type] : '';
     ToolingLogTextWriter.write(this.writeTo, prefix, msg);
     return true;
@@ -8773,6 +8802,20 @@ class ToolingLogCollectingWriter extends _tooling_log_text_writer.ToolingLogText
     });
     (0, _defineProperty2.default)(this, "messages", []);
   }
+  /**
+   * Called by ToolingLog, extends messages with the source if message includes one.
+   */
+
+
+  write(msg) {
+    if (msg.source) {
+      return super.write({ ...msg,
+        args: [`source[${msg.source}]`, ...msg.args]
+      });
+    }
+
+    return super.write(msg);
+  }
 
 }
 
@@ -15466,6 +15509,12 @@ exports.parseConfig = parseConfig;
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
+
+/**
+ * Information about how CiStatsReporter should talk to the ci-stats service. Normally
+ * it is read from a JSON environment variable using the `parseConfig()` function
+ * exported by this module.
+ */
 function validateConfig(log, config) {
   const validApiToken = typeof config.apiToken === 'string' && config.apiToken.length !== 0;
 
diff --git a/packages/kbn-test/src/functional_test_runner/lib/mocha/reporter/reporter.js b/packages/kbn-test/src/functional_test_runner/lib/mocha/reporter/reporter.js
index 43229ff2d1c98d..d6045b71bf3a78 100644
--- a/packages/kbn-test/src/functional_test_runner/lib/mocha/reporter/reporter.js
+++ b/packages/kbn-test/src/functional_test_runner/lib/mocha/reporter/reporter.js
@@ -62,6 +62,7 @@ export function MochaReporterProvider({ getService }) {
         log.setWriters([
           new ToolingLogTextWriter({
             level: 'error',
+            ignoreSources: ['ProcRunner', '@kbn/es Cluster'],
             writeTo: process.stdout,
           }),
           new ToolingLogTextWriter({
@@ -136,7 +137,7 @@ export function MochaReporterProvider({ getService }) {
     onPass = (test) => {
       const time = colors.speed(test.speed, ` (${ms(test.duration)})`);
       const pass = colors.pass(`${symbols.ok} pass`);
-      log.write(`- ${pass} ${time} "${test.fullTitle()}"`);
+      log.write(`- ${pass} ${time}`);
     };
 
     onFail = (runnable) => {
diff --git a/packages/kbn-test/src/functional_tests/tasks.ts b/packages/kbn-test/src/functional_tests/tasks.ts
index c8265c032cbccd..b220c3899a638f 100644
--- a/packages/kbn-test/src/functional_tests/tasks.ts
+++ b/packages/kbn-test/src/functional_tests/tasks.ts
@@ -90,7 +90,7 @@ export async function runTests(options: RunTestsParams) {
   log.write('--- determining which ftr configs to run');
   const configPathsWithTests: string[] = [];
   for (const configPath of options.configs) {
-    log.info('testing', configPath);
+    log.info('testing', relative(REPO_ROOT, configPath));
     await log.indent(4, async () => {
       if (await hasTests({ configPath, options: { ...options, log } })) {
         configPathsWithTests.push(configPath);
@@ -98,9 +98,10 @@ export async function runTests(options: RunTestsParams) {
     });
   }
 
-  for (const configPath of configPathsWithTests) {
+  for (const [i, configPath] of configPathsWithTests.entries()) {
     await log.indent(0, async () => {
-      log.write(`--- Running ${relative(REPO_ROOT, configPath)}`);
+      const progress = `${i + 1}/${configPathsWithTests.length}`;
+      log.write(`--- [${progress}] Running ${relative(REPO_ROOT, configPath)}`);
 
       await withProcRunner(log, async (procs) => {
         const config = await readConfigFile(log, configPath);
diff --git a/test/functional/services/remote/remote.ts b/test/functional/services/remote/remote.ts
index 5bf99b4bf1136b..653058959b839b 100644
--- a/test/functional/services/remote/remote.ts
+++ b/test/functional/services/remote/remote.ts
@@ -92,7 +92,7 @@ export async function RemoteProvider({ getService }: FtrProviderContext) {
     .subscribe({
       next({ message, level }) {
         const msg = message.replace(/\\n/g, '\n');
-        log[level === 'SEVERE' || level === 'error' ? 'error' : 'debug'](
+        log[level === 'SEVERE' || level === 'error' ? 'warning' : 'debug'](
           `browser[${level}] ${msg}`
         );
       },

From 9f07f71500ca1871a0a0585b81268c028e60577d Mon Sep 17 00:00:00 2001
From: Tyler Smalley <tyler.smalley@elastic.co>
Date: Wed, 13 Oct 2021 09:06:52 -0700
Subject: [PATCH 10/71] [build] Ironbank template updates (#114749)

* [build] Ironbank template updates

Signed-off-by: Tyler Smalley <tyler.smalley@elastic.co>

* Use placeholder

Signed-off-by: Tyler Smalley <tyler.smalley@elastic.co>
---
 .../docker_generator/bundle_dockerfiles.ts    |  10 +-
 .../resources/ironbank/LICENSE                | 280 ------------------
 .../templates/ironbank/README.md              |   4 +-
 .../ironbank/hardening_manifest.yaml          |   4 +
 4 files changed, 12 insertions(+), 286 deletions(-)
 delete mode 100644 src/dev/build/tasks/os_packages/docker_generator/resources/ironbank/LICENSE

diff --git a/src/dev/build/tasks/os_packages/docker_generator/bundle_dockerfiles.ts b/src/dev/build/tasks/os_packages/docker_generator/bundle_dockerfiles.ts
index 5f0665692b46f6..02b469820f900d 100644
--- a/src/dev/build/tasks/os_packages/docker_generator/bundle_dockerfiles.ts
+++ b/src/dev/build/tasks/os_packages/docker_generator/bundle_dockerfiles.ts
@@ -8,8 +8,9 @@
 
 import { resolve } from 'path';
 import { readFileSync } from 'fs';
+import { copyFile } from 'fs/promises';
 
-import { ToolingLog } from '@kbn/dev-utils';
+import { ToolingLog, REPO_ROOT } from '@kbn/dev-utils';
 import Mustache from 'mustache';
 
 import { compressTar, copyAll, mkdirp, write, Config } from '../../../lib';
@@ -39,9 +40,10 @@ export async function bundleDockerFiles(config: Config, log: ToolingLog, scope:
   await copyAll(resolve(scope.dockerBuildDir, 'bin'), resolve(dockerFilesBuildDir, 'bin'));
   await copyAll(resolve(scope.dockerBuildDir, 'config'), resolve(dockerFilesBuildDir, 'config'));
   if (scope.ironbank) {
-    await copyAll(resolve(scope.dockerBuildDir), resolve(dockerFilesBuildDir), {
-      select: ['LICENSE'],
-    });
+    await copyFile(
+      resolve(REPO_ROOT, 'licenses/ELASTIC-LICENSE-2.0.txt'),
+      resolve(dockerFilesBuildDir, 'LICENSE')
+    );
     const templates = ['hardening_manifest.yaml', 'README.md'];
     for (const template of templates) {
       const file = readFileSync(resolve(__dirname, 'templates/ironbank', template));
diff --git a/src/dev/build/tasks/os_packages/docker_generator/resources/ironbank/LICENSE b/src/dev/build/tasks/os_packages/docker_generator/resources/ironbank/LICENSE
deleted file mode 100644
index 632c3abe22e9be..00000000000000
--- a/src/dev/build/tasks/os_packages/docker_generator/resources/ironbank/LICENSE
+++ /dev/null
@@ -1,280 +0,0 @@
-ELASTIC LICENSE AGREEMENT
-
-PLEASE READ CAREFULLY THIS ELASTIC LICENSE AGREEMENT (THIS "AGREEMENT"), WHICH
-CONSTITUTES A LEGALLY BINDING AGREEMENT AND GOVERNS ALL OF YOUR USE OF ALL OF
-THE ELASTIC SOFTWARE WITH WHICH THIS AGREEMENT IS INCLUDED ("ELASTIC SOFTWARE")
-THAT IS PROVIDED IN OBJECT CODE FORMAT, AND, IN ACCORDANCE WITH SECTION 2 BELOW,
-CERTAIN OF THE ELASTIC SOFTWARE THAT IS PROVIDED IN SOURCE CODE FORMAT. BY
-INSTALLING OR USING ANY OF THE ELASTIC SOFTWARE GOVERNED BY THIS AGREEMENT, YOU
-ARE ASSENTING TO THE TERMS AND CONDITIONS OF THIS AGREEMENT. IF YOU DO NOT AGREE
-WITH SUCH TERMS AND CONDITIONS, YOU MAY NOT INSTALL OR USE THE ELASTIC SOFTWARE
-GOVERNED BY THIS AGREEMENT. IF YOU ARE INSTALLING OR USING THE SOFTWARE ON
-BEHALF OF A LEGAL ENTITY, YOU REPRESENT AND WARRANT THAT YOU HAVE THE ACTUAL
-AUTHORITY TO AGREE TO THE TERMS AND CONDITIONS OF THIS AGREEMENT ON BEHALF OF
-SUCH ENTITY.
-
-Posted Date: April 20, 2018
-
-This Agreement is entered into by and between Elasticsearch BV ("Elastic") and
-You, or the legal entity on behalf of whom You are acting (as applicable,
-"You").
-
-1. OBJECT CODE END USER LICENSES, RESTRICTIONS AND THIRD PARTY OPEN SOURCE
-SOFTWARE
-
-  1.1 Object Code End User License. Subject to the terms and conditions of
-  Section 1.2 of this Agreement, Elastic hereby grants to You, AT NO CHARGE and
-  for so long as you are not in breach of any provision of this Agreement, a
-  License to the Basic Features and Functions of the Elastic Software.
-
-  1.2 Reservation of Rights; Restrictions. As between Elastic and You, Elastic
-  and its licensors own all right, title and interest in and to the Elastic
-  Software, and except as expressly set forth in Sections 1.1, and 2.1 of this
-  Agreement, no other license to the Elastic Software is granted to You under
-  this Agreement, by implication, estoppel or otherwise. You agree not to: (i)
-  reverse engineer or decompile, decrypt, disassemble or otherwise reduce any
-  Elastic Software provided to You in Object Code, or any portion thereof, to
-  Source Code, except and only to the extent any such restriction is prohibited
-  by applicable law, (ii) except as expressly permitted in this Agreement,
-  prepare derivative works from, modify, copy or use the Elastic Software Object
-  Code or the Commercial Software Source Code in any manner; (iii) except as
-  expressly permitted in Section 1.1 above, transfer, sell, rent, lease,
-  distribute, sublicense, loan or otherwise transfer, Elastic Software Object
-  Code, in whole or in part, to any third party; (iv) use Elastic Software
-  Object Code for providing time-sharing services, any software-as-a-service,
-  service bureau services or as part of an application services provider or
-  other service offering (collectively, "SaaS Offering") where obtaining access
-  to the Elastic Software or the features and functions of the Elastic Software
-  is a primary reason or substantial motivation for users of the SaaS Offering
-  to access and/or use the SaaS Offering ("Prohibited SaaS Offering"); (v)
-  circumvent the limitations on use of Elastic Software provided to You in
-  Object Code format that are imposed or preserved by any License Key, or (vi)
-  alter or remove any Marks and Notices in the Elastic Software. If You have any
-  question as to whether a specific SaaS Offering constitutes a Prohibited SaaS
-  Offering, or are interested in obtaining Elastic's permission to engage in
-  commercial or non-commercial distribution of the Elastic Software, please
-  contact elastic_license@elastic.co.
-
-  1.3 Third Party Open Source Software. The Commercial Software may contain or
-  be provided with third party open source libraries, components, utilities and
-  other open source software (collectively, "Open Source Software"), which Open
-  Source Software may have applicable license terms as identified on a website
-  designated by Elastic. Notwithstanding anything to the contrary herein, use of
-  the Open Source Software shall be subject to the license terms and conditions
-  applicable to such Open Source Software, to the extent required by the
-  applicable licensor (which terms shall not restrict the license rights granted
-  to You hereunder, but may contain additional rights). To the extent any
-  condition of this Agreement conflicts with any license to the Open Source
-  Software, the Open Source Software license will govern with respect to such
-  Open Source Software only. Elastic may also separately provide you with
-  certain open source software that is licensed by Elastic. Your use of such
-  Elastic open source software will not be governed by this Agreement, but by
-  the applicable open source license terms.
-
-2. COMMERCIAL SOFTWARE SOURCE CODE
-
-  2.1 Limited License. Subject to the terms and conditions of Section 2.2 of
-  this Agreement, Elastic hereby grants to You, AT NO CHARGE and for so long as
-  you are not in breach of any provision of this Agreement, a limited,
-  non-exclusive, non-transferable, fully paid up royalty free right and license
-  to the Commercial Software in Source Code format, without the right to grant
-  or authorize sublicenses, to prepare Derivative Works of the Commercial
-  Software, provided You (i) do not hack the licensing mechanism, or otherwise
-  circumvent the intended limitations on the use of Elastic Software to enable
-  features other than Basic Features and Functions or those features You are
-  entitled to as part of a Subscription, and (ii) use the resulting object code
-  only for reasonable testing purposes.
-
-  2.2 Restrictions. Nothing in Section 2.1 grants You the right to (i) use the
-  Commercial Software Source Code other than in accordance with Section 2.1
-  above, (ii) use a Derivative Work of the Commercial Software outside of a
-  Non-production Environment, in any production capacity, on a temporary or
-  permanent basis, or (iii) transfer, sell, rent, lease, distribute, sublicense,
-  loan or otherwise make available the Commercial Software Source Code, in whole
-  or in part, to any third party. Notwithstanding the foregoing, You may
-  maintain a copy of the repository in which the Source Code of the Commercial
-  Software resides and that copy may be publicly accessible, provided that you
-  include this Agreement with Your copy of the repository.
-
-3. TERMINATION
-
-  3.1 Termination. This Agreement will automatically terminate, whether or not
-  You receive notice of such Termination from Elastic, if You breach any of its
-  provisions.
-
-  3.2 Post Termination. Upon any termination of this Agreement, for any reason,
-  You shall promptly cease the use of the Elastic Software in Object Code format
-  and cease use of the Commercial Software in Source Code format. For the
-  avoidance of doubt, termination of this Agreement will not affect Your right
-  to use Elastic Software, in either Object Code or Source Code formats, made
-  available under the Apache License Version 2.0.
-
-  3.3 Survival. Sections 1.2, 2.2. 3.3, 4 and 5 shall survive any termination or
-  expiration of this Agreement.
-
-4. DISCLAIMER OF WARRANTIES AND LIMITATION OF LIABILITY
-
-  4.1 Disclaimer of Warranties. TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE
-  LAW, THE ELASTIC SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND,
-  AND ELASTIC AND ITS LICENSORS MAKE NO WARRANTIES WHETHER EXPRESSED, IMPLIED OR
-  STATUTORY REGARDING OR RELATING TO THE ELASTIC SOFTWARE. TO THE MAXIMUM EXTENT
-  PERMITTED UNDER APPLICABLE LAW, ELASTIC AND ITS LICENSORS SPECIFICALLY
-  DISCLAIM ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
-  PURPOSE AND NON-INFRINGEMENT WITH RESPECT TO THE ELASTIC SOFTWARE, AND WITH
-  RESPECT TO THE USE OF THE FOREGOING. FURTHER, ELASTIC DOES NOT WARRANT RESULTS
-  OF USE OR THAT THE ELASTIC SOFTWARE WILL BE ERROR FREE OR THAT THE USE OF THE
-  ELASTIC SOFTWARE WILL BE UNINTERRUPTED.
-
-  4.2 Limitation of Liability. IN NO EVENT SHALL ELASTIC OR ITS LICENSORS BE
-  LIABLE TO YOU OR ANY THIRD PARTY FOR ANY DIRECT OR INDIRECT DAMAGES,
-  INCLUDING, WITHOUT LIMITATION, FOR ANY LOSS OF PROFITS, LOSS OF USE, BUSINESS
-  INTERRUPTION, LOSS OF DATA, COST OF SUBSTITUTE GOODS OR SERVICES, OR FOR ANY
-  SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES OF ANY KIND, IN CONNECTION WITH
-  OR ARISING OUT OF THE USE OR INABILITY TO USE THE ELASTIC SOFTWARE, OR THE
-  PERFORMANCE OF OR FAILURE TO PERFORM THIS AGREEMENT, WHETHER ALLEGED AS A
-  BREACH OF CONTRACT OR TORTIOUS CONDUCT, INCLUDING NEGLIGENCE, EVEN IF ELASTIC
-  HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
-
-5. MISCELLANEOUS
-
-  This Agreement completely and exclusively states the entire agreement of the
-  parties regarding the subject matter herein, and it supersedes, and its terms
-  govern, all prior proposals, agreements, or other communications between the
-  parties, oral or written, regarding such subject matter. This Agreement may be
-  modified by Elastic from time to time, and any such modifications will be
-  effective upon the "Posted Date" set forth at the top of the modified
-  Agreement. If any provision hereof is held unenforceable, this Agreement will
-  continue without said provision and be interpreted to reflect the original
-  intent of the parties. This Agreement and any non-contractual obligation
-  arising out of or in connection with it, is governed exclusively by Dutch law.
-  This Agreement shall not be governed by the 1980 UN Convention on Contracts
-  for the International Sale of Goods. All disputes arising out of or in
-  connection with this Agreement, including its existence and validity, shall be
-  resolved by the courts with jurisdiction in Amsterdam, The Netherlands, except
-  where mandatory law provides for the courts at another location in The
-  Netherlands to have jurisdiction. The parties hereby irrevocably waive any and
-  all claims and defenses either might otherwise have in any such action or
-  proceeding in any of such courts based upon any alleged lack of personal
-  jurisdiction, improper venue, forum non conveniens or any similar claim or
-  defense. A breach or threatened breach, by You of Section 2 may cause
-  irreparable harm for which damages at law may not provide adequate relief, and
-  therefore Elastic shall be entitled to seek injunctive relief without being
-  required to post a bond. You may not assign this Agreement (including by
-  operation of law in connection with a merger or acquisition), in whole or in
-  part to any third party without the prior written consent of Elastic, which
-  may be withheld or granted by Elastic in its sole and absolute discretion.
-  Any assignment in violation of the preceding sentence is void. Notices to
-  Elastic may also be sent to legal@elastic.co.
-
-6. DEFINITIONS
-
-  The following terms have the meanings ascribed:
-
-  6.1 "Affiliate" means, with respect to a party, any entity that controls, is
-  controlled by, or which is under common control with, such party, where
-  "control" means ownership of at least fifty percent (50%) of the outstanding
-  voting shares of the entity, or the contractual right to establish policy for,
-  and manage the operations of, the entity.
-
-  6.2 "Basic Features and Functions" means those features and functions of the
-  Elastic Software that are eligible for use under a Basic license, as set forth
-  at https://www.elastic.co/subscriptions, as may be modified by Elastic from
-  time to time.
-
-  6.3 "Commercial Software" means the Elastic Software Source Code in any file
-  containing a header stating the contents are subject to the Elastic License or
-  which is contained in the repository folder labeled "x-pack", unless a LICENSE
-  file present in the directory subtree declares a different license.
-
-  6.4 "Derivative Work of the Commercial Software" means, for purposes of this
-  Agreement, any modification(s) or enhancement(s) to the Commercial Software,
-  which represent, as a whole, an original work of authorship.
-
-  6.5 "License" means a limited, non-exclusive, non-transferable, fully paid up,
-  royalty free, right and license, without the right to grant or authorize
-  sublicenses, solely for Your internal business operations to (i) install and
-  use the applicable Features and Functions of the Elastic Software in Object
-  Code, and (ii) permit Contractors and Your Affiliates to use the Elastic
-  software as set forth in (i) above, provided that such use by Contractors must
-  be solely for Your benefit and/or the benefit of Your Affiliates, and You
-  shall be responsible for all acts and omissions of such Contractors and
-  Affiliates in connection with their use of the Elastic software that are
-  contrary to the terms and conditions of this Agreement.
-
-  6.6 "License Key" means a sequence of bytes, including but not limited to a
-  JSON blob, that is used to enable certain features and functions of the
-  Elastic Software.
-
-  6.7 "Marks and Notices" means all Elastic trademarks, trade names, logos and
-  notices present on the Documentation as originally provided by Elastic.
-
-  6.8 "Non-production Environment" means an environment for development, testing
-  or quality assurance, where software is not used for production purposes.
-
-  6.9 "Object Code" means any form resulting from mechanical transformation or
-  translation of Source Code form, including but not limited to compiled object
-  code, generated documentation, and conversions to other media types.
-
-  6.10 "Source Code" means the preferred form of computer software for making
-  modifications, including but not limited to software source code,
-  documentation source, and configuration files.
-
-  6.11 "Subscription" means the right to receive Support Services and a License
-  to the Commercial Software.
-
-  
-GOVERNMENT END USER ADDENDUM TO THE ELASTIC LICENSE AGREEMENT
-
-    This ADDENDUM TO THE ELASTIC LICENSE AGREEMENT (this "Addendum") applies
-only to U.S. Federal Government, State Government, and Local Government
-entities ("Government End Users") of the Elastic Software.  This Addendum is
-subject to, and hereby incorporated into, the Elastic License Agreement,
-which is being entered into as of even date herewith, by Elastic and You (the
-"Agreement").  This Addendum sets forth additional terms and conditions
-related to Your use of the Elastic Software. Capitalized terms not defined in
-this Addendum have the meaning set forth in the Agreement.
-
-    1. LIMITED LICENSE TO DISTRIBUTE (DSOP ONLY).  Subject to the terms and
-conditions of the Agreement (including this Addendum), Elastic grants the
-Department of Defense Enterprise DevSecOps Initiative (DSOP) a royalty-free,
-non-exclusive, non-transferable, limited license to reproduce and distribute
-the Elastic Software solely through a software distribution repository
-controlled and managed by DSOP, provided that DSOP: (i) distributes the
-Elastic Software complete and unmodified, inclusive of the Agreement
-(including this Addendum) and (ii) does not remove or alter any proprietary
-legends or notices contained in the Elastic Software.
-
-    2. CHOICE OF LAW.  The choice of law and venue provisions set forth shall
-prevail over those set forth in Section 5 of the Agreement.
-
-      "For U.S. Federal Government Entity End Users. This Agreement and any
-  non-contractual obligation arising out of or in connection with it, is
-  governed exclusively by U.S. Federal law.  To the extent permitted by
-  federal law, the laws of the State of Delaware (excluding Delaware choice
-  of law rules) will apply in the absence of applicable federal law.
-
-      For State and Local Government Entity End Users. This Agreement and any
-  non-contractual obligation arising out of or in connection with it, is
-  governed exclusively by the laws of the state in which you are located
-  without reference to conflict of laws.  Furthermore, the Parties agree that
-  the Uniform Computer Information Transactions Act or any version  thereof,
-  adopted by any state in  any form ('UCITA'), shall not apply to  this
-  Agreement and, to the extent that UCITA is applicable, the Parties agree to
-  opt out of the applicability of UCITA pursuant to the opt-out provision(s)
-  contained therein."
-
-    3. ELASTIC LICENSE MODIFICATION.  Section 5 of the Agreement is hereby
-amended to replace
-
-      "This Agreement may be modified by Elastic from time to time, and any
-  such modifications will be effective upon the "Posted Date" set forth at
-  the top of the modified Agreement."
-
-        with:
-
-      "This Agreement may be modified by Elastic from time to time; provided,
-  however, that any such modifications shall apply only to Elastic Software
-  that is installed after the "Posted Date" set forth at the top of the
-  modified Agreement." 
-  
-V100820.0
diff --git a/src/dev/build/tasks/os_packages/docker_generator/templates/ironbank/README.md b/src/dev/build/tasks/os_packages/docker_generator/templates/ironbank/README.md
index d297d135149f47..d81b219900a852 100644
--- a/src/dev/build/tasks/os_packages/docker_generator/templates/ironbank/README.md
+++ b/src/dev/build/tasks/os_packages/docker_generator/templates/ironbank/README.md
@@ -31,9 +31,9 @@ You can learn more about the Elastic Community and also understand how to get mo
 visiting [Elastic Community](https://www.elastic.co/community).
 
 This software is governed by the [Elastic
-License](https://github.com/elastic/elasticsearch/blob/{{branch}}/licenses/ELASTIC-LICENSE.txt),
+License](https://github.com/elastic/kibana/blob/{{branch}}/licenses/ELASTIC-LICENSE-2.0.txt),
 and includes the full set of [free
 features](https://www.elastic.co/subscriptions).
 
 View the detailed release notes
-[here](https://www.elastic.co/guide/en/elasticsearch/reference/{{branch}}/es-release-notes.html).
+[here](https://www.elastic.co/guide/en/kibana/{{branch}}/release-notes-{{version}}.html).
diff --git a/src/dev/build/tasks/os_packages/docker_generator/templates/ironbank/hardening_manifest.yaml b/src/dev/build/tasks/os_packages/docker_generator/templates/ironbank/hardening_manifest.yaml
index 2e65e68bc28827..24614039e5eb75 100644
--- a/src/dev/build/tasks/os_packages/docker_generator/templates/ironbank/hardening_manifest.yaml
+++ b/src/dev/build/tasks/os_packages/docker_generator/templates/ironbank/hardening_manifest.yaml
@@ -56,3 +56,7 @@ maintainers:
     name: 'Alexander Klepal'
     username: 'alexander.klepal'
     cht_member: true
+  - email: "yalabe.dukuly@anchore.com"
+    name: "Yalabe Dukuly"
+    username: "yalabe.dukuly"
+    cht_member: true
\ No newline at end of file

From 3ab04b67f878cb126b986474bbfdaa84ad8abbc4 Mon Sep 17 00:00:00 2001
From: Josh Dover <1813008+joshdover@users.noreply.github.com>
Date: Wed, 13 Oct 2021 10:20:20 -0600
Subject: [PATCH 11/71] Allow users with read access to view Integrations app
 (#113925)

---
 .../public/applications/integrations/app.tsx  |  77 ++--------
 .../epm/screens/detail/assets/assets.tsx      |  23 ++-
 .../epm/screens/detail/index.test.tsx         |  13 ++
 .../sections/epm/screens/detail/index.tsx     | 143 ++++++++++++++----
 .../fleet/public/components/header.tsx        |   3 +
 .../fleet/public/hooks/use_request/app.ts     |   9 +-
 x-pack/plugins/fleet/server/mocks/index.ts    |   3 +-
 x-pack/plugins/fleet/server/plugin.ts         |  23 ++-
 .../plugins/fleet/server/routes/app/index.ts  |  27 ++--
 .../plugins/fleet/server/routes/epm/index.ts  |  15 +-
 .../plugins/fleet/server/routes/security.ts   |   8 +
 .../fleet/server/services/app_context.ts      |  21 ++-
 .../server/services/epm/archive/cache.ts      |   8 +
 .../server/services/epm/archive/index.ts      |   4 +
 .../plugins/fleet/storybook/context/http.ts   |   4 +
 .../translations/translations/ja-JP.json      |   3 -
 .../translations/translations/zh-CN.json      |   3 -
 .../fleet_api_integration/apis/agents/list.ts |  57 +------
 .../apis/epm/bulk_upgrade.ts                  |   9 ++
 .../fleet_api_integration/apis/epm/delete.ts  |  10 ++
 .../fleet_api_integration/apis/epm/get.ts     |   9 ++
 .../apis/epm/install_by_upload.ts             |  13 ++
 .../fleet_api_integration/apis/epm/list.ts    |   9 ++
 .../test/fleet_api_integration/apis/index.js  |  10 +-
 .../fleet_api_integration/apis/test_users.ts  |  63 ++++++++
 25 files changed, 370 insertions(+), 197 deletions(-)
 create mode 100644 x-pack/test/fleet_api_integration/apis/test_users.ts

diff --git a/x-pack/plugins/fleet/public/applications/integrations/app.tsx b/x-pack/plugins/fleet/public/applications/integrations/app.tsx
index b10cef9d3ffe4e..771b17ae8c3ee6 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/app.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/app.tsx
@@ -7,12 +7,10 @@
 
 import React, { memo, useEffect, useState } from 'react';
 import type { AppMountParameters } from 'kibana/public';
-import { EuiCode, EuiEmptyPrompt, EuiErrorBoundary, EuiPanel, EuiPortal } from '@elastic/eui';
+import { EuiErrorBoundary, EuiPortal } from '@elastic/eui';
 import type { History } from 'history';
 import { Router, Redirect, Route, Switch } from 'react-router-dom';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { i18n } from '@kbn/i18n';
-import styled from 'styled-components';
 import useObservable from 'react-use/lib/useObservable';
 
 import {
@@ -49,29 +47,23 @@ const ErrorLayout = ({ children }: { children: JSX.Element }) => (
   </EuiErrorBoundary>
 );
 
-const Panel = styled(EuiPanel)`
-  max-width: 500px;
-  margin-right: auto;
-  margin-left: auto;
-`;
-
 export const WithPermissionsAndSetup: React.FC = memo(({ children }) => {
   useBreadcrumbs('integrations');
 
   const [isPermissionsLoading, setIsPermissionsLoading] = useState<boolean>(false);
-  const [permissionsError, setPermissionsError] = useState<string>();
   const [isInitialized, setIsInitialized] = useState(false);
   const [initializationError, setInitializationError] = useState<Error | null>(null);
 
   useEffect(() => {
     (async () => {
-      setPermissionsError(undefined);
       setIsInitialized(false);
       setInitializationError(null);
       try {
+        // Attempt Fleet Setup if user has permissions, otherwise skip
         setIsPermissionsLoading(true);
         const permissionsResponse = await sendGetPermissionsCheck();
         setIsPermissionsLoading(false);
+
         if (permissionsResponse.data?.success) {
           try {
             const setupResponse = await sendSetup();
@@ -83,69 +75,20 @@ export const WithPermissionsAndSetup: React.FC = memo(({ children }) => {
           }
           setIsInitialized(true);
         } else {
-          setPermissionsError(permissionsResponse.data?.error || 'REQUEST_ERROR');
+          setIsInitialized(true);
         }
-      } catch (err) {
-        setPermissionsError('REQUEST_ERROR');
+      } catch {
+        // If there's an error checking permissions, default to proceeding without running setup
+        // User will only have access to EPM endpoints if they actually have permission
+        setIsInitialized(true);
       }
     })();
   }, []);
 
-  if (isPermissionsLoading || permissionsError) {
+  if (isPermissionsLoading) {
     return (
       <ErrorLayout>
-        {isPermissionsLoading ? (
-          <Loading />
-        ) : permissionsError === 'REQUEST_ERROR' ? (
-          <Error
-            title={
-              <FormattedMessage
-                id="xpack.fleet.permissionsRequestErrorMessageTitle"
-                defaultMessage="Unable to check permissions"
-              />
-            }
-            error={i18n.translate('xpack.fleet.permissionsRequestErrorMessageDescription', {
-              defaultMessage: 'There was a problem checking Fleet permissions',
-            })}
-          />
-        ) : (
-          <Panel>
-            <EuiEmptyPrompt
-              iconType="securityApp"
-              title={
-                <h2>
-                  {permissionsError === 'MISSING_SUPERUSER_ROLE' ? (
-                    <FormattedMessage
-                      id="xpack.fleet.permissionDeniedErrorTitle"
-                      defaultMessage="Permission denied"
-                    />
-                  ) : (
-                    <FormattedMessage
-                      id="xpack.fleet.securityRequiredErrorTitle"
-                      defaultMessage="Security is not enabled"
-                    />
-                  )}
-                </h2>
-              }
-              body={
-                <p>
-                  {permissionsError === 'MISSING_SUPERUSER_ROLE' ? (
-                    <FormattedMessage
-                      id="xpack.fleet.integrationsPermissionDeniedErrorMessage"
-                      defaultMessage="You are not authorized to access Integrations. Integrations requires {roleName} privileges."
-                      values={{ roleName: <EuiCode>superuser</EuiCode> }}
-                    />
-                  ) : (
-                    <FormattedMessage
-                      id="xpack.fleet.integrationsSecurityRequiredErrorMessage"
-                      defaultMessage="You must enable security in Kibana and Elasticsearch to use Integrations."
-                    />
-                  )}
-                </p>
-              }
-            />
-          </Panel>
-        )}
+        <Loading />
       </ErrorLayout>
     );
   }
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/assets/assets.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/assets/assets.tsx
index 6d075faeef308a..a8d27580e0bd18 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/assets/assets.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/assets/assets.tsx
@@ -9,6 +9,7 @@ import React, { useEffect, useState } from 'react';
 import { Redirect } from 'react-router-dom';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiFlexGroup, EuiFlexItem, EuiTitle, EuiSpacer } from '@elastic/eui';
+import { groupBy } from 'lodash';
 
 import { Loading, Error, ExtensionWrapper } from '../../../../../components';
 
@@ -67,8 +68,26 @@ export const AssetsPage = ({ packageInfo }: AssetsPanelProps) => {
             id,
             type,
           }));
-          const { savedObjects } = await savedObjectsClient.bulkGet(objectsToGet);
-          setAssetsSavedObjects(savedObjects as AssetSavedObject[]);
+
+          // We don't have an API to know which SO types a user has access to, so instead we make a request for each
+          // SO type and ignore the 403 errors
+          const objectsByType = await Promise.all(
+            Object.entries(groupBy(objectsToGet, 'type')).map(([type, objects]) =>
+              savedObjectsClient
+                .bulkGet(objects)
+                // Ignore privilege errors
+                .catch((e: any) => {
+                  if (e?.body?.statusCode === 403) {
+                    return { savedObjects: [] };
+                  } else {
+                    throw e;
+                  }
+                })
+                .then(({ savedObjects }) => savedObjects as AssetSavedObject[])
+            )
+          );
+
+          setAssetsSavedObjects(objectsByType.flat());
         } catch (e) {
           setFetchError(e);
         } finally {
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.test.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.test.tsx
index d70b6c68016bee..d442f8a13e27e2 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.test.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.test.tsx
@@ -11,6 +11,7 @@ import { act, cleanup } from '@testing-library/react';
 
 import { INTEGRATIONS_ROUTING_PATHS, pagePathGetters } from '../../../../constants';
 import type {
+  CheckPermissionsResponse,
   GetAgentPoliciesResponse,
   GetFleetStatusResponse,
   GetInfoResponse,
@@ -23,6 +24,7 @@ import type {
 } from '../../../../../../../common/types/models';
 import {
   agentPolicyRouteService,
+  appRoutesService,
   epmRouteService,
   fleetSetupRouteService,
   packagePolicyRouteService,
@@ -260,6 +262,7 @@ interface EpmPackageDetailsResponseProvidersMock {
   fleetSetup: jest.MockedFunction<() => GetFleetStatusResponse>;
   packagePolicyList: jest.MockedFunction<() => GetPackagePoliciesResponse>;
   agentPolicyList: jest.MockedFunction<() => GetAgentPoliciesResponse>;
+  appCheckPermissions: jest.MockedFunction<() => CheckPermissionsResponse>;
 }
 
 const mockApiCalls = (
@@ -740,6 +743,10 @@ On Windows, the module was tested with Nginx installed from the Chocolatey repos
     },
   };
 
+  const appCheckPermissionsResponse: CheckPermissionsResponse = {
+    success: true,
+  };
+
   const mockedApiInterface: MockedApi<EpmPackageDetailsResponseProvidersMock> = {
     waitForApi() {
       return new Promise((resolve) => {
@@ -757,6 +764,7 @@ On Windows, the module was tested with Nginx installed from the Chocolatey repos
       fleetSetup: jest.fn().mockReturnValue(agentsSetupResponse),
       packagePolicyList: jest.fn().mockReturnValue(packagePoliciesResponse),
       agentPolicyList: jest.fn().mockReturnValue(agentPoliciesResponse),
+      appCheckPermissions: jest.fn().mockReturnValue(appCheckPermissionsResponse),
     },
   };
 
@@ -792,6 +800,11 @@ On Windows, the module was tested with Nginx installed from the Chocolatey repos
         return mockedApiInterface.responseProvider.epmGetStats();
       }
 
+      if (path === appRoutesService.getCheckPermissionsPath()) {
+        markApiCallAsHandled();
+        return mockedApiInterface.responseProvider.appCheckPermissions();
+      }
+
       const err = new Error(`API [GET ${path}] is not MOCKED!`);
       // eslint-disable-next-line no-console
       console.error(err);
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.tsx
index 82436eb4d3f512..ade290aab4e5e7 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.tsx
@@ -8,10 +8,12 @@ import type { ReactEventHandler } from 'react';
 import React, { useCallback, useEffect, useMemo, useState } from 'react';
 import { Redirect, Route, Switch, useLocation, useParams, useHistory } from 'react-router-dom';
 import styled from 'styled-components';
+import type { EuiToolTipProps } from '@elastic/eui';
 import {
   EuiBetaBadge,
   EuiButton,
   EuiButtonEmpty,
+  EuiCallOut,
   EuiDescriptionList,
   EuiDescriptionListDescription,
   EuiDescriptionListTitle,
@@ -19,6 +21,7 @@ import {
   EuiFlexItem,
   EuiSpacer,
   EuiText,
+  EuiToolTip,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
@@ -30,6 +33,7 @@ import {
   useUIExtension,
   useBreadcrumbs,
   useStartServices,
+  usePermissionCheck,
 } from '../../../../hooks';
 import {
   PLUGIN_ID,
@@ -61,6 +65,7 @@ import { OverviewPage } from './overview';
 import { PackagePoliciesPage } from './policies';
 import { SettingsPage } from './settings';
 import { CustomViewPage } from './custom';
+
 import './index.scss';
 
 export interface DetailParams {
@@ -95,7 +100,11 @@ export function Detail() {
   const { getId: getAgentPolicyId } = useAgentPolicyContext();
   const { pkgkey, panel } = useParams<DetailParams>();
   const { getHref } = useLink();
-  const hasWriteCapabilites = useCapabilities().write;
+  const hasWriteCapabilities = useCapabilities().write;
+  const permissionCheck = usePermissionCheck();
+  const missingSecurityConfiguration =
+    !permissionCheck.data?.success && permissionCheck.data?.error === 'MISSING_SECURITY';
+  const userCanInstallIntegrations = hasWriteCapabilities && permissionCheck.data?.success;
   const history = useHistory();
   const { pathname, search, hash } = useLocation();
   const queryParams = useMemo(() => new URLSearchParams(search), [search]);
@@ -127,9 +136,11 @@ export function Detail() {
   const {
     data: packageInfoData,
     error: packageInfoError,
-    isLoading,
+    isLoading: packageInfoLoading,
   } = useGetPackageInfoByKey(pkgkey);
 
+  const isLoading = packageInfoLoading || permissionCheck.isLoading;
+
   const showCustomTab =
     useUIExtension(packageInfoData?.response.name ?? '', 'package-detail-custom') !== undefined;
 
@@ -327,10 +338,9 @@ export function Detail() {
               { isDivider: true },
               {
                 content: (
-                  // eslint-disable-next-line @elastic/eui/href-or-on-click
-                  <EuiButton
+                  <EuiButtonWithTooltip
                     fill
-                    isDisabled={!hasWriteCapabilites}
+                    isDisabled={!userCanInstallIntegrations}
                     iconType="plusInCircle"
                     href={getHref('add_integration_to_policy', {
                       pkgkey,
@@ -341,6 +351,23 @@ export function Detail() {
                     })}
                     onClick={handleAddIntegrationPolicyClick}
                     data-test-subj="addIntegrationPolicyButton"
+                    tooltip={
+                      !userCanInstallIntegrations
+                        ? {
+                            content: missingSecurityConfiguration ? (
+                              <FormattedMessage
+                                id="xpack.fleet.epm.addPackagePolicyButtonSecurityRequiredTooltip"
+                                defaultMessage="To add Elastic Agent Integrations, you must have security enabled and have the minimum required privileges. Contact your administrator."
+                              />
+                            ) : (
+                              <FormattedMessage
+                                id="xpack.fleet.epm.addPackagePolicyButtonPrivilegesRequiredTooltip"
+                                defaultMessage="To add Elastic Agent integrations, you must have the minimum required privileges. Contact your adminstrator."
+                              />
+                            ),
+                          }
+                        : undefined
+                    }
                   >
                     <FormattedMessage
                       id="xpack.fleet.epm.addPackagePolicyButtonText"
@@ -349,7 +376,7 @@ export function Detail() {
                         packageName: integrationInfo?.title || packageInfo.title,
                       }}
                     />
-                  </EuiButton>
+                  </EuiButtonWithTooltip>
                 ),
               },
             ].map((item, index) => (
@@ -370,16 +397,17 @@ export function Detail() {
         </>
       ) : undefined,
     [
-      getHref,
-      handleAddIntegrationPolicyClick,
-      hasWriteCapabilites,
-      integration,
-      integrationInfo,
       packageInfo,
+      updateAvailable,
       packageInstallStatus,
+      userCanInstallIntegrations,
+      getHref,
       pkgkey,
-      updateAvailable,
+      integration,
       agentPolicyIdFromContext,
+      handleAddIntegrationPolicyClick,
+      missingSecurityConfiguration,
+      integrationInfo?.title,
     ]
   );
 
@@ -407,7 +435,7 @@ export function Detail() {
       },
     ];
 
-    if (packageInstallStatus === InstallStatus.installed) {
+    if (userCanInstallIntegrations && packageInstallStatus === InstallStatus.installed) {
       tabs.push({
         id: 'policies',
         name: (
@@ -443,21 +471,23 @@ export function Detail() {
       });
     }
 
-    tabs.push({
-      id: 'settings',
-      name: (
-        <FormattedMessage
-          id="xpack.fleet.epm.packageDetailsNav.settingsLinkText"
-          defaultMessage="Settings"
-        />
-      ),
-      isSelected: panel === 'settings',
-      'data-test-subj': `tab-settings`,
-      href: getHref('integration_details_settings', {
-        pkgkey: packageInfoKey,
-        ...(integration ? { integration } : {}),
-      }),
-    });
+    if (userCanInstallIntegrations) {
+      tabs.push({
+        id: 'settings',
+        name: (
+          <FormattedMessage
+            id="xpack.fleet.epm.packageDetailsNav.settingsLinkText"
+            defaultMessage="Settings"
+          />
+        ),
+        isSelected: panel === 'settings',
+        'data-test-subj': `tab-settings`,
+        href: getHref('integration_details_settings', {
+          pkgkey: packageInfoKey,
+          ...(integration ? { integration } : {}),
+        }),
+      });
+    }
 
     if (showCustomTab) {
       tabs.push({
@@ -478,13 +508,55 @@ export function Detail() {
     }
 
     return tabs;
-  }, [packageInfo, panel, getHref, integration, packageInstallStatus, showCustomTab, CustomAssets]);
+  }, [
+    packageInfo,
+    panel,
+    getHref,
+    integration,
+    userCanInstallIntegrations,
+    packageInstallStatus,
+    CustomAssets,
+    showCustomTab,
+  ]);
+
+  const securityCallout = missingSecurityConfiguration ? (
+    <>
+      <EuiCallOut
+        color="warning"
+        iconType="lock"
+        title={
+          <FormattedMessage
+            id="xpack.fleet.epm.packageDetailsSecurityRequiredCalloutTitle"
+            defaultMessage="Security needs to be enabled in order to add Elastic Agent integrations"
+          />
+        }
+      >
+        <FormattedMessage
+          id="xpack.fleet.epm.packageDetailsSecurityRequiredCalloutDescription"
+          defaultMessage="In order to fully use Fleet, you must enable Elasticsearch and Kibana security features.
+        Follow the {guideLink} to enable security."
+          values={{
+            guideLink: (
+              <a href={services.http.basePath.prepend('/app/fleet')}>
+                <FormattedMessage
+                  id="xpack.fleet.epm.packageDetailsSecurityRequiredCalloutDescriptionGuideLink"
+                  defaultMessage="steps in this guide"
+                />
+              </a>
+            ),
+          }}
+        />
+      </EuiCallOut>
+      <EuiSpacer />
+    </>
+  ) : undefined;
 
   return (
     <WithHeaderLayout
       leftColumn={headerLeftContent}
       rightColumn={headerRightContent}
       rightColumnGrow={false}
+      topContent={securityCallout}
       tabs={headerTabs}
       tabsClassName="fleet__epm__shiftNavTabs"
     >
@@ -526,3 +598,16 @@ export function Detail() {
     </WithHeaderLayout>
   );
 }
+
+type EuiButtonPropsFull = Parameters<typeof EuiButton>[0];
+
+const EuiButtonWithTooltip: React.FC<EuiButtonPropsFull & { tooltip?: Partial<EuiToolTipProps> }> =
+  ({ tooltip: tooltipProps, ...buttonProps }) => {
+    return tooltipProps ? (
+      <EuiToolTip {...tooltipProps}>
+        <EuiButton {...buttonProps} />
+      </EuiToolTip>
+    ) : (
+      <EuiButton {...buttonProps} />
+    );
+  };
diff --git a/x-pack/plugins/fleet/public/components/header.tsx b/x-pack/plugins/fleet/public/components/header.tsx
index 80cebe3b0b3041..2a8b20240a4f63 100644
--- a/x-pack/plugins/fleet/public/components/header.tsx
+++ b/x-pack/plugins/fleet/public/components/header.tsx
@@ -43,6 +43,7 @@ export interface HeaderProps {
   leftColumn?: JSX.Element;
   rightColumn?: JSX.Element;
   rightColumnGrow?: EuiFlexItemProps['grow'];
+  topContent?: JSX.Element;
   tabs?: Array<Omit<EuiTabProps, 'name'> & { name?: JSX.Element | string }>;
   tabsClassName?: string;
   'data-test-subj'?: string;
@@ -61,6 +62,7 @@ export const Header: React.FC<HeaderProps> = ({
   leftColumn,
   rightColumn,
   rightColumnGrow,
+  topContent,
   tabs,
   maxWidth,
   tabsClassName,
@@ -68,6 +70,7 @@ export const Header: React.FC<HeaderProps> = ({
 }) => (
   <Container data-test-subj={dataTestSubj}>
     <Wrapper maxWidth={maxWidth}>
+      {topContent}
       <HeaderColumns
         leftColumn={leftColumn}
         rightColumn={rightColumn}
diff --git a/x-pack/plugins/fleet/public/hooks/use_request/app.ts b/x-pack/plugins/fleet/public/hooks/use_request/app.ts
index c84dd0fd15b447..c4a0f94869827f 100644
--- a/x-pack/plugins/fleet/public/hooks/use_request/app.ts
+++ b/x-pack/plugins/fleet/public/hooks/use_request/app.ts
@@ -8,7 +8,7 @@
 import { appRoutesService } from '../../services';
 import type { CheckPermissionsResponse, GenerateServiceTokenResponse } from '../../types';
 
-import { sendRequest } from './use_request';
+import { sendRequest, useRequest } from './use_request';
 
 export const sendGetPermissionsCheck = () => {
   return sendRequest<CheckPermissionsResponse>({
@@ -23,3 +23,10 @@ export const sendGenerateServiceToken = () => {
     method: 'post',
   });
 };
+
+export const usePermissionCheck = () => {
+  return useRequest<CheckPermissionsResponse>({
+    path: appRoutesService.getCheckPermissionsPath(),
+    method: 'get',
+  });
+};
diff --git a/x-pack/plugins/fleet/server/mocks/index.ts b/x-pack/plugins/fleet/server/mocks/index.ts
index 43b455045e72b3..0e7b335da6775a 100644
--- a/x-pack/plugins/fleet/server/mocks/index.ts
+++ b/x-pack/plugins/fleet/server/mocks/index.ts
@@ -37,7 +37,8 @@ export const createAppContextStartContractMock = (): FleetAppContext => {
     data: dataPluginMock.createStartContract(),
     encryptedSavedObjectsStart: encryptedSavedObjectsMock.createStart(),
     savedObjects: savedObjectsServiceMock.createStartContract(),
-    security: securityMock.createStart(),
+    securitySetup: securityMock.createSetup(),
+    securityStart: securityMock.createStart(),
     logger: loggingSystemMock.create().get(),
     isProductionMode: true,
     configInitialValue: {
diff --git a/x-pack/plugins/fleet/server/plugin.ts b/x-pack/plugins/fleet/server/plugin.ts
index 6aad028666ee80..a706ca6a54fdcb 100644
--- a/x-pack/plugins/fleet/server/plugin.ts
+++ b/x-pack/plugins/fleet/server/plugin.ts
@@ -37,6 +37,7 @@ import {
   AGENT_POLICY_SAVED_OBJECT_TYPE,
   PACKAGE_POLICY_SAVED_OBJECT_TYPE,
   PACKAGES_SAVED_OBJECT_TYPE,
+  ASSETS_SAVED_OBJECT_TYPE,
   AGENT_SAVED_OBJECT_TYPE,
   ENROLLMENT_API_KEYS_SAVED_OBJECT_TYPE,
   PRECONFIGURATION_DELETION_RECORD_SAVED_OBJECT_TYPE,
@@ -103,7 +104,8 @@ export interface FleetAppContext {
   data: DataPluginStart;
   encryptedSavedObjectsStart?: EncryptedSavedObjectsPluginStart;
   encryptedSavedObjectsSetup?: EncryptedSavedObjectsPluginSetup;
-  security?: SecurityPluginStart;
+  securitySetup?: SecurityPluginSetup;
+  securityStart?: SecurityPluginStart;
   config$?: Observable<FleetConfigType>;
   configInitialValue: FleetConfigType;
   savedObjects: SavedObjectsServiceStart;
@@ -122,6 +124,7 @@ const allSavedObjectTypes = [
   AGENT_POLICY_SAVED_OBJECT_TYPE,
   PACKAGE_POLICY_SAVED_OBJECT_TYPE,
   PACKAGES_SAVED_OBJECT_TYPE,
+  ASSETS_SAVED_OBJECT_TYPE,
   AGENT_SAVED_OBJECT_TYPE,
   ENROLLMENT_API_KEYS_SAVED_OBJECT_TYPE,
   PRECONFIGURATION_DELETION_RECORD_SAVED_OBJECT_TYPE,
@@ -164,14 +167,15 @@ export class FleetPlugin
   private licensing$!: Observable<ILicense>;
   private config$: Observable<FleetConfigType>;
   private configInitialValue: FleetConfigType;
-  private cloud: CloudSetup | undefined;
-  private logger: Logger | undefined;
+  private cloud?: CloudSetup;
+  private logger?: Logger;
 
   private isProductionMode: FleetAppContext['isProductionMode'];
   private kibanaVersion: FleetAppContext['kibanaVersion'];
   private kibanaBranch: FleetAppContext['kibanaBranch'];
-  private httpSetup: HttpServiceSetup | undefined;
-  private encryptedSavedObjectsSetup: EncryptedSavedObjectsPluginSetup | undefined;
+  private httpSetup?: HttpServiceSetup;
+  private securitySetup?: SecurityPluginSetup;
+  private encryptedSavedObjectsSetup?: EncryptedSavedObjectsPluginSetup;
 
   constructor(private readonly initializerContext: PluginInitializerContext) {
     this.config$ = this.initializerContext.config.create<FleetConfigType>();
@@ -187,6 +191,7 @@ export class FleetPlugin
     this.licensing$ = deps.licensing.license$;
     this.encryptedSavedObjectsSetup = deps.encryptedSavedObjects;
     this.cloud = deps.cloud;
+    this.securitySetup = deps.security;
     const config = this.configInitialValue;
 
     registerSavedObjects(core.savedObjects, deps.encryptedSavedObjects);
@@ -233,6 +238,10 @@ export class FleetPlugin
 
     // Always register app routes for permissions checking
     registerAppRoutes(router);
+    // Allow read-only users access to endpoints necessary for Integrations UI
+    // Only some endpoints require superuser so we pass a raw IRouter here
+    registerEPMRoutes(router);
+
     // For all the routes we enforce the user to have role superuser
     const routerSuperuserOnly = makeRouterEnforcingSuperuser(router);
     // Register rest of routes only if security is enabled
@@ -243,7 +252,6 @@ export class FleetPlugin
       registerOutputRoutes(routerSuperuserOnly);
       registerSettingsRoutes(routerSuperuserOnly);
       registerDataStreamRoutes(routerSuperuserOnly);
-      registerEPMRoutes(routerSuperuserOnly);
       registerPreconfigurationRoutes(routerSuperuserOnly);
 
       // Conditional config routes
@@ -260,7 +268,8 @@ export class FleetPlugin
       data: plugins.data,
       encryptedSavedObjectsStart: plugins.encryptedSavedObjects,
       encryptedSavedObjectsSetup: this.encryptedSavedObjectsSetup,
-      security: plugins.security,
+      securitySetup: this.securitySetup,
+      securityStart: plugins.security,
       configInitialValue: this.configInitialValue,
       config$: this.config$,
       savedObjects: core.savedObjects,
diff --git a/x-pack/plugins/fleet/server/routes/app/index.ts b/x-pack/plugins/fleet/server/routes/app/index.ts
index 025da6d79702cd..43614f3a286b03 100644
--- a/x-pack/plugins/fleet/server/routes/app/index.ts
+++ b/x-pack/plugins/fleet/server/routes/app/index.ts
@@ -17,13 +17,15 @@ export const getCheckPermissionsHandler: RequestHandler = async (context, reques
     success: false,
     error: 'MISSING_SECURITY',
   };
-  const body: CheckPermissionsResponse = { success: true };
-  try {
-    const security = await appContextService.getSecurity();
+
+  if (!appContextService.hasSecurity() || !appContextService.getSecurityLicense().isEnabled()) {
+    return response.ok({ body: missingSecurityBody });
+  } else {
+    const security = appContextService.getSecurity();
     const user = security.authc.getCurrentUser(request);
 
-    // when ES security is disabled, but Kibana security plugin is not explicitly disabled,
-    // `authc.getCurrentUser()` does not error, instead it comes back as `null`
+    // Defensively handle situation where user is undefined (should only happen when ES security is disabled)
+    // This should be covered by the `getSecurityLicense().isEnabled()` check above, but we leave this for robustness.
     if (!user) {
       return response.ok({
         body: missingSecurityBody,
@@ -31,20 +33,15 @@ export const getCheckPermissionsHandler: RequestHandler = async (context, reques
     }
 
     if (!user?.roles.includes('superuser')) {
-      body.success = false;
-      body.error = 'MISSING_SUPERUSER_ROLE';
       return response.ok({
-        body,
+        body: {
+          success: false,
+          error: 'MISSING_SUPERUSER_ROLE',
+        } as CheckPermissionsResponse,
       });
     }
 
-    return response.ok({ body: { success: true } });
-  } catch (e) {
-    // when Kibana security plugin is explicitly disabled,
-    // `appContextService.getSecurity()` returns an error, so we catch it here
-    return response.ok({
-      body: missingSecurityBody,
-    });
+    return response.ok({ body: { success: true } as CheckPermissionsResponse });
   }
 };
 
diff --git a/x-pack/plugins/fleet/server/routes/epm/index.ts b/x-pack/plugins/fleet/server/routes/epm/index.ts
index 684547dc1862c0..0f49b3cfa772de 100644
--- a/x-pack/plugins/fleet/server/routes/epm/index.ts
+++ b/x-pack/plugins/fleet/server/routes/epm/index.ts
@@ -20,6 +20,7 @@ import {
   GetStatsRequestSchema,
   UpdatePackageRequestSchema,
 } from '../../types';
+import { enforceSuperUser } from '../security';
 
 import {
   getCategoriesHandler,
@@ -60,7 +61,7 @@ export const registerRoutes = (router: IRouter) => {
     {
       path: EPM_API_ROUTES.LIMITED_LIST_PATTERN,
       validate: false,
-      options: { tags: [`access:${PLUGIN_ID}`] },
+      options: { tags: [`access:${PLUGIN_ID}-read`] },
     },
     getLimitedListHandler
   );
@@ -69,7 +70,7 @@ export const registerRoutes = (router: IRouter) => {
     {
       path: EPM_API_ROUTES.STATS_PATTERN,
       validate: GetStatsRequestSchema,
-      options: { tags: [`access:${PLUGIN_ID}`] },
+      options: { tags: [`access:${PLUGIN_ID}-read`] },
     },
     getStatsHandler
   );
@@ -98,7 +99,7 @@ export const registerRoutes = (router: IRouter) => {
       validate: UpdatePackageRequestSchema,
       options: { tags: [`access:${PLUGIN_ID}-all`] },
     },
-    updatePackageHandler
+    enforceSuperUser(updatePackageHandler)
   );
 
   router.post(
@@ -107,7 +108,7 @@ export const registerRoutes = (router: IRouter) => {
       validate: InstallPackageFromRegistryRequestSchema,
       options: { tags: [`access:${PLUGIN_ID}-all`] },
     },
-    installPackageFromRegistryHandler
+    enforceSuperUser(installPackageFromRegistryHandler)
   );
 
   router.post(
@@ -116,7 +117,7 @@ export const registerRoutes = (router: IRouter) => {
       validate: BulkUpgradePackagesFromRegistryRequestSchema,
       options: { tags: [`access:${PLUGIN_ID}-all`] },
     },
-    bulkInstallPackagesFromRegistryHandler
+    enforceSuperUser(bulkInstallPackagesFromRegistryHandler)
   );
 
   router.post(
@@ -132,7 +133,7 @@ export const registerRoutes = (router: IRouter) => {
         },
       },
     },
-    installPackageByUploadHandler
+    enforceSuperUser(installPackageByUploadHandler)
   );
 
   router.delete(
@@ -141,6 +142,6 @@ export const registerRoutes = (router: IRouter) => {
       validate: DeletePackageRequestSchema,
       options: { tags: [`access:${PLUGIN_ID}-all`] },
     },
-    deletePackageHandler
+    enforceSuperUser(deletePackageHandler)
   );
 };
diff --git a/x-pack/plugins/fleet/server/routes/security.ts b/x-pack/plugins/fleet/server/routes/security.ts
index 60011dcf3d33f2..8efea34ed8164b 100644
--- a/x-pack/plugins/fleet/server/routes/security.ts
+++ b/x-pack/plugins/fleet/server/routes/security.ts
@@ -13,6 +13,14 @@ export function enforceSuperUser<T1, T2, T3>(
   handler: RequestHandler<T1, T2, T3>
 ): RequestHandler<T1, T2, T3> {
   return function enforceSuperHandler(context, req, res) {
+    if (!appContextService.hasSecurity() || !appContextService.getSecurityLicense().isEnabled()) {
+      return res.forbidden({
+        body: {
+          message: `Access to this API requires that security is enabled`,
+        },
+      });
+    }
+
     const security = appContextService.getSecurity();
     const user = security.authc.getCurrentUser(req);
     if (!user) {
diff --git a/x-pack/plugins/fleet/server/services/app_context.ts b/x-pack/plugins/fleet/server/services/app_context.ts
index 1fb34a9a399eb2..a1e6ef4545aefe 100644
--- a/x-pack/plugins/fleet/server/services/app_context.ts
+++ b/x-pack/plugins/fleet/server/services/app_context.ts
@@ -22,7 +22,7 @@ import type {
   EncryptedSavedObjectsPluginSetup,
 } from '../../../encrypted_saved_objects/server';
 
-import type { SecurityPluginStart } from '../../../security/server';
+import type { SecurityPluginStart, SecurityPluginSetup } from '../../../security/server';
 import type { FleetConfigType } from '../../common';
 import type {
   ExternalCallback,
@@ -39,7 +39,8 @@ class AppContextService {
   private encryptedSavedObjectsSetup: EncryptedSavedObjectsPluginSetup | undefined;
   private data: DataPluginStart | undefined;
   private esClient: ElasticsearchClient | undefined;
-  private security: SecurityPluginStart | undefined;
+  private securitySetup: SecurityPluginSetup | undefined;
+  private securityStart: SecurityPluginStart | undefined;
   private config$?: Observable<FleetConfigType>;
   private configSubject$?: BehaviorSubject<FleetConfigType>;
   private savedObjects: SavedObjectsServiceStart | undefined;
@@ -56,7 +57,8 @@ class AppContextService {
     this.esClient = appContext.elasticsearch.client.asInternalUser;
     this.encryptedSavedObjects = appContext.encryptedSavedObjectsStart?.getClient();
     this.encryptedSavedObjectsSetup = appContext.encryptedSavedObjectsSetup;
-    this.security = appContext.security;
+    this.securitySetup = appContext.securitySetup;
+    this.securityStart = appContext.securityStart;
     this.savedObjects = appContext.savedObjects;
     this.isProductionMode = appContext.isProductionMode;
     this.cloud = appContext.cloud;
@@ -92,14 +94,21 @@ class AppContextService {
   }
 
   public getSecurity() {
-    if (!this.security) {
+    if (!this.hasSecurity()) {
       throw new Error('Security service not set.');
     }
-    return this.security;
+    return this.securityStart!;
+  }
+
+  public getSecurityLicense() {
+    if (!this.hasSecurity()) {
+      throw new Error('Security service not set.');
+    }
+    return this.securitySetup!.license;
   }
 
   public hasSecurity() {
-    return !!this.security;
+    return !!this.securitySetup && !!this.securityStart;
   }
 
   public getCloud() {
diff --git a/x-pack/plugins/fleet/server/services/epm/archive/cache.ts b/x-pack/plugins/fleet/server/services/epm/archive/cache.ts
index 7f479dc5d6b63b..676c3aa571a0f0 100644
--- a/x-pack/plugins/fleet/server/services/epm/archive/cache.ts
+++ b/x-pack/plugins/fleet/server/services/epm/archive/cache.ts
@@ -67,3 +67,11 @@ export const setPackageInfo = ({
 };
 
 export const deletePackageInfo = (args: SharedKey) => packageInfoCache.delete(sharedKey(args));
+
+export const clearPackageFileCache = (args: SharedKey) => {
+  const fileList = getArchiveFilelist(args) ?? [];
+  fileList.forEach((filePath) => {
+    deleteArchiveEntry(filePath);
+  });
+  deleteArchiveFilelist(args);
+};
diff --git a/x-pack/plugins/fleet/server/services/epm/archive/index.ts b/x-pack/plugins/fleet/server/services/epm/archive/index.ts
index b08ec815a394d0..7c590eb1bcd392 100644
--- a/x-pack/plugins/fleet/server/services/epm/archive/index.ts
+++ b/x-pack/plugins/fleet/server/services/epm/archive/index.ts
@@ -16,6 +16,7 @@ import {
   setArchiveFilelist,
   deleteArchiveFilelist,
   deletePackageInfo,
+  clearPackageFileCache,
 } from './cache';
 import type { SharedKey } from './cache';
 import { getBufferExtractor } from './extract';
@@ -42,6 +43,9 @@ export async function unpackBufferToCache({
   archiveBuffer: Buffer;
   installSource: InstallSource;
 }): Promise<string[]> {
+  // Make sure any buffers from previous installations from registry or upload are deleted first
+  clearPackageFileCache({ name, version });
+
   const entries = await unpackBufferEntries(archiveBuffer, contentType);
   const paths: string[] = [];
   entries.forEach((entry) => {
diff --git a/x-pack/plugins/fleet/storybook/context/http.ts b/x-pack/plugins/fleet/storybook/context/http.ts
index f62970c0c0306c..3e515c075a595e 100644
--- a/x-pack/plugins/fleet/storybook/context/http.ts
+++ b/x-pack/plugins/fleet/storybook/context/http.ts
@@ -75,6 +75,10 @@ export const getHttp = (basepath = BASE_PATH) => {
         return await import('./fixtures/integration.okta');
       }
 
+      if (path.startsWith('/api/fleet/check-permissions')) {
+        return { success: true };
+      }
+
       action(path)('KP: UNSUPPORTED ROUTE');
       return {};
     }) as HttpHandler,
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 2c828513e9d33f..482a493865a478 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -10873,8 +10873,6 @@
     "xpack.fleet.integrations.updatePackage.updatePackageButtonLabel": "最新バージョンに更新",
     "xpack.fleet.integrationsAppTitle": "統合",
     "xpack.fleet.integrationsHeaderTitle": "Elasticエージェント統合",
-    "xpack.fleet.integrationsPermissionDeniedErrorMessage": "統合にアクセスする権限がありません。統合には{roleName}権限が必要です。",
-    "xpack.fleet.integrationsSecurityRequiredErrorMessage": "統合を使用するには、KibanaとElasticsearchでセキュリティを有効にする必要があります。",
     "xpack.fleet.invalidLicenseDescription": "現在のライセンスは期限切れです。登録されたビートエージェントは引き続き動作しますが、Elastic Fleet インターフェイスにアクセスするには有効なライセンスが必要です。",
     "xpack.fleet.invalidLicenseTitle": "ライセンスの期限切れ",
     "xpack.fleet.multiTextInput.addRow": "行の追加",
@@ -10946,7 +10944,6 @@
     "xpack.fleet.preconfiguration.missingIDError": "{agentPolicyName}には「id」フィールドがありません。ポリシーのis_defaultまたはis_default_fleet_serverに設定されている場合をのぞき、「id」は必須です。",
     "xpack.fleet.preconfiguration.packageMissingError": "{agentPolicyName}を追加できませんでした。{pkgName}がインストールされていません。{pkgName}を`{packagesConfigValue}`に追加するか、{packagePolicyName}から削除してください。",
     "xpack.fleet.preconfiguration.policyDeleted": "構成済みのポリシー{id}が削除されました。作成をスキップしています",
-    "xpack.fleet.securityRequiredErrorTitle": "セキュリティが有効ではありません",
     "xpack.fleet.serverError.agentPolicyDoesNotExist": "エージェントポリシー{agentPolicyId}が存在しません",
     "xpack.fleet.serverError.enrollmentKeyDuplicate": "エージェントポリシーの{agentPolicyId}登録キー{providedKeyName}はすでに存在します",
     "xpack.fleet.serverError.returnedIncorrectKey": "find enrollmentKeyByIdで正しくないキーが返されました",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index c0d3975461c7b8..2322f6213149ff 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -10987,8 +10987,6 @@
     "xpack.fleet.integrations.updatePackage.updatePackageButtonLabel": "更新到最新版本",
     "xpack.fleet.integrationsAppTitle": "集成",
     "xpack.fleet.integrationsHeaderTitle": "Elastic 代理集成",
-    "xpack.fleet.integrationsPermissionDeniedErrorMessage": "您无权访问“集成”。“集成”需要 {roleName} 权限。",
-    "xpack.fleet.integrationsSecurityRequiredErrorMessage": "必须在 Kibana 和 Elasticsearch 中启用安全性，才能使用“集成”。",
     "xpack.fleet.invalidLicenseDescription": "您当前的许可证已过期。已注册 Beats 代理将继续工作，但您需要有效的许可证，才能访问 Elastic Fleet 界面。",
     "xpack.fleet.invalidLicenseTitle": "已过期许可证",
     "xpack.fleet.multiTextInput.addRow": "添加行",
@@ -11060,7 +11058,6 @@
     "xpack.fleet.preconfiguration.missingIDError": "{agentPolicyName} 缺失 `id` 字段。`id` 是必需的，但标记为 is_default 或 is_default_fleet_server 的策略除外。",
     "xpack.fleet.preconfiguration.packageMissingError": "{agentPolicyName} 无法添加。{pkgName} 未安装，请将 {pkgName} 添加到 `{packagesConfigValue}` 或将其从 {packagePolicyName} 中移除。",
     "xpack.fleet.preconfiguration.policyDeleted": "预配置的策略 {id} 已删除；将跳过创建",
-    "xpack.fleet.securityRequiredErrorTitle": "安全性未启用",
     "xpack.fleet.serverError.agentPolicyDoesNotExist": "代理策略 {agentPolicyId} 不存在",
     "xpack.fleet.serverError.enrollmentKeyDuplicate": "称作 {providedKeyName} 的注册密钥对于代理策略 {agentPolicyId} 已存在",
     "xpack.fleet.serverError.returnedIncorrectKey": "find enrollmentKeyById 返回错误的密钥",
diff --git a/x-pack/test/fleet_api_integration/apis/agents/list.ts b/x-pack/test/fleet_api_integration/apis/agents/list.ts
index a11f4d49fe0f14..3795734f60fe08 100644
--- a/x-pack/test/fleet_api_integration/apis/agents/list.ts
+++ b/x-pack/test/fleet_api_integration/apis/agents/list.ts
@@ -8,66 +8,15 @@
 import expect from '@kbn/expect';
 
 import { FtrProviderContext } from '../../../api_integration/ftr_provider_context';
+import { testUsers } from '../test_users';
 
 export default function ({ getService }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
   const supertestWithoutAuth = getService('supertestWithoutAuth');
   const supertest = getService('supertest');
-  const security = getService('security');
-  const users: { [rollName: string]: { username: string; password: string; permissions?: any } } = {
-    kibana_basic_user: {
-      permissions: {
-        feature: {
-          dashboards: ['read'],
-        },
-        spaces: ['*'],
-      },
-      username: 'kibana_basic_user',
-      password: 'changeme',
-    },
-    fleet_user: {
-      permissions: {
-        feature: {
-          fleet: ['read'],
-        },
-        spaces: ['*'],
-      },
-      username: 'fleet_user',
-      password: 'changeme',
-    },
-    fleet_admin: {
-      permissions: {
-        feature: {
-          fleet: ['all'],
-        },
-        spaces: ['*'],
-      },
-      username: 'fleet_admin',
-      password: 'changeme',
-    },
-  };
 
   describe('fleet_list_agent', () => {
     before(async () => {
-      for (const roleName in users) {
-        if (users.hasOwnProperty(roleName)) {
-          const user = users[roleName];
-
-          if (user.permissions) {
-            await security.role.create(roleName, {
-              kibana: [user.permissions],
-            });
-          }
-
-          // Import a repository first
-          await security.user.create(user.username, {
-            password: user.password,
-            roles: [roleName],
-            full_name: user.username,
-          });
-        }
-      }
-
       await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/fleet/agents');
     });
     after(async () => {
@@ -77,13 +26,13 @@ export default function ({ getService }: FtrProviderContext) {
     it('should return a 403 if a user without the superuser role try to access the APU', async () => {
       await supertestWithoutAuth
         .get(`/api/fleet/agents`)
-        .auth(users.fleet_admin.username, users.fleet_admin.password)
+        .auth(testUsers.fleet_all.username, testUsers.fleet_all.password)
         .expect(403);
     });
     it('should not return the list of agents when requesting as a user without fleet permissions', async () => {
       await supertestWithoutAuth
         .get(`/api/fleet/agents`)
-        .auth(users.kibana_basic_user.username, users.kibana_basic_user.password)
+        .auth(testUsers.fleet_no_access.username, testUsers.fleet_no_access.password)
         .expect(403);
     });
 
diff --git a/x-pack/test/fleet_api_integration/apis/epm/bulk_upgrade.ts b/x-pack/test/fleet_api_integration/apis/epm/bulk_upgrade.ts
index bb75629e222a56..3b3ccb03e56f32 100644
--- a/x-pack/test/fleet_api_integration/apis/epm/bulk_upgrade.ts
+++ b/x-pack/test/fleet_api_integration/apis/epm/bulk_upgrade.ts
@@ -14,10 +14,12 @@ import {
   IBulkInstallPackageHTTPError,
 } from '../../../../plugins/fleet/common';
 import { setupFleetAndAgents } from '../agents/services';
+import { testUsers } from '../test_users';
 
 export default function (providerContext: FtrProviderContext) {
   const { getService } = providerContext;
   const supertest = getService('supertest');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
 
   const deletePackage = async (pkgkey: string) => {
     await supertest.delete(`/api/fleet/epm/packages/${pkgkey}`).set('kbn-xsrf', 'xxxx');
@@ -44,6 +46,13 @@ export default function (providerContext: FtrProviderContext) {
       it('should return 400 if no packages are requested for upgrade', async function () {
         await supertest.post(`/api/fleet/epm/packages/_bulk`).set('kbn-xsrf', 'xxxx').expect(400);
       });
+      it('should return 403 if read only user requests upgrade', async function () {
+        await supertestWithoutAuth
+          .post(`/api/fleet/epm/packages/_bulk`)
+          .auth(testUsers.fleet_read_only.username, testUsers.fleet_read_only.password)
+          .set('kbn-xsrf', 'xxxx')
+          .expect(403);
+      });
       it('should return 200 and an array for upgrading a package', async function () {
         const { body }: { body: BulkInstallPackagesResponse } = await supertest
           .post(`/api/fleet/epm/packages/_bulk`)
diff --git a/x-pack/test/fleet_api_integration/apis/epm/delete.ts b/x-pack/test/fleet_api_integration/apis/epm/delete.ts
index 40650c4c176f7b..9980d85ac171ef 100644
--- a/x-pack/test/fleet_api_integration/apis/epm/delete.ts
+++ b/x-pack/test/fleet_api_integration/apis/epm/delete.ts
@@ -8,10 +8,12 @@
 import { FtrProviderContext } from '../../../api_integration/ftr_provider_context';
 import { skipIfNoDockerRegistry } from '../../helpers';
 import { setupFleetAndAgents } from '../agents/services';
+import { testUsers } from '../test_users';
 
 export default function (providerContext: FtrProviderContext) {
   const { getService } = providerContext;
   const supertest = getService('supertest');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
   const requiredPackage = 'elastic_agent-0.0.7';
 
   const installPackage = async (pkgkey: string) => {
@@ -52,5 +54,13 @@ export default function (providerContext: FtrProviderContext) {
         .send({ force: true })
         .expect(200);
     });
+
+    it('should return 403 for read-only users', async () => {
+      await supertestWithoutAuth
+        .delete(`/api/fleet/epm/packages/${requiredPackage}`)
+        .auth(testUsers.fleet_read_only.username, testUsers.fleet_read_only.password)
+        .set('kbn-xsrf', 'xxxx')
+        .expect(403);
+    });
   });
 }
diff --git a/x-pack/test/fleet_api_integration/apis/epm/get.ts b/x-pack/test/fleet_api_integration/apis/epm/get.ts
index 014fe0808d2558..13533a9a82af00 100644
--- a/x-pack/test/fleet_api_integration/apis/epm/get.ts
+++ b/x-pack/test/fleet_api_integration/apis/epm/get.ts
@@ -11,11 +11,13 @@ import path from 'path';
 import { FtrProviderContext } from '../../../api_integration/ftr_provider_context';
 import { skipIfNoDockerRegistry } from '../../helpers';
 import { setupFleetAndAgents } from '../agents/services';
+import { testUsers } from '../test_users';
 
 export default function (providerContext: FtrProviderContext) {
   const { getService } = providerContext;
 
   const supertest = getService('supertest');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
 
   const testPkgKey = 'apache-0.1.4';
 
@@ -91,5 +93,12 @@ export default function (providerContext: FtrProviderContext) {
     it('returns a 400 for a package key without a proper semver version', async function () {
       await supertest.get('/api/fleet/epm/packages/endpoint-0.1.0.1.2.3').expect(400);
     });
+
+    it('allows user with only read permission to access', async () => {
+      await supertestWithoutAuth
+        .get(`/api/fleet/epm/packages/${testPkgKey}`)
+        .auth(testUsers.fleet_read_only.username, testUsers.fleet_read_only.password)
+        .expect(200);
+    });
   });
 }
diff --git a/x-pack/test/fleet_api_integration/apis/epm/install_by_upload.ts b/x-pack/test/fleet_api_integration/apis/epm/install_by_upload.ts
index 23feacbcee3740..86928874f8a344 100644
--- a/x-pack/test/fleet_api_integration/apis/epm/install_by_upload.ts
+++ b/x-pack/test/fleet_api_integration/apis/epm/install_by_upload.ts
@@ -12,10 +12,12 @@ import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../../api_integration/ftr_provider_context';
 import { skipIfNoDockerRegistry } from '../../helpers';
 import { setupFleetAndAgents } from '../agents/services';
+import { testUsers } from '../test_users';
 
 export default function (providerContext: FtrProviderContext) {
   const { getService } = providerContext;
   const supertest = getService('supertest');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
   const dockerServers = getService('dockerServers');
 
   const testPkgArchiveTgz = path.join(
@@ -190,5 +192,16 @@ export default function (providerContext: FtrProviderContext) {
         '{"statusCode":400,"error":"Bad Request","message":"Name thisIsATypo and version 0.1.4 do not match top-level directory apache-0.1.4"}'
       );
     });
+
+    it('should not allow users without all access', async () => {
+      const buf = fs.readFileSync(testPkgArchiveTgz);
+      await supertestWithoutAuth
+        .post(`/api/fleet/epm/packages`)
+        .auth(testUsers.fleet_read_only.username, testUsers.fleet_read_only.password)
+        .set('kbn-xsrf', 'xxxx')
+        .type('application/gzip')
+        .send(buf)
+        .expect(403);
+    });
   });
 }
diff --git a/x-pack/test/fleet_api_integration/apis/epm/list.ts b/x-pack/test/fleet_api_integration/apis/epm/list.ts
index 931e4947982200..56f3e6ca1f2fa7 100644
--- a/x-pack/test/fleet_api_integration/apis/epm/list.ts
+++ b/x-pack/test/fleet_api_integration/apis/epm/list.ts
@@ -9,10 +9,12 @@ import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../../api_integration/ftr_provider_context';
 import { skipIfNoDockerRegistry } from '../../helpers';
 import { setupFleetAndAgents } from '../agents/services';
+import { testUsers } from '../test_users';
 
 export default function (providerContext: FtrProviderContext) {
   const { getService } = providerContext;
   const supertest = getService('supertest');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
   const esArchiver = getService('esArchiver');
 
   // use function () {} and not () => {} here
@@ -54,6 +56,13 @@ export default function (providerContext: FtrProviderContext) {
 
         expect(listResponse.response).to.eql(['endpoint']);
       });
+
+      it('allows user with only read permission to access', async () => {
+        await supertestWithoutAuth
+          .get('/api/fleet/epm/packages')
+          .auth(testUsers.fleet_read_only.username, testUsers.fleet_read_only.password)
+          .expect(200);
+      });
     });
   });
 }
diff --git a/x-pack/test/fleet_api_integration/apis/index.js b/x-pack/test/fleet_api_integration/apis/index.js
index 387433b787728d..fd5ac05247fd2a 100644
--- a/x-pack/test/fleet_api_integration/apis/index.js
+++ b/x-pack/test/fleet_api_integration/apis/index.js
@@ -5,10 +5,16 @@
  * 2.0.
  */
 
-export default function ({ loadTestFile }) {
+import { setupTestUsers } from './test_users';
+
+export default function ({ loadTestFile, getService }) {
   describe('Fleet Endpoints', function () {
+    before(async () => {
+      await setupTestUsers(getService('security'));
+    });
+
     // EPM
-    loadTestFile(require.resolve('./epm/index'));
+    loadTestFile(require.resolve('./epm'));
 
     // Fleet setup
     loadTestFile(require.resolve('./fleet_setup'));
diff --git a/x-pack/test/fleet_api_integration/apis/test_users.ts b/x-pack/test/fleet_api_integration/apis/test_users.ts
new file mode 100644
index 00000000000000..a1df6d3a31b71b
--- /dev/null
+++ b/x-pack/test/fleet_api_integration/apis/test_users.ts
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { SecurityService } from '../../../../test/common/services/security/security';
+
+export const testUsers: {
+  [rollName: string]: { username: string; password: string; permissions?: any };
+} = {
+  fleet_no_access: {
+    permissions: {
+      feature: {
+        dashboards: ['read'],
+      },
+      spaces: ['*'],
+    },
+    username: 'fleet_no_access',
+    password: 'changeme',
+  },
+  fleet_read_only: {
+    permissions: {
+      feature: {
+        fleet: ['read'],
+      },
+      spaces: ['*'],
+    },
+    username: 'fleet_read_only',
+    password: 'changeme',
+  },
+  fleet_all: {
+    permissions: {
+      feature: {
+        fleet: ['all'],
+      },
+      spaces: ['*'],
+    },
+    username: 'fleet_all',
+    password: 'changeme',
+  },
+};
+
+export const setupTestUsers = async (security: SecurityService) => {
+  for (const roleName in testUsers) {
+    if (testUsers.hasOwnProperty(roleName)) {
+      const user = testUsers[roleName];
+
+      if (user.permissions) {
+        await security.role.create(roleName, {
+          kibana: [user.permissions],
+        });
+      }
+
+      await security.user.create(user.username, {
+        password: user.password,
+        roles: [roleName],
+        full_name: user.username,
+      });
+    }
+  }
+};

From bfc790ae924bfa2d58c6d1fb54152b414846b38e Mon Sep 17 00:00:00 2001
From: Matthew Kime <matt@mattki.me>
Date: Wed, 13 Oct 2021 12:46:11 -0500
Subject: [PATCH 12/71] fix codeowners file (#114783)

---
 .github/CODEOWNERS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 17150e3c98cec1..91a8f8c2d59985 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -63,7 +63,7 @@
 /packages/kbn-interpreter/ @elastic/kibana-app-services
 /src/plugins/bfetch/ @elastic/kibana-app-services
 /src/plugins/data/ @elastic/kibana-app-services
-/src/plugins/data-views/ @elastic/kibana-app-services
+/src/plugins/data_views/ @elastic/kibana-app-services
 /src/plugins/embeddable/ @elastic/kibana-app-services
 /src/plugins/expressions/ @elastic/kibana-app-services
 /src/plugins/field_formats/ @elastic/kibana-app-services

From eaf25d64e4b9dfa88371e0b54fc0ca0986359d13 Mon Sep 17 00:00:00 2001
From: Dario Gieselaar <dario.gieselaar@elastic.co>
Date: Wed, 13 Oct 2021 19:48:01 +0200
Subject: [PATCH 13/71] [APM] Generate breakdown metrics (#114390)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 packages/elastic-apm-generator/src/index.ts   |   1 +
 .../src/lib/base_span.ts                      |  31 +++-
 .../elastic-apm-generator/src/lib/entity.ts   |   4 +
 .../src/lib/output/to_elasticsearch_output.ts |   4 +-
 .../elastic-apm-generator/src/lib/service.ts  |   1 +
 .../elastic-apm-generator/src/lib/span.ts     |  12 --
 .../src/lib/transaction.ts                    |  28 ++--
 .../src/lib/utils/aggregate.ts                |  45 ++++++
 .../src/lib/utils/create_picker.ts            |  16 ++
 .../src/lib/utils/get_breakdown_metrics.ts    | 145 ++++++++++++++++++
 .../lib/utils/get_span_destination_metrics.ts |  54 +++----
 .../src/lib/utils/get_transaction_metrics.ts  |  90 +++++------
 .../src/scripts/examples/01_simple_trace.ts   |  20 ++-
 .../test/scenarios/01_simple_trace.test.ts    |   2 +
 .../scenarios/04_breakdown_metrics.test.ts    | 105 +++++++++++++
 .../01_simple_trace.test.ts.snap              |  30 ++++
 ...ervice_instances_transaction_statistics.ts |   3 +
 .../apm_api_integration/common/trace_data.ts  |   8 +-
 .../instances_main_statistics.ts              | 145 ++++++++++++++++++
 19 files changed, 621 insertions(+), 123 deletions(-)
 create mode 100644 packages/elastic-apm-generator/src/lib/utils/aggregate.ts
 create mode 100644 packages/elastic-apm-generator/src/lib/utils/create_picker.ts
 create mode 100644 packages/elastic-apm-generator/src/lib/utils/get_breakdown_metrics.ts
 create mode 100644 packages/elastic-apm-generator/src/test/scenarios/04_breakdown_metrics.test.ts

diff --git a/packages/elastic-apm-generator/src/index.ts b/packages/elastic-apm-generator/src/index.ts
index fd83ce483ad4f1..7007e92012a66a 100644
--- a/packages/elastic-apm-generator/src/index.ts
+++ b/packages/elastic-apm-generator/src/index.ts
@@ -12,3 +12,4 @@ export { getTransactionMetrics } from './lib/utils/get_transaction_metrics';
 export { getSpanDestinationMetrics } from './lib/utils/get_span_destination_metrics';
 export { getObserverDefaults } from './lib/defaults/get_observer_defaults';
 export { toElasticsearchOutput } from './lib/output/to_elasticsearch_output';
+export { getBreakdownMetrics } from './lib/utils/get_breakdown_metrics';
diff --git a/packages/elastic-apm-generator/src/lib/base_span.ts b/packages/elastic-apm-generator/src/lib/base_span.ts
index 24a51282687f47..6288c16d339b62 100644
--- a/packages/elastic-apm-generator/src/lib/base_span.ts
+++ b/packages/elastic-apm-generator/src/lib/base_span.ts
@@ -8,10 +8,12 @@
 
 import { Fields } from './entity';
 import { Serializable } from './serializable';
+import { Span } from './span';
+import { Transaction } from './transaction';
 import { generateTraceId } from './utils/generate_id';
 
 export class BaseSpan extends Serializable {
-  private _children: BaseSpan[] = [];
+  private readonly _children: BaseSpan[] = [];
 
   constructor(fields: Fields) {
     super({
@@ -22,20 +24,29 @@ export class BaseSpan extends Serializable {
     });
   }
 
-  traceId(traceId: string) {
-    this.fields['trace.id'] = traceId;
+  parent(span: BaseSpan) {
+    this.fields['trace.id'] = span.fields['trace.id'];
+    this.fields['parent.id'] = span.isSpan()
+      ? span.fields['span.id']
+      : span.fields['transaction.id'];
+
+    if (this.isSpan()) {
+      this.fields['transaction.id'] = span.fields['transaction.id'];
+    }
     this._children.forEach((child) => {
-      child.fields['trace.id'] = traceId;
+      child.parent(this);
     });
+
     return this;
   }
 
   children(...children: BaseSpan[]) {
-    this._children.push(...children);
     children.forEach((child) => {
-      child.traceId(this.fields['trace.id']!);
+      child.parent(this);
     });
 
+    this._children.push(...children);
+
     return this;
   }
 
@@ -52,4 +63,12 @@ export class BaseSpan extends Serializable {
   serialize(): Fields[] {
     return [this.fields, ...this._children.flatMap((child) => child.serialize())];
   }
+
+  isSpan(): this is Span {
+    return this.fields['processor.event'] === 'span';
+  }
+
+  isTransaction(): this is Transaction {
+    return this.fields['processor.event'] === 'transaction';
+  }
 }
diff --git a/packages/elastic-apm-generator/src/lib/entity.ts b/packages/elastic-apm-generator/src/lib/entity.ts
index e0a048c876213b..2a4beee652cf74 100644
--- a/packages/elastic-apm-generator/src/lib/entity.ts
+++ b/packages/elastic-apm-generator/src/lib/entity.ts
@@ -10,9 +10,11 @@ export type Fields = Partial<{
   '@timestamp': number;
   'agent.name': string;
   'agent.version': string;
+  'container.id': string;
   'ecs.version': string;
   'event.outcome': string;
   'event.ingested': number;
+  'host.name': string;
   'metricset.name': string;
   'observer.version': string;
   'observer.version_major': number;
@@ -42,6 +44,8 @@ export type Fields = Partial<{
   'span.destination.service.type': string;
   'span.destination.service.response_time.sum.us': number;
   'span.destination.service.response_time.count': number;
+  'span.self_time.count': number;
+  'span.self_time.sum.us': number;
 }>;
 
 export class Entity {
diff --git a/packages/elastic-apm-generator/src/lib/output/to_elasticsearch_output.ts b/packages/elastic-apm-generator/src/lib/output/to_elasticsearch_output.ts
index ded94f9ad22764..b4cae1b41b9a65 100644
--- a/packages/elastic-apm-generator/src/lib/output/to_elasticsearch_output.ts
+++ b/packages/elastic-apm-generator/src/lib/output/to_elasticsearch_output.ts
@@ -14,10 +14,12 @@ export function toElasticsearchOutput(events: Fields[], versionOverride?: string
   return events.map((event) => {
     const values = {
       ...event,
+      ...getObserverDefaults(),
       '@timestamp': new Date(event['@timestamp']!).toISOString(),
       'timestamp.us': event['@timestamp']! * 1000,
       'ecs.version': '1.4',
-      ...getObserverDefaults(),
+      'service.node.name':
+        event['service.node.name'] || event['container.id'] || event['host.name'],
     };
 
     const document = {};
diff --git a/packages/elastic-apm-generator/src/lib/service.ts b/packages/elastic-apm-generator/src/lib/service.ts
index 8ddbd827e842e3..859afa18aab030 100644
--- a/packages/elastic-apm-generator/src/lib/service.ts
+++ b/packages/elastic-apm-generator/src/lib/service.ts
@@ -14,6 +14,7 @@ export class Service extends Entity {
     return new Instance({
       ...this.fields,
       ['service.node.name']: instanceName,
+      'container.id': instanceName,
     });
   }
 }
diff --git a/packages/elastic-apm-generator/src/lib/span.ts b/packages/elastic-apm-generator/src/lib/span.ts
index da9ba9cdff7222..36f7f44816d01d 100644
--- a/packages/elastic-apm-generator/src/lib/span.ts
+++ b/packages/elastic-apm-generator/src/lib/span.ts
@@ -19,18 +19,6 @@ export class Span extends BaseSpan {
     });
   }
 
-  children(...children: BaseSpan[]) {
-    super.children(...children);
-
-    children.forEach((child) =>
-      child.defaults({
-        'parent.id': this.fields['span.id'],
-      })
-    );
-
-    return this;
-  }
-
   duration(duration: number) {
     this.fields['span.duration.us'] = duration * 1000;
     return this;
diff --git a/packages/elastic-apm-generator/src/lib/transaction.ts b/packages/elastic-apm-generator/src/lib/transaction.ts
index 14ed6ac1ea85e8..f615f467109969 100644
--- a/packages/elastic-apm-generator/src/lib/transaction.ts
+++ b/packages/elastic-apm-generator/src/lib/transaction.ts
@@ -11,6 +11,8 @@ import { Fields } from './entity';
 import { generateEventId } from './utils/generate_id';
 
 export class Transaction extends BaseSpan {
+  private _sampled: boolean = true;
+
   constructor(fields: Fields) {
     super({
       ...fields,
@@ -19,19 +21,25 @@ export class Transaction extends BaseSpan {
       'transaction.sampled': true,
     });
   }
-  children(...children: BaseSpan[]) {
-    super.children(...children);
-    children.forEach((child) =>
-      child.defaults({
-        'transaction.id': this.fields['transaction.id'],
-        'parent.id': this.fields['transaction.id'],
-      })
-    );
-    return this;
-  }
 
   duration(duration: number) {
     this.fields['transaction.duration.us'] = duration * 1000;
     return this;
   }
+
+  sample(sampled: boolean = true) {
+    this._sampled = sampled;
+    return this;
+  }
+
+  serialize() {
+    const [transaction, ...spans] = super.serialize();
+
+    const events = [transaction];
+    if (this._sampled) {
+      events.push(...spans);
+    }
+
+    return events;
+  }
 }
diff --git a/packages/elastic-apm-generator/src/lib/utils/aggregate.ts b/packages/elastic-apm-generator/src/lib/utils/aggregate.ts
new file mode 100644
index 00000000000000..81b72f6fa01e9f
--- /dev/null
+++ b/packages/elastic-apm-generator/src/lib/utils/aggregate.ts
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import moment from 'moment';
+import { pickBy } from 'lodash';
+import objectHash from 'object-hash';
+import { Fields } from '../entity';
+import { createPicker } from './create_picker';
+
+export function aggregate(events: Fields[], fields: string[]) {
+  const picker = createPicker(fields);
+
+  const metricsets = new Map<string, { key: Fields; events: Fields[] }>();
+
+  function getMetricsetKey(span: Fields) {
+    const timestamp = moment(span['@timestamp']).valueOf();
+    return {
+      '@timestamp': timestamp - (timestamp % (60 * 1000)),
+      ...pickBy(span, picker),
+    };
+  }
+
+  for (const event of events) {
+    const key = getMetricsetKey(event);
+    const id = objectHash(key);
+
+    let metricset = metricsets.get(id);
+
+    if (!metricset) {
+      metricset = {
+        key: { ...key, 'processor.event': 'metric', 'processor.name': 'metric' },
+        events: [],
+      };
+      metricsets.set(id, metricset);
+    }
+
+    metricset.events.push(event);
+  }
+
+  return Array.from(metricsets.values());
+}
diff --git a/packages/elastic-apm-generator/src/lib/utils/create_picker.ts b/packages/elastic-apm-generator/src/lib/utils/create_picker.ts
new file mode 100644
index 00000000000000..7fce23b6fc9668
--- /dev/null
+++ b/packages/elastic-apm-generator/src/lib/utils/create_picker.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+export function createPicker(fields: string[]) {
+  const wildcards = fields
+    .filter((field) => field.endsWith('.*'))
+    .map((field) => field.replace('*', ''));
+
+  return (value: unknown, key: string) => {
+    return fields.includes(key) || wildcards.some((field) => key.startsWith(field));
+  };
+}
diff --git a/packages/elastic-apm-generator/src/lib/utils/get_breakdown_metrics.ts b/packages/elastic-apm-generator/src/lib/utils/get_breakdown_metrics.ts
new file mode 100644
index 00000000000000..8eae0941c6bdd0
--- /dev/null
+++ b/packages/elastic-apm-generator/src/lib/utils/get_breakdown_metrics.ts
@@ -0,0 +1,145 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import objectHash from 'object-hash';
+import { groupBy, pickBy } from 'lodash';
+import { Fields } from '../entity';
+import { createPicker } from './create_picker';
+
+const instanceFields = [
+  'container.*',
+  'kubernetes.*',
+  'agent.*',
+  'process.*',
+  'cloud.*',
+  'service.*',
+  'host.*',
+];
+
+const instancePicker = createPicker(instanceFields);
+
+const metricsetPicker = createPicker([
+  'transaction.type',
+  'transaction.name',
+  'span.type',
+  'span.subtype',
+]);
+
+export function getBreakdownMetrics(events: Fields[]) {
+  const txWithSpans = groupBy(
+    events.filter(
+      (event) => event['processor.event'] === 'span' || event['processor.event'] === 'transaction'
+    ),
+    (event) => event['transaction.id']
+  );
+
+  const metricsets: Map<string, Fields> = new Map();
+
+  Object.keys(txWithSpans).forEach((transactionId) => {
+    const txEvents = txWithSpans[transactionId];
+    const transaction = txEvents.find((event) => event['processor.event'] === 'transaction')!;
+
+    const eventsById: Record<string, Fields> = {};
+    const activityByParentId: Record<string, Array<{ from: number; to: number }>> = {};
+    for (const event of txEvents) {
+      const id =
+        event['processor.event'] === 'transaction' ? event['transaction.id'] : event['span.id'];
+      eventsById[id!] = event;
+
+      const parentId = event['parent.id'];
+
+      if (!parentId) {
+        continue;
+      }
+
+      if (!activityByParentId[parentId]) {
+        activityByParentId[parentId] = [];
+      }
+
+      const from = event['@timestamp']! * 1000;
+      const to =
+        from +
+        (event['processor.event'] === 'transaction'
+          ? event['transaction.duration.us']!
+          : event['span.duration.us']!);
+
+      activityByParentId[parentId].push({ from, to });
+    }
+
+    // eslint-disable-next-line guard-for-in
+    for (const id in eventsById) {
+      const event = eventsById[id];
+      const activities = activityByParentId[id] || [];
+
+      const timeStart = event['@timestamp']! * 1000;
+
+      let selfTime = 0;
+      let lastMeasurement = timeStart;
+      const changeTimestamps = [
+        ...new Set([
+          timeStart,
+          ...activities.flatMap((activity) => [activity.from, activity.to]),
+          timeStart +
+            (event['processor.event'] === 'transaction'
+              ? event['transaction.duration.us']!
+              : event['span.duration.us']!),
+        ]),
+      ];
+
+      for (const timestamp of changeTimestamps) {
+        const hasActiveChildren = activities.some(
+          (activity) => activity.from < timestamp && activity.to >= timestamp
+        );
+
+        if (!hasActiveChildren) {
+          selfTime += timestamp - lastMeasurement;
+        }
+
+        lastMeasurement = timestamp;
+      }
+
+      const key = {
+        '@timestamp': event['@timestamp']! - (event['@timestamp']! % (30 * 1000)),
+        'transaction.type': transaction['transaction.type'],
+        'transaction.name': transaction['transaction.name'],
+        ...pickBy(event, metricsetPicker),
+      };
+
+      const instance = pickBy(event, instancePicker);
+
+      const metricsetId = objectHash(key);
+
+      let metricset = metricsets.get(metricsetId);
+
+      if (!metricset) {
+        metricset = {
+          ...key,
+          ...instance,
+          'processor.event': 'metric',
+          'processor.name': 'metric',
+          'metricset.name': `span_breakdown`,
+          'span.self_time.count': 0,
+          'span.self_time.sum.us': 0,
+        };
+
+        if (event['processor.event'] === 'transaction') {
+          metricset['span.type'] = 'app';
+        } else {
+          metricset['span.type'] = event['span.type'];
+          metricset['span.subtype'] = event['span.subtype'];
+        }
+
+        metricsets.set(metricsetId, metricset);
+      }
+
+      metricset['span.self_time.count']!++;
+      metricset['span.self_time.sum.us']! += selfTime;
+    }
+  });
+
+  return Array.from(metricsets.values());
+}
diff --git a/packages/elastic-apm-generator/src/lib/utils/get_span_destination_metrics.ts b/packages/elastic-apm-generator/src/lib/utils/get_span_destination_metrics.ts
index 3740ad685735ee..decf2f71a9be42 100644
--- a/packages/elastic-apm-generator/src/lib/utils/get_span_destination_metrics.ts
+++ b/packages/elastic-apm-generator/src/lib/utils/get_span_destination_metrics.ts
@@ -6,46 +6,34 @@
  * Side Public License, v 1.
  */
 
-import { pick } from 'lodash';
-import moment from 'moment';
-import objectHash from 'object-hash';
 import { Fields } from '../entity';
+import { aggregate } from './aggregate';
 
 export function getSpanDestinationMetrics(events: Fields[]) {
   const exitSpans = events.filter((event) => !!event['span.destination.service.resource']);
 
-  const metricsets = new Map<string, Fields>();
+  const metricsets = aggregate(exitSpans, [
+    'event.outcome',
+    'agent.name',
+    'service.environment',
+    'service.name',
+    'span.destination.service.resource',
+  ]);
 
-  function getSpanBucketKey(span: Fields) {
-    return {
-      '@timestamp': moment(span['@timestamp']).startOf('minute').valueOf(),
-      ...pick(span, [
-        'event.outcome',
-        'agent.name',
-        'service.environment',
-        'service.name',
-        'span.destination.service.resource',
-      ]),
-    };
-  }
-
-  for (const span of exitSpans) {
-    const key = getSpanBucketKey(span);
-    const id = objectHash(key);
+  return metricsets.map((metricset) => {
+    let count = 0;
+    let sum = 0;
 
-    let metricset = metricsets.get(id);
-    if (!metricset) {
-      metricset = {
-        ['processor.event']: 'metric',
-        ...key,
-        'span.destination.service.response_time.sum.us': 0,
-        'span.destination.service.response_time.count': 0,
-      };
-      metricsets.set(id, metricset);
+    for (const event of metricset.events) {
+      count++;
+      sum += event['span.duration.us']!;
     }
-    metricset['span.destination.service.response_time.count']! += 1;
-    metricset['span.destination.service.response_time.sum.us']! += span['span.duration.us']!;
-  }
 
-  return [...Array.from(metricsets.values())];
+    return {
+      ...metricset.key,
+      ['metricset.name']: 'span_destination',
+      'span.destination.service.response_time.sum.us': sum,
+      'span.destination.service.response_time.count': count,
+    };
+  });
 }
diff --git a/packages/elastic-apm-generator/src/lib/utils/get_transaction_metrics.ts b/packages/elastic-apm-generator/src/lib/utils/get_transaction_metrics.ts
index 62ecb9e20006f2..4d46461c6dcc9b 100644
--- a/packages/elastic-apm-generator/src/lib/utils/get_transaction_metrics.ts
+++ b/packages/elastic-apm-generator/src/lib/utils/get_transaction_metrics.ts
@@ -6,10 +6,9 @@
  * Side Public License, v 1.
  */
 
-import { pick, sortBy } from 'lodash';
-import moment from 'moment';
-import objectHash from 'object-hash';
+import { sortBy } from 'lodash';
 import { Fields } from '../entity';
+import { aggregate } from './aggregate';
 
 function sortAndCompressHistogram(histogram?: { values: number[]; counts: number[] }) {
   return sortBy(histogram?.values).reduce(
@@ -30,60 +29,45 @@ function sortAndCompressHistogram(histogram?: { values: number[]; counts: number
 }
 
 export function getTransactionMetrics(events: Fields[]) {
-  const transactions = events.filter((event) => event['processor.event'] === 'transaction');
+  const transactions = events
+    .filter((event) => event['processor.event'] === 'transaction')
+    .map((transaction) => {
+      return {
+        ...transaction,
+        ['trace.root']: transaction['parent.id'] === undefined,
+      };
+    });
 
-  const metricsets = new Map<string, Fields>();
+  const metricsets = aggregate(transactions, [
+    'trace.root',
+    'transaction.name',
+    'transaction.type',
+    'event.outcome',
+    'transaction.result',
+    'agent.name',
+    'service.environment',
+    'service.name',
+    'service.version',
+    'host.name',
+    'container.id',
+    'kubernetes.pod.name',
+  ]);
 
-  function getTransactionBucketKey(transaction: Fields) {
-    return {
-      '@timestamp': moment(transaction['@timestamp']).startOf('minute').valueOf(),
-      'trace.root': transaction['parent.id'] === undefined,
-      ...pick(transaction, [
-        'transaction.name',
-        'transaction.type',
-        'event.outcome',
-        'transaction.result',
-        'agent.name',
-        'service.environment',
-        'service.name',
-        'service.version',
-        'host.name',
-        'container.id',
-        'kubernetes.pod.name',
-      ]),
+  return metricsets.map((metricset) => {
+    const histogram = {
+      values: [] as number[],
+      counts: [] as number[],
     };
-  }
 
-  for (const transaction of transactions) {
-    const key = getTransactionBucketKey(transaction);
-    const id = objectHash(key);
-    let metricset = metricsets.get(id);
-    if (!metricset) {
-      metricset = {
-        ...key,
-        ['processor.event']: 'metric',
-        'transaction.duration.histogram': {
-          values: [],
-          counts: [],
-        },
-      };
-      metricsets.set(id, metricset);
+    for (const transaction of metricset.events) {
+      histogram.counts.push(1);
+      histogram.values.push(Number(transaction['transaction.duration.us']));
     }
-    metricset['transaction.duration.histogram']?.counts.push(1);
-    metricset['transaction.duration.histogram']?.values.push(
-      Number(transaction['transaction.duration.us'])
-    );
-  }
 
-  return [
-    ...Array.from(metricsets.values()).map((metricset) => {
-      return {
-        ...metricset,
-        ['transaction.duration.histogram']: sortAndCompressHistogram(
-          metricset['transaction.duration.histogram']
-        ),
-        _doc_count: metricset['transaction.duration.histogram']!.values.length,
-      };
-    }),
-  ];
+    return {
+      ...metricset.key,
+      'transaction.duration.histogram': sortAndCompressHistogram(histogram),
+      _doc_count: metricset.events.length,
+    };
+  });
 }
diff --git a/packages/elastic-apm-generator/src/scripts/examples/01_simple_trace.ts b/packages/elastic-apm-generator/src/scripts/examples/01_simple_trace.ts
index eef3e6cc405600..7aae2986919c87 100644
--- a/packages/elastic-apm-generator/src/scripts/examples/01_simple_trace.ts
+++ b/packages/elastic-apm-generator/src/scripts/examples/01_simple_trace.ts
@@ -7,17 +7,18 @@
  */
 
 import { service, timerange, getTransactionMetrics, getSpanDestinationMetrics } from '../..';
+import { getBreakdownMetrics } from '../../lib/utils/get_breakdown_metrics';
 
 export function simpleTrace(from: number, to: number) {
   const instance = service('opbeans-go', 'production', 'go').instance('instance');
 
   const range = timerange(from, to);
 
-  const transactionName = '100rpm (75% success) failed 1000ms';
+  const transactionName = '100rpm (80% success) failed 1000ms';
 
   const successfulTraceEvents = range
-    .interval('1m')
-    .rate(75)
+    .interval('30s')
+    .rate(40)
     .flatMap((timestamp) =>
       instance
         .transaction(transactionName)
@@ -31,14 +32,14 @@ export function simpleTrace(from: number, to: number) {
             .success()
             .destination('elasticsearch')
             .timestamp(timestamp),
-          instance.span('custom_operation', 'app').duration(50).success().timestamp(timestamp)
+          instance.span('custom_operation', 'custom').duration(100).success().timestamp(timestamp)
         )
         .serialize()
     );
 
   const failedTraceEvents = range
-    .interval('1m')
-    .rate(25)
+    .interval('30s')
+    .rate(10)
     .flatMap((timestamp) =>
       instance
         .transaction(transactionName)
@@ -50,5 +51,10 @@ export function simpleTrace(from: number, to: number) {
 
   const events = successfulTraceEvents.concat(failedTraceEvents);
 
-  return events.concat(getTransactionMetrics(events)).concat(getSpanDestinationMetrics(events));
+  return [
+    ...events,
+    ...getTransactionMetrics(events),
+    ...getSpanDestinationMetrics(events),
+    ...getBreakdownMetrics(events),
+  ];
 }
diff --git a/packages/elastic-apm-generator/src/test/scenarios/01_simple_trace.test.ts b/packages/elastic-apm-generator/src/test/scenarios/01_simple_trace.test.ts
index 6bae70507dcbe7..733093ce0a71c3 100644
--- a/packages/elastic-apm-generator/src/test/scenarios/01_simple_trace.test.ts
+++ b/packages/elastic-apm-generator/src/test/scenarios/01_simple_trace.test.ts
@@ -68,6 +68,7 @@ describe('simple trace', () => {
     expect(transaction).toEqual({
       '@timestamp': 1609459200000,
       'agent.name': 'java',
+      'container.id': 'instance-1',
       'event.outcome': 'success',
       'processor.event': 'transaction',
       'processor.name': 'transaction',
@@ -89,6 +90,7 @@ describe('simple trace', () => {
     expect(span).toEqual({
       '@timestamp': 1609459200050,
       'agent.name': 'java',
+      'container.id': 'instance-1',
       'event.outcome': 'success',
       'parent.id': 'e7433020f2745625',
       'processor.event': 'span',
diff --git a/packages/elastic-apm-generator/src/test/scenarios/04_breakdown_metrics.test.ts b/packages/elastic-apm-generator/src/test/scenarios/04_breakdown_metrics.test.ts
new file mode 100644
index 00000000000000..aeb944f35faf60
--- /dev/null
+++ b/packages/elastic-apm-generator/src/test/scenarios/04_breakdown_metrics.test.ts
@@ -0,0 +1,105 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import { sumBy } from 'lodash';
+import { Fields } from '../../lib/entity';
+import { service } from '../../lib/service';
+import { timerange } from '../../lib/timerange';
+import { getBreakdownMetrics } from '../../lib/utils/get_breakdown_metrics';
+
+describe('breakdown metrics', () => {
+  let events: Fields[];
+
+  const LIST_RATE = 2;
+  const LIST_SPANS = 2;
+  const ID_RATE = 4;
+  const ID_SPANS = 2;
+  const INTERVALS = 6;
+
+  beforeEach(() => {
+    const javaService = service('opbeans-java', 'production', 'java');
+    const javaInstance = javaService.instance('instance-1');
+
+    const start = new Date('2021-01-01T00:00:00.000Z').getTime();
+
+    const range = timerange(start, start + INTERVALS * 30 * 1000 - 1);
+
+    events = getBreakdownMetrics([
+      ...range
+        .interval('30s')
+        .rate(LIST_RATE)
+        .flatMap((timestamp) =>
+          javaInstance
+            .transaction('GET /api/product/list')
+            .timestamp(timestamp)
+            .duration(1000)
+            .children(
+              javaInstance
+                .span('GET apm-*/_search', 'db', 'elasticsearch')
+                .timestamp(timestamp + 150)
+                .duration(500),
+              javaInstance.span('GET foo', 'db', 'redis').timestamp(timestamp).duration(100)
+            )
+            .serialize()
+        ),
+      ...range
+        .interval('30s')
+        .rate(ID_RATE)
+        .flatMap((timestamp) =>
+          javaInstance
+            .transaction('GET /api/product/:id')
+            .timestamp(timestamp)
+            .duration(1000)
+            .children(
+              javaInstance
+                .span('GET apm-*/_search', 'db', 'elasticsearch')
+                .duration(500)
+                .timestamp(timestamp + 100)
+                .children(
+                  javaInstance
+                    .span('bar', 'external', 'http')
+                    .timestamp(timestamp + 200)
+                    .duration(100)
+                )
+            )
+            .serialize()
+        ),
+    ]).filter((event) => event['processor.event'] === 'metric');
+  });
+
+  it('generates the right amount of breakdown metrics', () => {
+    expect(events.length).toBe(INTERVALS * (LIST_SPANS + 1 + ID_SPANS + 1));
+  });
+
+  it('calculates breakdown metrics for the right amount of transactions and spans', () => {
+    expect(sumBy(events, (event) => event['span.self_time.count']!)).toBe(
+      INTERVALS * LIST_RATE * (LIST_SPANS + 1) + INTERVALS * ID_RATE * (ID_SPANS + 1)
+    );
+  });
+
+  it('generates app metricsets for transaction self time', () => {
+    expect(events.some((event) => event['span.type'] === 'app' && !event['span.subtype'])).toBe(
+      true
+    );
+  });
+
+  it('generates the right statistic', () => {
+    const elasticsearchSets = events.filter((event) => event['span.subtype'] === 'elasticsearch');
+
+    const expectedCountFromListTransaction = INTERVALS * LIST_RATE;
+
+    const expectedCountFromIdTransaction = INTERVALS * ID_RATE;
+
+    const expectedCount = expectedCountFromIdTransaction + expectedCountFromListTransaction;
+
+    expect(sumBy(elasticsearchSets, (set) => set['span.self_time.count']!)).toBe(expectedCount);
+
+    expect(sumBy(elasticsearchSets, (set) => set['span.self_time.sum.us']!)).toBe(
+      expectedCountFromListTransaction * 500 * 1000 + expectedCountFromIdTransaction * 400 * 1000
+    );
+  });
+});
diff --git a/packages/elastic-apm-generator/src/test/scenarios/__snapshots__/01_simple_trace.test.ts.snap b/packages/elastic-apm-generator/src/test/scenarios/__snapshots__/01_simple_trace.test.ts.snap
index 6eec0ce38ba300..00a55cb87b125e 100644
--- a/packages/elastic-apm-generator/src/test/scenarios/__snapshots__/01_simple_trace.test.ts.snap
+++ b/packages/elastic-apm-generator/src/test/scenarios/__snapshots__/01_simple_trace.test.ts.snap
@@ -5,6 +5,7 @@ Array [
   Object {
     "@timestamp": 1609459200000,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "processor.event": "transaction",
     "processor.name": "transaction",
@@ -21,6 +22,7 @@ Array [
   Object {
     "@timestamp": 1609459200050,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "parent.id": "36c16f18e75058f8",
     "processor.event": "span",
@@ -39,6 +41,7 @@ Array [
   Object {
     "@timestamp": 1609459260000,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "processor.event": "transaction",
     "processor.name": "transaction",
@@ -55,6 +58,7 @@ Array [
   Object {
     "@timestamp": 1609459260050,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "parent.id": "65ce74106eb050be",
     "processor.event": "span",
@@ -73,6 +77,7 @@ Array [
   Object {
     "@timestamp": 1609459320000,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "processor.event": "transaction",
     "processor.name": "transaction",
@@ -89,6 +94,7 @@ Array [
   Object {
     "@timestamp": 1609459320050,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "parent.id": "91fa709d90625fff",
     "processor.event": "span",
@@ -107,6 +113,7 @@ Array [
   Object {
     "@timestamp": 1609459380000,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "processor.event": "transaction",
     "processor.name": "transaction",
@@ -123,6 +130,7 @@ Array [
   Object {
     "@timestamp": 1609459380050,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "parent.id": "6c500d1d19835e68",
     "processor.event": "span",
@@ -141,6 +149,7 @@ Array [
   Object {
     "@timestamp": 1609459440000,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "processor.event": "transaction",
     "processor.name": "transaction",
@@ -157,6 +166,7 @@ Array [
   Object {
     "@timestamp": 1609459440050,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "parent.id": "1b3246cc83595869",
     "processor.event": "span",
@@ -175,6 +185,7 @@ Array [
   Object {
     "@timestamp": 1609459500000,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "processor.event": "transaction",
     "processor.name": "transaction",
@@ -191,6 +202,7 @@ Array [
   Object {
     "@timestamp": 1609459500050,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "parent.id": "12b49e3c83fe58d5",
     "processor.event": "span",
@@ -209,6 +221,7 @@ Array [
   Object {
     "@timestamp": 1609459560000,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "processor.event": "transaction",
     "processor.name": "transaction",
@@ -225,6 +238,7 @@ Array [
   Object {
     "@timestamp": 1609459560050,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "parent.id": "d9272009dd4354a1",
     "processor.event": "span",
@@ -243,6 +257,7 @@ Array [
   Object {
     "@timestamp": 1609459620000,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "processor.event": "transaction",
     "processor.name": "transaction",
@@ -259,6 +274,7 @@ Array [
   Object {
     "@timestamp": 1609459620050,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "parent.id": "bc52ca08063c505b",
     "processor.event": "span",
@@ -277,6 +293,7 @@ Array [
   Object {
     "@timestamp": 1609459680000,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "processor.event": "transaction",
     "processor.name": "transaction",
@@ -293,6 +310,7 @@ Array [
   Object {
     "@timestamp": 1609459680050,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "parent.id": "186858dd88b75d59",
     "processor.event": "span",
@@ -311,6 +329,7 @@ Array [
   Object {
     "@timestamp": 1609459740000,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "processor.event": "transaction",
     "processor.name": "transaction",
@@ -327,6 +346,7 @@ Array [
   Object {
     "@timestamp": 1609459740050,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "parent.id": "0d5f44d48189546c",
     "processor.event": "span",
@@ -345,6 +365,7 @@ Array [
   Object {
     "@timestamp": 1609459800000,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "processor.event": "transaction",
     "processor.name": "transaction",
@@ -361,6 +382,7 @@ Array [
   Object {
     "@timestamp": 1609459800050,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "parent.id": "7483e0606e435c83",
     "processor.event": "span",
@@ -379,6 +401,7 @@ Array [
   Object {
     "@timestamp": 1609459860000,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "processor.event": "transaction",
     "processor.name": "transaction",
@@ -395,6 +418,7 @@ Array [
   Object {
     "@timestamp": 1609459860050,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "parent.id": "f142c4cbc7f3568e",
     "processor.event": "span",
@@ -413,6 +437,7 @@ Array [
   Object {
     "@timestamp": 1609459920000,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "processor.event": "transaction",
     "processor.name": "transaction",
@@ -429,6 +454,7 @@ Array [
   Object {
     "@timestamp": 1609459920050,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "parent.id": "2e3a47fa2d905519",
     "processor.event": "span",
@@ -447,6 +473,7 @@ Array [
   Object {
     "@timestamp": 1609459980000,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "processor.event": "transaction",
     "processor.name": "transaction",
@@ -463,6 +490,7 @@ Array [
   Object {
     "@timestamp": 1609459980050,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "parent.id": "de5eaa1e47dc56b1",
     "processor.event": "span",
@@ -481,6 +509,7 @@ Array [
   Object {
     "@timestamp": 1609460040000,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "processor.event": "transaction",
     "processor.name": "transaction",
@@ -497,6 +526,7 @@ Array [
   Object {
     "@timestamp": 1609460040050,
     "agent.name": "java",
+    "container.id": "instance-1",
     "event.outcome": "success",
     "parent.id": "af7eac7ae61e576a",
     "processor.event": "span",
diff --git a/x-pack/plugins/apm/server/lib/services/get_service_instances/get_service_instances_transaction_statistics.ts b/x-pack/plugins/apm/server/lib/services/get_service_instances/get_service_instances_transaction_statistics.ts
index 089282d6f1c34c..ec76e0d35e5c00 100644
--- a/x-pack/plugins/apm/server/lib/services/get_service_instances/get_service_instances_transaction_statistics.ts
+++ b/x-pack/plugins/apm/server/lib/services/get_service_instances/get_service_instances_transaction_statistics.ts
@@ -109,6 +109,9 @@ export async function getServiceInstancesTransactionStatistics<
       filter: [
         { term: { [SERVICE_NAME]: serviceName } },
         { term: { [TRANSACTION_TYPE]: transactionType } },
+        ...getDocumentTypeFilterForAggregatedTransactions(
+          searchAggregatedTransactions
+        ),
         ...rangeQuery(start, end),
         ...environmentQuery(environment),
         ...kqlQuery(kuery),
diff --git a/x-pack/test/apm_api_integration/common/trace_data.ts b/x-pack/test/apm_api_integration/common/trace_data.ts
index 9c96d3fa1e0b08..84bbb4beea4f4d 100644
--- a/x-pack/test/apm_api_integration/common/trace_data.ts
+++ b/x-pack/test/apm_api_integration/common/trace_data.ts
@@ -6,6 +6,7 @@
  */
 
 import {
+  getBreakdownMetrics,
   getSpanDestinationMetrics,
   getTransactionMetrics,
   toElasticsearchOutput,
@@ -20,7 +21,12 @@ export async function traceData(context: InheritedFtrProviderContext) {
   return {
     index: (events: any[]) => {
       const esEvents = toElasticsearchOutput(
-        events.concat(getTransactionMetrics(events)).concat(getSpanDestinationMetrics(events)),
+        [
+          ...events,
+          ...getTransactionMetrics(events),
+          ...getSpanDestinationMetrics(events),
+          ...getBreakdownMetrics(events),
+        ],
         '7.14.0'
       );
 
diff --git a/x-pack/test/apm_api_integration/tests/service_overview/instances_main_statistics.ts b/x-pack/test/apm_api_integration/tests/service_overview/instances_main_statistics.ts
index 2d165f4ceb902a..cdf62053a821b0 100644
--- a/x-pack/test/apm_api_integration/tests/service_overview/instances_main_statistics.ts
+++ b/x-pack/test/apm_api_integration/tests/service_overview/instances_main_statistics.ts
@@ -8,6 +8,7 @@
 import expect from '@kbn/expect';
 import { pick, sortBy } from 'lodash';
 import moment from 'moment';
+import { service, timerange } from '@elastic/apm-generator';
 import { APIReturnType } from '../../../../plugins/apm/public/services/rest/createCallApmApi';
 import { isFiniteNumber } from '../../../../plugins/apm/common/utils/is_finite_number';
 import { FtrProviderContext } from '../../common/ftr_provider_context';
@@ -15,9 +16,12 @@ import archives from '../../common/fixtures/es_archiver/archives_metadata';
 import { registry } from '../../common/registry';
 
 import { LatencyAggregationType } from '../../../../plugins/apm/common/latency_aggregation_types';
+import { ENVIRONMENT_ALL } from '../../../../plugins/apm/common/environment_filter_values';
+import { SERVICE_NODE_NAME_MISSING } from '../../../../plugins/apm/common/service_nodes';
 
 export default function ApiTest({ getService }: FtrProviderContext) {
   const apmApiClient = getService('apmApiClient');
+  const traceData = getService('traceData');
 
   const archiveName = 'apm_8.0.0';
   const { start, end } = archives[archiveName];
@@ -278,4 +282,145 @@ export default function ApiTest({ getService }: FtrProviderContext) {
       });
     }
   );
+
+  registry.when(
+    'Service overview instances main statistics when data is generated',
+    { config: 'basic', archives: ['apm_8.0.0_empty'] },
+    () => {
+      describe('for two go instances and one java instance', () => {
+        const GO_A_INSTANCE_RATE_SUCCESS = 10;
+        const GO_A_INSTANCE_RATE_FAILURE = 5;
+        const GO_B_INSTANCE_RATE_SUCCESS = 15;
+
+        const JAVA_INSTANCE_RATE = 20;
+
+        const rangeStart = new Date('2021-01-01T12:00:00.000Z').getTime();
+        const rangeEnd = new Date('2021-01-01T12:15:00.000Z').getTime() - 1;
+
+        before(async () => {
+          const goService = service('opbeans-go', 'production', 'go');
+          const javaService = service('opbeans-java', 'production', 'java');
+
+          const goInstanceA = goService.instance('go-instance-a');
+          const goInstanceB = goService.instance('go-instance-b');
+          const javaInstance = javaService.instance('java-instance');
+
+          const interval = timerange(rangeStart, rangeEnd).interval('1m');
+
+          // include exit spans to generate span_destination metrics
+          // that should not be included
+          function withSpans(timestamp: number) {
+            return new Array(3).fill(undefined).map(() =>
+              goInstanceA
+                .span('GET apm-*/_search', 'db', 'elasticsearch')
+                .timestamp(timestamp + 100)
+                .duration(300)
+                .destination('elasticsearch')
+                .success()
+            );
+          }
+
+          return traceData.index([
+            ...interval.rate(GO_A_INSTANCE_RATE_SUCCESS).flatMap((timestamp) =>
+              goInstanceA
+                .transaction('GET /api/product/list')
+                .success()
+                .duration(500)
+                .timestamp(timestamp)
+                .children(...withSpans(timestamp))
+                .serialize()
+            ),
+            ...interval.rate(GO_A_INSTANCE_RATE_FAILURE).flatMap((timestamp) =>
+              goInstanceA
+                .transaction('GET /api/product/list')
+                .failure()
+                .duration(500)
+                .timestamp(timestamp)
+                .children(...withSpans(timestamp))
+                .serialize()
+            ),
+            ...interval.rate(GO_B_INSTANCE_RATE_SUCCESS).flatMap((timestamp) =>
+              goInstanceB
+                .transaction('GET /api/product/list')
+                .success()
+                .duration(500)
+                .timestamp(timestamp)
+                .children(...withSpans(timestamp))
+                .serialize()
+            ),
+            ...interval.rate(JAVA_INSTANCE_RATE).flatMap((timestamp) =>
+              javaInstance
+                .transaction('GET /api/product/list')
+                .success()
+                .duration(500)
+                .timestamp(timestamp)
+                .children(...withSpans(timestamp))
+                .serialize()
+            ),
+          ]);
+        });
+
+        after(async () => {
+          return traceData.clean();
+        });
+
+        describe('for the go service', () => {
+          let body: APIReturnType<'GET /internal/apm/services/{serviceName}/service_overview_instances/main_statistics'>;
+
+          before(async () => {
+            body = (
+              await apmApiClient.readUser({
+                endpoint:
+                  'GET /internal/apm/services/{serviceName}/service_overview_instances/main_statistics',
+                params: {
+                  path: {
+                    serviceName: 'opbeans-go',
+                  },
+                  query: {
+                    start: new Date(rangeStart).toISOString(),
+                    end: new Date(rangeEnd + 1).toISOString(),
+                    environment: ENVIRONMENT_ALL.value,
+                    kuery: '',
+                    latencyAggregationType: LatencyAggregationType.avg,
+                    transactionType: 'request',
+                  },
+                },
+              })
+            ).body;
+          });
+
+          it('returns statistics for the go instances', () => {
+            const goAStats = body.currentPeriod.find(
+              (stat) => stat.serviceNodeName === 'go-instance-a'
+            );
+            const goBStats = body.currentPeriod.find(
+              (stat) => stat.serviceNodeName === 'go-instance-b'
+            );
+
+            expect(goAStats?.throughput).to.eql(
+              GO_A_INSTANCE_RATE_SUCCESS + GO_A_INSTANCE_RATE_FAILURE
+            );
+
+            expect(goBStats?.throughput).to.eql(GO_B_INSTANCE_RATE_SUCCESS);
+          });
+
+          it('does not return data for the java service', () => {
+            const javaStats = body.currentPeriod.find(
+              (stat) => stat.serviceNodeName === 'java-instance'
+            );
+
+            expect(javaStats).to.be(undefined);
+          });
+
+          it('does not return data for missing service node name', () => {
+            const missingNameStats = body.currentPeriod.find(
+              (stat) => stat.serviceNodeName === SERVICE_NODE_NAME_MISSING
+            );
+
+            expect(missingNameStats).to.be(undefined);
+          });
+        });
+      });
+    }
+  );
 }

From 6d5354a99df279221166648fb6c5fa3381201d81 Mon Sep 17 00:00:00 2001
From: Clint Andrew Hall <clint.hall@elastic.co>
Date: Wed, 13 Oct 2021 12:50:20 -0500
Subject: [PATCH 14/71] [fleet][integrations] Provide Deployment Details on
 Cloud (#114287)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 ...-plugin-core-public.doclinksstart.links.md |   1 +
 .../public/doc_links/doc_links_service.ts     |   2 +
 src/core/public/public.api.md                 |   1 +
 x-pack/plugins/fleet/kibana.json              |   2 +-
 .../public/applications/integrations/app.tsx  |  77 ++++++-----
 .../header/deployment_details.component.tsx   | 120 ++++++++++++++++++
 .../header/deployment_details.stories.tsx     |  56 ++++++++
 .../components/header/deployment_details.tsx  |  51 ++++++++
 .../integrations/components/header/header.tsx |  32 +++++
 .../components/header/header_portal.tsx       |  35 +++++
 .../integrations/components/header/index.ts   |   8 ++
 .../applications/integrations/index.tsx       |   6 +-
 .../public/mock/create_test_renderer.tsx      |   4 +
 .../fleet/public/mock/plugin_dependencies.ts  |   2 +
 x-pack/plugins/fleet/public/plugin.ts         |   5 +
 .../plugins/fleet/storybook/context/cloud.ts  |  23 ++++
 .../fleet/storybook/context/doc_links.ts      |   1 +
 .../plugins/fleet/storybook/context/index.tsx |  27 +++-
 .../plugins/fleet/storybook/context/share.ts  |  22 ++++
 .../plugins/fleet/storybook/context/stubs.tsx |   4 +-
 x-pack/plugins/fleet/storybook/decorator.tsx  |   2 +-
 21 files changed, 436 insertions(+), 45 deletions(-)
 create mode 100644 x-pack/plugins/fleet/public/applications/integrations/components/header/deployment_details.component.tsx
 create mode 100644 x-pack/plugins/fleet/public/applications/integrations/components/header/deployment_details.stories.tsx
 create mode 100644 x-pack/plugins/fleet/public/applications/integrations/components/header/deployment_details.tsx
 create mode 100644 x-pack/plugins/fleet/public/applications/integrations/components/header/header.tsx
 create mode 100644 x-pack/plugins/fleet/public/applications/integrations/components/header/header_portal.tsx
 create mode 100644 x-pack/plugins/fleet/public/applications/integrations/components/header/index.ts
 create mode 100644 x-pack/plugins/fleet/storybook/context/cloud.ts
 create mode 100644 x-pack/plugins/fleet/storybook/context/share.ts

diff --git a/docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md b/docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md
index 055cf213dea909..e79bc7a0db0262 100644
--- a/docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md
+++ b/docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md
@@ -240,6 +240,7 @@ readonly links: {
             upgradeElasticAgent: string;
             upgradeElasticAgent712lower: string;
             learnMoreBlog: string;
+            apiKeysLearnMore: string;
         }>;
         readonly ecs: {
             readonly guide: string;
diff --git a/src/core/public/doc_links/doc_links_service.ts b/src/core/public/doc_links/doc_links_service.ts
index 6039a0766a1a16..ac0aac3466f5f5 100644
--- a/src/core/public/doc_links/doc_links_service.ts
+++ b/src/core/public/doc_links/doc_links_service.ts
@@ -482,6 +482,7 @@ export class DocLinksService {
           upgradeElasticAgent: `${FLEET_DOCS}upgrade-elastic-agent.html`,
           upgradeElasticAgent712lower: `${FLEET_DOCS}upgrade-elastic-agent.html#upgrade-7.12-lower`,
           learnMoreBlog: `${ELASTIC_WEBSITE_URL}blog/elastic-agent-and-fleet-make-it-easier-to-integrate-your-systems-with-elastic`,
+          apiKeysLearnMore: `${KIBANA_DOCS}api-keys.html`,
         },
         ecs: {
           guide: `${ELASTIC_WEBSITE_URL}guide/en/ecs/current/index.html`,
@@ -741,6 +742,7 @@ export interface DocLinksStart {
       upgradeElasticAgent: string;
       upgradeElasticAgent712lower: string;
       learnMoreBlog: string;
+      apiKeysLearnMore: string;
     }>;
     readonly ecs: {
       readonly guide: string;
diff --git a/src/core/public/public.api.md b/src/core/public/public.api.md
index 7b0ec39d4a4d9a..50c9bcf925969f 100644
--- a/src/core/public/public.api.md
+++ b/src/core/public/public.api.md
@@ -709,6 +709,7 @@ export interface DocLinksStart {
             upgradeElasticAgent: string;
             upgradeElasticAgent712lower: string;
             learnMoreBlog: string;
+            apiKeysLearnMore: string;
         }>;
         readonly ecs: {
             readonly guide: string;
diff --git a/x-pack/plugins/fleet/kibana.json b/x-pack/plugins/fleet/kibana.json
index c4782156b19826..9de538ee91b8c3 100644
--- a/x-pack/plugins/fleet/kibana.json
+++ b/x-pack/plugins/fleet/kibana.json
@@ -8,7 +8,7 @@
   "server": true,
   "ui": true,
   "configPath": ["xpack", "fleet"],
-  "requiredPlugins": ["licensing", "data", "encryptedSavedObjects", "navigation", "customIntegrations"],
+  "requiredPlugins": ["licensing", "data", "encryptedSavedObjects", "navigation", "customIntegrations", "share"],
   "optionalPlugins": ["security", "features", "cloud", "usageCollection", "home", "globalSearch"],
   "extraPublicDirs": ["common"],
   "requiredBundles": ["kibanaReact", "esUiShared", "home", "infra", "kibanaUtils"]
diff --git a/x-pack/plugins/fleet/public/applications/integrations/app.tsx b/x-pack/plugins/fleet/public/applications/integrations/app.tsx
index 771b17ae8c3ee6..c2f6f53627e382 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/app.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/app.tsx
@@ -40,6 +40,7 @@ import { EPMApp } from './sections/epm';
 import { DefaultLayout } from './layouts';
 import { PackageInstallProvider } from './hooks';
 import { useBreadcrumbs, UIExtensionsContext } from './hooks';
+import { IntegrationsHeader } from './components/header';
 
 const ErrorLayout = ({ children }: { children: JSX.Element }) => (
   <EuiErrorBoundary>
@@ -127,41 +128,53 @@ export const IntegrationsAppContext: React.FC<{
   history: AppMountParameters['history'];
   kibanaVersion: string;
   extensions: UIExtensionsStorage;
+  setHeaderActionMenu: AppMountParameters['setHeaderActionMenu'];
   /** For testing purposes only */
   routerHistory?: History<any>; // TODO remove
-}> = memo(({ children, startServices, config, history, kibanaVersion, extensions }) => {
-  const isDarkMode = useObservable<boolean>(startServices.uiSettings.get$('theme:darkMode'));
+}> = memo(
+  ({
+    children,
+    startServices,
+    config,
+    history,
+    kibanaVersion,
+    extensions,
+    setHeaderActionMenu,
+  }) => {
+    const isDarkMode = useObservable<boolean>(startServices.uiSettings.get$('theme:darkMode'));
 
-  return (
-    <RedirectAppLinks application={startServices.application}>
-      <startServices.i18n.Context>
-        <KibanaContextProvider services={{ ...startServices }}>
-          <EuiErrorBoundary>
-            <ConfigContext.Provider value={config}>
-              <KibanaVersionContext.Provider value={kibanaVersion}>
-                <EuiThemeProvider darkMode={isDarkMode}>
-                  <UIExtensionsContext.Provider value={extensions}>
-                    <FleetStatusProvider>
-                      <startServices.customIntegrations.ContextProvider>
-                        <Router history={history}>
-                          <AgentPolicyContextProvider>
-                            <PackageInstallProvider notifications={startServices.notifications}>
-                              {children}
-                            </PackageInstallProvider>
-                          </AgentPolicyContextProvider>
-                        </Router>
-                      </startServices.customIntegrations.ContextProvider>
-                    </FleetStatusProvider>
-                  </UIExtensionsContext.Provider>
-                </EuiThemeProvider>
-              </KibanaVersionContext.Provider>
-            </ConfigContext.Provider>
-          </EuiErrorBoundary>
-        </KibanaContextProvider>
-      </startServices.i18n.Context>
-    </RedirectAppLinks>
-  );
-});
+    return (
+      <RedirectAppLinks application={startServices.application}>
+        <startServices.i18n.Context>
+          <KibanaContextProvider services={{ ...startServices }}>
+            <EuiErrorBoundary>
+              <ConfigContext.Provider value={config}>
+                <KibanaVersionContext.Provider value={kibanaVersion}>
+                  <EuiThemeProvider darkMode={isDarkMode}>
+                    <UIExtensionsContext.Provider value={extensions}>
+                      <FleetStatusProvider>
+                        <startServices.customIntegrations.ContextProvider>
+                          <Router history={history}>
+                            <AgentPolicyContextProvider>
+                              <PackageInstallProvider notifications={startServices.notifications}>
+                                <IntegrationsHeader {...{ setHeaderActionMenu }} />
+                                {children}
+                              </PackageInstallProvider>
+                            </AgentPolicyContextProvider>
+                          </Router>
+                        </startServices.customIntegrations.ContextProvider>
+                      </FleetStatusProvider>
+                    </UIExtensionsContext.Provider>
+                  </EuiThemeProvider>
+                </KibanaVersionContext.Provider>
+              </ConfigContext.Provider>
+            </EuiErrorBoundary>
+          </KibanaContextProvider>
+        </startServices.i18n.Context>
+      </RedirectAppLinks>
+    );
+  }
+);
 
 export const AppRoutes = memo(() => {
   const { modal, setModal } = useUrlModal();
diff --git a/x-pack/plugins/fleet/public/applications/integrations/components/header/deployment_details.component.tsx b/x-pack/plugins/fleet/public/applications/integrations/components/header/deployment_details.component.tsx
new file mode 100644
index 00000000000000..1fa673890fa82e
--- /dev/null
+++ b/x-pack/plugins/fleet/public/applications/integrations/components/header/deployment_details.component.tsx
@@ -0,0 +1,120 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import styled from 'styled-components';
+
+import {
+  EuiPopover,
+  EuiText,
+  EuiForm,
+  EuiFormRow,
+  EuiFieldText,
+  EuiCopy,
+  EuiButtonIcon,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiButton,
+  EuiLink,
+  EuiHeaderLink,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+
+export interface Props {
+  endpointUrl: string;
+  cloudId: string;
+  managementUrl?: string;
+  learnMoreUrl: string;
+}
+
+const Description = styled(EuiText)`
+  margin-bottom: ${({ theme }) => theme.eui.euiSizeL};
+`;
+
+export const DeploymentDetails = ({ endpointUrl, cloudId, learnMoreUrl, managementUrl }: Props) => {
+  const [isOpen, setIsOpen] = React.useState(false);
+
+  const button = (
+    <EuiHeaderLink onClick={() => setIsOpen(!isOpen)} iconType="iInCircle" iconSide="left" isActive>
+      {i18n.translate('xpack.fleet.integrations.deploymentButton', {
+        defaultMessage: 'View deployment details',
+      })}
+    </EuiHeaderLink>
+  );
+
+  const management = managementUrl ? (
+    <EuiFormRow label="API keys" fullWidth>
+      <EuiFlexGroup gutterSize="m" alignItems="center">
+        <EuiFlexItem>
+          <EuiButton href={managementUrl}>Create and manage API keys</EuiButton>
+        </EuiFlexItem>
+        <EuiFlexItem>
+          <EuiLink external href={learnMoreUrl} target="_blank">
+            Learn more
+          </EuiLink>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    </EuiFormRow>
+  ) : null;
+
+  return (
+    <EuiPopover
+      isOpen={isOpen}
+      closePopover={() => setIsOpen(false)}
+      button={button}
+      anchorPosition="downCenter"
+    >
+      <div style={{ width: 450 }}>
+        <Description>
+          Send data to Elastic from your applications by referencing your deployment and
+          Elasticsearch information.
+        </Description>
+        <EuiForm component="div">
+          <EuiFormRow label="Elasticsearch endpoint" fullWidth isDisabled>
+            <EuiFlexGroup gutterSize="s">
+              <EuiFlexItem>
+                <EuiFieldText value={endpointUrl} fullWidth disabled />
+              </EuiFlexItem>
+              <EuiFlexItem grow={false}>
+                <EuiCopy textToCopy={endpointUrl}>
+                  {(copy) => (
+                    <EuiButtonIcon
+                      onClick={copy}
+                      iconType="copyClipboard"
+                      display="base"
+                      size="m"
+                    />
+                  )}
+                </EuiCopy>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </EuiFormRow>
+          <EuiFormRow label="Cloud ID" fullWidth>
+            <EuiFlexGroup gutterSize="s">
+              <EuiFlexItem>
+                <EuiFieldText value={cloudId} fullWidth disabled />
+              </EuiFlexItem>
+              <EuiFlexItem grow={false}>
+                <EuiCopy textToCopy={cloudId}>
+                  {(copy) => (
+                    <EuiButtonIcon
+                      onClick={copy}
+                      iconType="copyClipboard"
+                      display="base"
+                      size="m"
+                    />
+                  )}
+                </EuiCopy>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </EuiFormRow>
+          {management}
+        </EuiForm>
+      </div>
+    </EuiPopover>
+  );
+};
diff --git a/x-pack/plugins/fleet/public/applications/integrations/components/header/deployment_details.stories.tsx b/x-pack/plugins/fleet/public/applications/integrations/components/header/deployment_details.stories.tsx
new file mode 100644
index 00000000000000..445bf471c0fe9d
--- /dev/null
+++ b/x-pack/plugins/fleet/public/applications/integrations/components/header/deployment_details.stories.tsx
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import type { Meta } from '@storybook/react';
+import { EuiHeader } from '@elastic/eui';
+
+import { DeploymentDetails as ConnectedComponent } from './deployment_details';
+import type { Props as PureComponentProps } from './deployment_details.component';
+import { DeploymentDetails as PureComponent } from './deployment_details.component';
+
+export default {
+  title: 'Sections/EPM/Deployment Details',
+  description: '',
+  decorators: [
+    (storyFn) => {
+      const sections = [{ items: [] }, { items: [storyFn()] }];
+      return <EuiHeader sections={sections} />;
+    },
+  ],
+} as Meta;
+
+export const DeploymentDetails = () => {
+  return <ConnectedComponent />;
+};
+
+DeploymentDetails.args = {
+  isCloudEnabled: true,
+};
+
+DeploymentDetails.argTypes = {
+  isCloudEnabled: {
+    type: {
+      name: 'boolean',
+    },
+    defaultValue: true,
+    control: {
+      type: 'boolean',
+    },
+  },
+};
+
+export const Component = (props: PureComponentProps) => {
+  return <PureComponent {...props} />;
+};
+
+Component.args = {
+  cloudId: 'cloud-id',
+  endpointUrl: 'https://endpoint-url',
+  learnMoreUrl: 'https://learn-more-url',
+  managementUrl: 'https://management-url',
+};
diff --git a/x-pack/plugins/fleet/public/applications/integrations/components/header/deployment_details.tsx b/x-pack/plugins/fleet/public/applications/integrations/components/header/deployment_details.tsx
new file mode 100644
index 00000000000000..48c8fa56fb91ba
--- /dev/null
+++ b/x-pack/plugins/fleet/public/applications/integrations/components/header/deployment_details.tsx
@@ -0,0 +1,51 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { useStartServices } from '../../hooks';
+
+import { DeploymentDetails as Component } from './deployment_details.component';
+
+export const DeploymentDetails = () => {
+  const { share, cloud, docLinks } = useStartServices();
+
+  // If the cloud plugin isn't enabled, we can't display the flyout.
+  if (!cloud) {
+    return null;
+  }
+
+  const { isCloudEnabled, cloudId, cname } = cloud;
+
+  // If cloud isn't enabled, we don't have a cloudId or a cname, we can't display the flyout.
+  if (!isCloudEnabled || !cloudId || !cname) {
+    return null;
+  }
+
+  // If the cname doesn't start with a known prefix, we can't display the flyout.
+  // TODO: dover - this is a short term solution, see https://github.com/elastic/kibana/pull/114287#issuecomment-940111026
+  if (
+    !(
+      cname.endsWith('elastic-cloud.com') ||
+      cname.endsWith('found.io') ||
+      cname.endsWith('found.no')
+    )
+  ) {
+    return null;
+  }
+
+  const cnameNormalized = cname.startsWith('.') ? cname.substring(1) : cname;
+  const endpointUrl = `https://${cloudId}.${cnameNormalized}`;
+
+  const managementUrl = share.url.locators
+    .get('MANAGEMENT_APP_LOCATOR')
+    ?.useUrl({ sectionId: 'security', appId: 'api_keys' });
+
+  const learnMoreUrl = docLinks.links.fleet.apiKeysLearnMore;
+
+  return <Component {...{ cloudId, endpointUrl, managementUrl, learnMoreUrl }} />;
+};
diff --git a/x-pack/plugins/fleet/public/applications/integrations/components/header/header.tsx b/x-pack/plugins/fleet/public/applications/integrations/components/header/header.tsx
new file mode 100644
index 00000000000000..e87c63e98ef28c
--- /dev/null
+++ b/x-pack/plugins/fleet/public/applications/integrations/components/header/header.tsx
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiHeaderSectionItem, EuiHeaderSection, EuiHeaderLinks } from '@elastic/eui';
+
+import type { AppMountParameters } from 'kibana/public';
+
+import { HeaderPortal } from './header_portal';
+import { DeploymentDetails } from './deployment_details';
+
+export const IntegrationsHeader = ({
+  setHeaderActionMenu,
+}: {
+  setHeaderActionMenu: AppMountParameters['setHeaderActionMenu'];
+}) => {
+  return (
+    <HeaderPortal {...{ setHeaderActionMenu }}>
+      <EuiHeaderSection grow={false}>
+        <EuiHeaderSectionItem>
+          <EuiHeaderLinks>
+            <DeploymentDetails />
+          </EuiHeaderLinks>
+        </EuiHeaderSectionItem>
+      </EuiHeaderSection>
+    </HeaderPortal>
+  );
+};
diff --git a/x-pack/plugins/fleet/public/applications/integrations/components/header/header_portal.tsx b/x-pack/plugins/fleet/public/applications/integrations/components/header/header_portal.tsx
new file mode 100644
index 00000000000000..d3dbbcf9628ec8
--- /dev/null
+++ b/x-pack/plugins/fleet/public/applications/integrations/components/header/header_portal.tsx
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { AppMountParameters } from 'kibana/public';
+import type { FC } from 'react';
+import React, { useEffect, useMemo } from 'react';
+import { createPortalNode, InPortal, OutPortal } from 'react-reverse-portal';
+
+import { toMountPoint } from '../../../../../../../../src/plugins/kibana_react/public';
+
+export interface Props {
+  setHeaderActionMenu: AppMountParameters['setHeaderActionMenu'];
+}
+
+export const HeaderPortal: FC<Props> = ({ children, setHeaderActionMenu }) => {
+  const portalNode = useMemo(() => createPortalNode(), []);
+
+  useEffect(() => {
+    setHeaderActionMenu((element) => {
+      const mount = toMountPoint(<OutPortal node={portalNode} />);
+      return mount(element);
+    });
+
+    return () => {
+      portalNode.unmount();
+      setHeaderActionMenu(undefined);
+    };
+  }, [portalNode, setHeaderActionMenu]);
+
+  return <InPortal node={portalNode}>{children}</InPortal>;
+};
diff --git a/x-pack/plugins/fleet/public/applications/integrations/components/header/index.ts b/x-pack/plugins/fleet/public/applications/integrations/components/header/index.ts
new file mode 100644
index 00000000000000..e0a342326d9723
--- /dev/null
+++ b/x-pack/plugins/fleet/public/applications/integrations/components/header/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { IntegrationsHeader } from './header';
diff --git a/x-pack/plugins/fleet/public/applications/integrations/index.tsx b/x-pack/plugins/fleet/public/applications/integrations/index.tsx
index da8959a019ce57..0abb78f850076b 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/index.tsx
@@ -37,6 +37,7 @@ interface IntegrationsAppProps {
   history: AppMountParameters['history'];
   kibanaVersion: string;
   extensions: UIExtensionsStorage;
+  setHeaderActionMenu: AppMountParameters['setHeaderActionMenu'];
 }
 const IntegrationsApp = ({
   basepath,
@@ -45,6 +46,7 @@ const IntegrationsApp = ({
   history,
   kibanaVersion,
   extensions,
+  setHeaderActionMenu,
 }: IntegrationsAppProps) => {
   return (
     <IntegrationsAppContext
@@ -54,6 +56,7 @@ const IntegrationsApp = ({
       history={history}
       kibanaVersion={kibanaVersion}
       extensions={extensions}
+      setHeaderActionMenu={setHeaderActionMenu}
     >
       <WithPermissionsAndSetup>
         <AppRoutes />
@@ -64,7 +67,7 @@ const IntegrationsApp = ({
 
 export function renderApp(
   startServices: FleetStartServices,
-  { element, appBasePath, history }: AppMountParameters,
+  { element, appBasePath, history, setHeaderActionMenu }: AppMountParameters,
   config: FleetConfigType,
   kibanaVersion: string,
   extensions: UIExtensionsStorage
@@ -77,6 +80,7 @@ export function renderApp(
       history={history}
       kibanaVersion={kibanaVersion}
       extensions={extensions}
+      setHeaderActionMenu={setHeaderActionMenu}
     />,
     element
   );
diff --git a/x-pack/plugins/fleet/public/mock/create_test_renderer.tsx b/x-pack/plugins/fleet/public/mock/create_test_renderer.tsx
index d0724545ee9025..a0a9ef405540a5 100644
--- a/x-pack/plugins/fleet/public/mock/create_test_renderer.tsx
+++ b/x-pack/plugins/fleet/public/mock/create_test_renderer.tsx
@@ -41,6 +41,7 @@ export interface TestRenderer {
   kibanaVersion: string;
   AppWrapper: React.FC<any>;
   render: UiRender;
+  setHeaderActionMenu: Function;
 }
 
 export const createFleetTestRendererMock = (): TestRenderer => {
@@ -55,6 +56,7 @@ export const createFleetTestRendererMock = (): TestRenderer => {
     config: createConfigurationMock(),
     startInterface: createStartMock(extensions),
     kibanaVersion: '8.0.0',
+    setHeaderActionMenu: jest.fn(),
     AppWrapper: memo(({ children }) => {
       return (
         <FleetAppContext
@@ -96,6 +98,7 @@ export const createIntegrationsTestRendererMock = (): TestRenderer => {
     config: createConfigurationMock(),
     startInterface: createStartMock(extensions),
     kibanaVersion: '8.0.0',
+    setHeaderActionMenu: jest.fn(),
     AppWrapper: memo(({ children }) => {
       return (
         <IntegrationsAppContext
@@ -106,6 +109,7 @@ export const createIntegrationsTestRendererMock = (): TestRenderer => {
           kibanaVersion={testRendererMocks.kibanaVersion}
           extensions={extensions}
           routerHistory={testRendererMocks.history}
+          setHeaderActionMenu={() => {}}
         >
           {children}
         </IntegrationsAppContext>
diff --git a/x-pack/plugins/fleet/public/mock/plugin_dependencies.ts b/x-pack/plugins/fleet/public/mock/plugin_dependencies.ts
index f78fe58a6ad881..0bf0213905e723 100644
--- a/x-pack/plugins/fleet/public/mock/plugin_dependencies.ts
+++ b/x-pack/plugins/fleet/public/mock/plugin_dependencies.ts
@@ -10,6 +10,7 @@ import { licensingMock } from '../../../licensing/public/mocks';
 import { homePluginMock } from '../../../../../src/plugins/home/public/mocks';
 import { navigationPluginMock } from '../../../../../src/plugins/navigation/public/mocks';
 import { customIntegrationsMock } from '../../../../../src/plugins/custom_integrations/public/mocks';
+import { sharePluginMock } from '../../../../../src/plugins/share/public/mocks';
 
 import type { MockedFleetSetupDeps, MockedFleetStartDeps } from './types';
 
@@ -27,5 +28,6 @@ export const createStartDepsMock = (): MockedFleetStartDeps => {
     data: dataPluginMock.createStartContract(),
     navigation: navigationPluginMock.createStartContract(),
     customIntegrations: customIntegrationsMock.createStart(),
+    share: sharePluginMock.createStartContract(),
   };
 };
diff --git a/x-pack/plugins/fleet/public/plugin.ts b/x-pack/plugins/fleet/public/plugin.ts
index d23bfcfe7b888a..e1f263b0763e87 100644
--- a/x-pack/plugins/fleet/public/plugin.ts
+++ b/x-pack/plugins/fleet/public/plugin.ts
@@ -21,6 +21,8 @@ import type {
   CustomIntegrationsSetup,
 } from 'src/plugins/custom_integrations/public';
 
+import type { SharePluginStart } from 'src/plugins/share/public';
+
 import { DEFAULT_APP_CATEGORIES, AppNavLinkStatus } from '../../../../src/core/public';
 
 import type {
@@ -81,10 +83,12 @@ export interface FleetStartDeps {
   data: DataPublicPluginStart;
   navigation: NavigationPublicPluginStart;
   customIntegrations: CustomIntegrationsStart;
+  share: SharePluginStart;
 }
 
 export interface FleetStartServices extends CoreStart, FleetStartDeps {
   storage: Storage;
+  share: SharePluginStart;
   cloud?: CloudSetup;
 }
 
@@ -134,6 +138,7 @@ export class FleetPlugin implements Plugin<FleetSetup, FleetStart, FleetSetupDep
           ...coreStartServices,
           ...startDepsServices,
           storage: this.storage,
+          cloud: deps.cloud,
         };
         const { renderApp, teardownIntegrations } = await import('./applications/integrations');
         const unmount = renderApp(startServices, params, config, kibanaVersion, extensions);
diff --git a/x-pack/plugins/fleet/storybook/context/cloud.ts b/x-pack/plugins/fleet/storybook/context/cloud.ts
new file mode 100644
index 00000000000000..bed72c8ac4db7c
--- /dev/null
+++ b/x-pack/plugins/fleet/storybook/context/cloud.ts
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { CloudSetup } from '../../../cloud/public';
+
+export const getCloud = ({ isCloudEnabled }: { isCloudEnabled: boolean }) => {
+  const cloud: CloudSetup = {
+    isCloudEnabled,
+    baseUrl: 'https://base.url',
+    cloudId: 'cloud-id',
+    cname: 'found.io',
+    deploymentUrl: 'https://deployment.url',
+    organizationUrl: 'https://organization.url',
+    profileUrl: 'https://profile.url',
+    snapshotsUrl: 'https://snapshots.url',
+  };
+
+  return cloud;
+};
diff --git a/x-pack/plugins/fleet/storybook/context/doc_links.ts b/x-pack/plugins/fleet/storybook/context/doc_links.ts
index 9b86ea03549f3b..bb6d8086d1cd8a 100644
--- a/x-pack/plugins/fleet/storybook/context/doc_links.ts
+++ b/x-pack/plugins/fleet/storybook/context/doc_links.ts
@@ -15,6 +15,7 @@ export const getDocLinks = () => {
       fleet: {
         learnMoreBlog:
           'https://www.elastic.co/blog/elastic-agent-and-fleet-make-it-easier-to-integrate-your-systems-with-elastic',
+        apiKeysLearnMore: 'https://www.elastic.co/guide/en/kibana/master/api-keys.html',
       },
     },
   } as unknown as DocLinksStart;
diff --git a/x-pack/plugins/fleet/storybook/context/index.tsx b/x-pack/plugins/fleet/storybook/context/index.tsx
index c9c8e0be5d883a..e6c0726e755c24 100644
--- a/x-pack/plugins/fleet/storybook/context/index.tsx
+++ b/x-pack/plugins/fleet/storybook/context/index.tsx
@@ -28,6 +28,8 @@ import { getUiSettings } from './ui_settings';
 import { getNotifications } from './notifications';
 import { stubbedStartServices } from './stubs';
 import { getDocLinks } from './doc_links';
+import { getCloud } from './cloud';
+import { getShare } from './share';
 
 // TODO: clintandrewhall - this is not ideal, or complete.  The root context of Fleet applications
 // requires full start contracts of its dependencies.  As a result, we have to mock all of those contracts
@@ -36,6 +38,7 @@ import { getDocLinks } from './doc_links';
 //
 // Expect this to grow as components that are given Stories need access to mocked services.
 export const StorybookContext: React.FC<{ storyContext?: StoryContext }> = ({
+  storyContext,
   children: storyChildren,
 }) => {
   const basepath = '';
@@ -46,10 +49,12 @@ export const StorybookContext: React.FC<{ storyContext?: StoryContext }> = ({
     ...stubbedStartServices,
     application: getApplication(),
     chrome: getChrome(),
+    cloud: getCloud({ isCloudEnabled: storyContext?.args.isCloudEnabled }),
+    customIntegrations: {
+      ContextProvider: getStorybookContextProvider(),
+    },
     docLinks: getDocLinks(),
     http: getHttp(),
-    notifications: getNotifications(),
-    uiSettings: getUiSettings(),
     i18n: {
       Context: function I18nContext({ children }) {
         return <I18nProvider>{children}</I18nProvider>;
@@ -58,9 +63,9 @@ export const StorybookContext: React.FC<{ storyContext?: StoryContext }> = ({
     injectedMetadata: {
       getInjectedVar: () => null,
     },
-    customIntegrations: {
-      ContextProvider: getStorybookContextProvider(),
-    },
+    notifications: getNotifications(),
+    share: getShare(),
+    uiSettings: getUiSettings(),
   };
 
   setHttpClient(startServices.http);
@@ -81,12 +86,20 @@ export const StorybookContext: React.FC<{ storyContext?: StoryContext }> = ({
   } as unknown as FleetConfigType;
 
   const extensions = {};
-
   const kibanaVersion = '1.2.3';
+  const setHeaderActionMenu = () => {};
 
   return (
     <IntegrationsAppContext
-      {...{ kibanaVersion, basepath, config, history, startServices, extensions }}
+      {...{
+        kibanaVersion,
+        basepath,
+        config,
+        history,
+        startServices,
+        extensions,
+        setHeaderActionMenu,
+      }}
     >
       {storyChildren}
     </IntegrationsAppContext>
diff --git a/x-pack/plugins/fleet/storybook/context/share.ts b/x-pack/plugins/fleet/storybook/context/share.ts
new file mode 100644
index 00000000000000..b6a8dfbcdcb679
--- /dev/null
+++ b/x-pack/plugins/fleet/storybook/context/share.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { SharePluginStart } from 'src/plugins/share/public';
+
+export const getShare = () => {
+  const share: SharePluginStart = {
+    url: {
+      locators: {
+        get: () => ({
+          useUrl: () => 'https://locator.url',
+        }),
+      },
+    },
+  } as unknown as SharePluginStart;
+
+  return share;
+};
diff --git a/x-pack/plugins/fleet/storybook/context/stubs.tsx b/x-pack/plugins/fleet/storybook/context/stubs.tsx
index a7db4bd8f68cd0..f72b176bd8d7be 100644
--- a/x-pack/plugins/fleet/storybook/context/stubs.tsx
+++ b/x-pack/plugins/fleet/storybook/context/stubs.tsx
@@ -14,8 +14,7 @@ type Stubs =
   | 'fatalErrors'
   | 'navigation'
   | 'overlays'
-  | 'savedObjects'
-  | 'cloud';
+  | 'savedObjects';
 
 type StubbedStartServices = Pick<FleetStartServices, Stubs>;
 
@@ -27,5 +26,4 @@ export const stubbedStartServices: StubbedStartServices = {
   navigation: {} as FleetStartServices['navigation'],
   overlays: {} as FleetStartServices['overlays'],
   savedObjects: {} as FleetStartServices['savedObjects'],
-  cloud: {} as FleetStartServices['cloud'],
 };
diff --git a/x-pack/plugins/fleet/storybook/decorator.tsx b/x-pack/plugins/fleet/storybook/decorator.tsx
index 8e682498095748..93870809c94bb0 100644
--- a/x-pack/plugins/fleet/storybook/decorator.tsx
+++ b/x-pack/plugins/fleet/storybook/decorator.tsx
@@ -11,5 +11,5 @@ import type { DecoratorFn } from '@storybook/react';
 import { StorybookContext } from './context';
 
 export const decorator: DecoratorFn = (story, storybook) => {
-  return <StorybookContext>{story()}</StorybookContext>;
+  return <StorybookContext storyContext={storybook}>{story()}</StorybookContext>;
 };

From 5de36a8229e563a1920bef28b37c49a4231b4098 Mon Sep 17 00:00:00 2001
From: Spencer <email@spalger.com>
Date: Wed, 13 Oct 2021 12:50:35 -0500
Subject: [PATCH 15/71] [kbn/optimizer] fix --update-limit docs (#114840)

Co-authored-by: spalger <spalger@users.noreply.github.com>
---
 packages/kbn-optimizer/src/cli.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/kbn-optimizer/src/cli.ts b/packages/kbn-optimizer/src/cli.ts
index 7f0c39ccd0e55e..41ca656259fc6b 100644
--- a/packages/kbn-optimizer/src/cli.ts
+++ b/packages/kbn-optimizer/src/cli.ts
@@ -207,7 +207,7 @@ export function runKbnOptimizerCli(options: { defaultLimitsPath: string }) {
           --no-inspect-workers  when inspecting the parent process, don't inspect the workers
           --limits           path to a limits.yml file to read, defaults to $KBN_OPTIMIZER_LIMITS_PATH or source file
           --validate-limits  validate the limits.yml config to ensure that there are limits defined for every bundle
-          --update-limits    run a build and rewrite the limits file to include the current bundle sizes +5kb
+          --update-limits    run a build and rewrite the limits file to include the current bundle sizes +15kb
         `,
       },
     }

From 6d24de9d6eaf95d115a250e70eacf3ae7d1e76f6 Mon Sep 17 00:00:00 2001
From: Chris Cowan <chris@chriscowan.us>
Date: Wed, 13 Oct 2021 12:00:15 -0600
Subject: [PATCH 16/71] [Stack Monitoring] Fix shard size alerts (#114357)

* [Stack Monitoring] Fix shard size alerts

* Removing the source filter for source_node.*

* Removing superfluous types

* Removing superfluous nodeId and nodeName from test
---
 x-pack/plugins/monitoring/common/types/alerts.ts  |  4 +++-
 .../server/alerts/large_shard_size_rule.test.ts   |  4 ----
 .../server/lib/alerts/fetch_index_shard_size.ts   | 15 +++------------
 3 files changed, 6 insertions(+), 17 deletions(-)

diff --git a/x-pack/plugins/monitoring/common/types/alerts.ts b/x-pack/plugins/monitoring/common/types/alerts.ts
index bbd217169469da..9abca4cbdc948e 100644
--- a/x-pack/plugins/monitoring/common/types/alerts.ts
+++ b/x-pack/plugins/monitoring/common/types/alerts.ts
@@ -208,9 +208,11 @@ export interface CCRReadExceptionsUIMeta extends CCRReadExceptionsStats {
   itemLabel: string;
 }
 
-export interface IndexShardSizeStats extends AlertNodeStats {
+export interface IndexShardSizeStats {
   shardIndex: string;
   shardSize: number;
+  clusterUuid: string;
+  ccs?: string;
 }
 
 export interface IndexShardSizeUIMeta extends IndexShardSizeStats {
diff --git a/x-pack/plugins/monitoring/server/alerts/large_shard_size_rule.test.ts b/x-pack/plugins/monitoring/server/alerts/large_shard_size_rule.test.ts
index 0b8509c4fa56a1..f7d6081edd306c 100644
--- a/x-pack/plugins/monitoring/server/alerts/large_shard_size_rule.test.ts
+++ b/x-pack/plugins/monitoring/server/alerts/large_shard_size_rule.test.ts
@@ -85,14 +85,10 @@ describe('LargeShardSizeRule', () => {
     const shardSize = 0;
     const clusterUuid = 'abc123';
     const clusterName = 'testCluster';
-    const nodeId = 'myNodeId';
-    const nodeName = 'myNodeName';
     const stat = {
       shardIndex,
       shardSize,
       clusterUuid,
-      nodeId,
-      nodeName,
     };
 
     const replaceState = jest.fn();
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/fetch_index_shard_size.ts b/x-pack/plugins/monitoring/server/lib/alerts/fetch_index_shard_size.ts
index 98bb546b43ab9d..9259adc63e5463 100644
--- a/x-pack/plugins/monitoring/server/lib/alerts/fetch_index_shard_size.ts
+++ b/x-pack/plugins/monitoring/server/lib/alerts/fetch_index_shard_size.ts
@@ -11,12 +11,8 @@ import { ElasticsearchIndexStats, ElasticsearchResponseHit } from '../../../comm
 import { ESGlobPatterns, RegExPatterns } from '../../../common/es_glob_patterns';
 import { Globals } from '../../static_globals';
 
-interface SourceNode {
-  name: string;
-  uuid: string;
-}
 type TopHitType = ElasticsearchResponseHit & {
-  _source: { index_stats?: Partial<ElasticsearchIndexStats>; source_node?: SourceNode };
+  _source: { index_stats?: Partial<ElasticsearchIndexStats> };
 };
 
 const memoizedIndexPatterns = (globPatterns: string) => {
@@ -90,8 +86,6 @@ export async function fetchIndexShardSize(
                         '_index',
                         'index_stats.shards.primaries',
                         'index_stats.primaries.store.size_in_bytes',
-                        'source_node.name',
-                        'source_node.uuid',
                       ],
                     },
                     size: 1,
@@ -135,10 +129,10 @@ export async function fetchIndexShardSize(
       }
       const {
         _index: monitoringIndexName,
-        _source: { source_node: sourceNode, index_stats: indexStats },
+        _source: { index_stats: indexStats },
       } = topHit;
 
-      if (!indexStats || !indexStats.primaries || !sourceNode) {
+      if (!indexStats || !indexStats.primaries) {
         continue;
       }
 
@@ -151,7 +145,6 @@ export async function fetchIndexShardSize(
        * We can only calculate the average primary shard size at this point, since we don't have
        * data (in .monitoring-es* indices) to give us individual shards. This might change in the future
        */
-      const { name: nodeName, uuid: nodeId } = sourceNode;
       const avgShardSize = primaryShardSizeBytes / totalPrimaryShards;
       if (avgShardSize < thresholdBytes) {
         continue;
@@ -161,8 +154,6 @@ export async function fetchIndexShardSize(
         shardIndex,
         shardSize,
         clusterUuid,
-        nodeName,
-        nodeId,
         ccs: monitoringIndexName.includes(':') ? monitoringIndexName.split(':')[0] : undefined,
       });
     }

From feed7391a0cd0909e1eefb1953c4a8fc81328118 Mon Sep 17 00:00:00 2001
From: Stacey Gammon <gammon@elastic.co>
Date: Wed, 13 Oct 2021 14:01:46 -0400
Subject: [PATCH 17/71] Update kibana_platform_plugin_intro with more details
 on packages vs plugins (#114713)

* Update kibana_platform_plugin_intro.mdx

* updates

* Update kibana_platform_plugin_intro.mdx

* Update kibana_platform_plugin_intro.mdx

* Update kibana_platform_plugin_intro.mdx

* Update dev_docs/key_concepts/kibana_platform_plugin_intro.mdx

Co-authored-by: Tyler Smalley <tylersmalley@gmail.com>

* Update dev_docs/key_concepts/kibana_platform_plugin_intro.mdx

Co-authored-by: Tyler Smalley <tylersmalley@gmail.com>

* Update dev_docs/key_concepts/kibana_platform_plugin_intro.mdx

Co-authored-by: Tyler Smalley <tylersmalley@gmail.com>

* Update dev_docs/key_concepts/kibana_platform_plugin_intro.mdx

Co-authored-by: Brandon Kobel <brandon.kobel@gmail.com>

* Update dev_docs/key_concepts/kibana_platform_plugin_intro.mdx

Co-authored-by: Brandon Kobel <brandon.kobel@gmail.com>

Co-authored-by: Tyler Smalley <tylersmalley@gmail.com>
Co-authored-by: Brandon Kobel <brandon.kobel@gmail.com>
---
 .../kibana_platform_plugin_intro.mdx          | 23 +++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/dev_docs/key_concepts/kibana_platform_plugin_intro.mdx b/dev_docs/key_concepts/kibana_platform_plugin_intro.mdx
index 133b96f44da88e..737b9d8708f296 100644
--- a/dev_docs/key_concepts/kibana_platform_plugin_intro.mdx
+++ b/dev_docs/key_concepts/kibana_platform_plugin_intro.mdx
@@ -33,13 +33,28 @@ At a super high-level, Kibana is composed of **plugins**, **core**, and **Kibana
 
 <DocAccordion buttonContent="(Internal only) FAQ: Should I put my code in a plugin or a package?" color="warning">
 <DocCallOut color="warning">
-If it's stateful, it has to go in a plugin, but packages are often a good choices for stateless utilities. Stateless code exported publicly from a plugin will increase the page load bundle size of _every single page_, even if none of those plugin's services are actually needed. With packages, however, only code that is needed for the current page is downloaded.
+When the [Bazel migration](https://github.com/elastic/kibana/blob/master/legacy_rfcs/text/0015_bazel.md) is complete, all code, including plugins, will be a package. With that, packages won't be required to be in the `packages/` directory and can be located somewhere that makes more sense structurally.
 
-The downside however is that the packages folder is far away from the plugins folder so having a part of your code in a plugin and the rest in a package may make it hard to find, leading to duplication.
+In the meantime, the following can be used to determine whether it makes sense to add code to a package inside the `packages` folder, or a plugin inside `src/plugins` or `x-pack/plugins`. 
 
-The Operations team hopes to resolve this conundrum by supporting co-located packages and plugins and automatically putting all stateless code inside a package. You can track this work by following [this issue](https://github.com/elastic/kibana/issues/112886).
 
-Until then, consider whether it makes sense to logically separate the code, and consider the size of the exports, when determining whether you should put stateless public exports in a package or a plugin.
+**If the code is stateful, it has to be exposed from a plugin's <DocLink id="kibPlatformIntro" section="lifecycle-methods" text="lifecycle methods"/>. Do not statically export stateful code.**
+
+Benefits to packages:
+
+1. <b>_Potentially_ reduced page load time</b>. All code that is statically exported from plugins will be downloaded on _every single page load_, even if that code isn't needed. With packages, only code that is imported is downloaded, which can be minimized by using async imports.
+2. <b>Puts the consumer is in charge of how and when to async import</b>. If a consumer async imports code exported from a plugin, it makes no difference, because of the above point. It's already been downloaded. However, simply moving code into a package is _not_ a guaranteed performance improvement. It does give the consumer the power to make smart performance choices, however. If they require code from multiple packages, the consumer can async import from multiple packages at the same time. Read more in our <DocLink id="kibDevPerformance" text="performance docs"/>.
+
+Downsides to packages:
+
+1. <b>It's not <DocLink id="kibDevPrinciples" text="organized by domain"/></b>. The packages folder is far away from the plugins folder. Having your stateless code in a plugin and the rest in a package may make it hard to find, leading to duplication. The Operations team hopes to fix this by supporting packages and plugins existing in the same folder. You can track this work by following [this issue](https://github.com/elastic/kibana/issues/112886).
+
+2. <b>Development overhead</b>. Developers have to run `yarn kbn watch` to have changes rebuilt automatically. [Phase II](https://github.com/elastic/kibana/blob/master/legacy_rfcs/text/0015_bazel.md#phase-ii---docs-developer-experience) of the Bazel migration work will bring the development experience on par with plugin development. This work can be tracked [here](https://github.com/elastic/kibana/issues/104519). 
+
+3. <b>Development performance</b>. Rebuild time is typically longer than it would be for the same code in a plugin. The reasons are captured in [this issue](https://github.com/elastic/kibana/issues/107648). The ops team is actively working to reduce this performance increase.
+
+
+As you can see, the answer to "Should I put my code in a plugin or a package" is 'It Depends'. If you are still having a hard time determining what the best path location is, reach out to the Kibana Operations Team (#kibana-operations) for help.
 
 </DocCallOut>
 </DocAccordion>

From dab5a59fc294061dd1a8a35811573d09285741cb Mon Sep 17 00:00:00 2001
From: spalger <spalger@users.noreply.github.com>
Date: Wed, 13 Oct 2021 18:25:23 +0000
Subject: [PATCH 18/71] skip suite failing es promotion (#114885)

---
 x-pack/test/security_solution_endpoint_api_int/apis/package.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/x-pack/test/security_solution_endpoint_api_int/apis/package.ts b/x-pack/test/security_solution_endpoint_api_int/apis/package.ts
index a8fd5a612b3068..fdacc07426871b 100644
--- a/x-pack/test/security_solution_endpoint_api_int/apis/package.ts
+++ b/x-pack/test/security_solution_endpoint_api_int/apis/package.ts
@@ -66,7 +66,8 @@ export default function ({ getService }: FtrProviderContext) {
     });
   };
 
-  describe('Endpoint package', () => {
+  // FAILING ES PROMOTION: https://github.com/elastic/kibana/issues/114885
+  describe.skip('Endpoint package', () => {
     describe('network processors', () => {
       let networkIndexData: InsertedEvents;
 

From 21f45283be5712b494ed60f0630b2828c2807e9a Mon Sep 17 00:00:00 2001
From: Kaarina Tungseth <kaarina.tungseth@elastic.co>
Date: Wed, 13 Oct 2021 13:29:50 -0500
Subject: [PATCH 19/71] [DOCS] Documents
 monitoring.cluster_alerts.allowedSpaces (#114669)

* [DOCS] Documents monitoring.cluster_alerts.allowedSpaces

* Update docs/settings/spaces-settings.asciidoc

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>
---
 docs/settings/spaces-settings.asciidoc | 29 ++++++++++++++------------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/docs/settings/spaces-settings.asciidoc b/docs/settings/spaces-settings.asciidoc
index 30b7beceb70ba7..969adb93185d06 100644
--- a/docs/settings/spaces-settings.asciidoc
+++ b/docs/settings/spaces-settings.asciidoc
@@ -5,20 +5,23 @@
 <titleabbrev>Spaces settings</titleabbrev>
 ++++
 
-By default, Spaces is enabled in Kibana, and you can secure Spaces using
-roles when Security is enabled.
-
-[float]
-[[spaces-settings]]
-==== Spaces settings
+By default, spaces is enabled in {kib}. To secure spaces, <<security-settings-kb,enable security>>.
 
 `xpack.spaces.enabled`::
-deprecated:[7.16.0,"In 8.0 and later, this setting will no longer be supported."]
-Set to `true` (default) to enable Spaces in {kib}.
-This setting is deprecated. Starting in 8.0, it will not be possible to disable this plugin.
+deprecated:[7.16.0,"In 8.0 and later, this setting will no longer be supported and it will not be possible to disable this plugin."]
+To enable spaces, set to `true`. 
+The default is `true`.
 
 `xpack.spaces.maxSpaces`::
-The maximum amount of Spaces that can be used with this instance of {kib}. Some operations
-in {kib} return all spaces using a single `_search` from {es}, so this must be
-set lower than the `index.max_result_window` in {es}.
-Defaults to `1000`.
+The maximum number of spaces that you can use with the {kib} instance. Some {kib} operations
+return all spaces using a single `_search` from {es}, so you must
+configure this setting lower than the `index.max_result_window` in {es}.
+The default is `1000`.
+
+`monitoring.cluster_alerts-allowedSpaces` {ess-icon}:: 
+Specifies the spaces where cluster alerts are automatically generated. 
+You must specify all spaces where you want to generate alerts, including the default space. 
+When the default space is unspecified, {kib} is unable to generate an alert for the default space.
+{es} clusters that run on {es} services are all containers. To send monitoring data 
+from your self-managed {es} installation to {es} services, set to `false`. 
+The default is `true`.

From 95cd74d7fa744afec65e9fe72ceaf7abda30e262 Mon Sep 17 00:00:00 2001
From: James Gowdy <jgowdy@elastic.co>
Date: Wed, 13 Oct 2021 19:35:51 +0100
Subject: [PATCH 20/71] [ML] Using data views service for loading data views
 (#113961)

* [ML] Using data views service for loading data views

* removing more saved object client uses

* removing IIndexPattern use

* removing IndexPattern use

* removing more depricated types

* fixing teste

* fixing index pattern loading

* tiny refactor

* fixing rollup index test

* changes based on review

* adding size to find calls

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 x-pack/plugins/ml/common/types/kibana.ts      |   2 -
 x-pack/plugins/ml/kibana.json                 |   1 +
 x-pack/plugins/ml/public/application/app.tsx  |   1 +
 .../components/data_grid/common.ts            |  17 +-
 .../data_recognizer/data_recognizer.d.ts      |   4 +-
 .../full_time_range_selector.test.tsx         |  10 +-
 .../full_time_range_selector.tsx              |   7 +-
 .../full_time_range_selector_service.ts       |   6 +-
 .../scatterplot_matrix/scatterplot_matrix.tsx |   4 +-
 .../use_scatterplot_field_options.ts          |   4 +-
 .../contexts/ml/__mocks__/index_pattern.ts    |   4 +-
 .../contexts/ml/__mocks__/index_patterns.ts   |   4 +-
 .../application/contexts/ml/ml_context.ts     |   6 +-
 .../common/use_results_view_config.ts         |   6 +-
 .../hooks/use_index_data.ts                   |   7 +-
 .../expandable_section_results.tsx            |   4 +-
 .../exploration_query_bar.tsx                 |   4 +-
 .../exploration_results_table.tsx             |   4 +-
 .../use_exploration_results.ts                |   4 +-
 .../outlier_exploration/use_outlier_data.ts   |   4 +-
 .../action_clone/clone_action_name.tsx        |  21 +--
 .../action_delete/delete_action_name.test.tsx |   2 +-
 .../action_delete/use_delete_action.tsx       |  21 +--
 .../source_selection.test.tsx                 |   1 +
 .../index_based/data_loader/data_loader.ts    |   9 +-
 .../explorer_query_bar/explorer_query_bar.tsx |   6 +-
 .../custom_url_editor/editor.test.tsx         |   4 +-
 .../components/custom_url_editor/editor.tsx   |   4 +-
 .../components/custom_url_editor/utils.d.ts   |   4 +-
 .../edit_job_flyout/edit_utils.d.ts           |   4 +-
 .../components/edit_job_flyout/edit_utils.js  |  28 +--
 .../edit_job_flyout/tabs/custom_urls.tsx      |   4 +-
 .../common/chart_loader/chart_loader.ts       |   4 +-
 .../new_job/common/index_pattern_context.ts   |   4 +-
 .../job_creator/advanced_job_creator.ts       |   8 +-
 .../job_creator/categorization_job_creator.ts |   8 +-
 .../new_job/common/job_creator/job_creator.ts |  10 +-
 .../common/job_creator/job_creator_factory.ts |   4 +-
 .../job_creator/multi_metric_job_creator.ts   |   8 +-
 .../job_creator/population_job_creator.ts     |   8 +-
 .../common/job_creator/rare_job_creator.ts    |   8 +-
 .../job_creator/single_metric_job_creator.ts  |   8 +-
 .../categorization_examples_loader.ts         |   4 +-
 .../preconfigured_job_redirect.ts             |   6 +-
 .../jobs/new_job/utils/new_job_utils.test.ts  |   4 +-
 .../public/application/routing/resolvers.ts   |   4 +-
 .../ml/public/application/routing/router.tsx  |  12 +-
 .../services/field_format_service.ts          |   8 +-
 .../load_new_job_capabilities.ts              |   6 +-
 .../new_job_capabilities._service.test.ts     |   4 +-
 .../new_job_capabilities_service.ts           |   5 +-
 .../new_job_capabilities_service_analytics.ts |   5 +-
 .../remove_nested_field_children.test.ts      |   4 +-
 .../application/util/dependency_cache.ts      |  15 +-
 .../util/field_types_utils.test.ts            |  19 +-
 .../application/util/field_types_utils.ts     |   5 +-
 .../ml/public/application/util/index_utils.ts |  50 ++----
 .../anomaly_charts_embeddable.tsx             |   4 +-
 x-pack/plugins/ml/public/embeddables/types.ts |   4 +-
 .../plugins/ml/server/lib/data_views_utils.ts |  26 +++
 x-pack/plugins/ml/server/lib/route_guard.ts   |  23 ++-
 .../data_frame_analytics/index_patterns.ts    |  22 +--
 .../data_recognizer/data_recognizer.test.ts   |  12 +-
 .../models/data_recognizer/data_recognizer.ts |  62 ++++---
 .../ml/server/models/data_recognizer/index.ts |   2 +-
 .../data_view_rollup_cloudwatch.json          | 151 ++++++++++++++++
 .../responses/kibana_saved_objects.json       |  35 ----
 .../job_service/new_job_caps/field_service.ts |  20 +--
 .../new_job_caps/new_job_caps.test.ts         |  16 +-
 .../job_service/new_job_caps/new_job_caps.ts  |   9 +-
 .../models/job_service/new_job_caps/rollup.ts |  44 ++---
 x-pack/plugins/ml/server/plugin.ts            |  22 ++-
 .../ml/server/routes/data_frame_analytics.ts  | 170 +++++++++---------
 .../plugins/ml/server/routes/job_service.ts   |  35 ++--
 x-pack/plugins/ml/server/routes/modules.ts    |  80 +++++++--
 .../shared_services/providers/modules.ts      |  42 ++---
 .../server/shared_services/shared_services.ts |  36 +++-
 x-pack/plugins/ml/server/types.ts             |   2 +
 x-pack/plugins/ml/tsconfig.json               |   1 +
 79 files changed, 721 insertions(+), 529 deletions(-)
 create mode 100644 x-pack/plugins/ml/server/lib/data_views_utils.ts
 create mode 100644 x-pack/plugins/ml/server/models/job_service/new_job_caps/__mocks__/responses/data_view_rollup_cloudwatch.json
 delete mode 100644 x-pack/plugins/ml/server/models/job_service/new_job_caps/__mocks__/responses/kibana_saved_objects.json

diff --git a/x-pack/plugins/ml/common/types/kibana.ts b/x-pack/plugins/ml/common/types/kibana.ts
index 7783a02c2dd379..cc7b68b40149f8 100644
--- a/x-pack/plugins/ml/common/types/kibana.ts
+++ b/x-pack/plugins/ml/common/types/kibana.ts
@@ -8,7 +8,6 @@
 // custom edits or fixes for default kibana types which are incomplete
 
 import type { SimpleSavedObject } from 'kibana/public';
-import type { IndexPatternAttributes } from 'src/plugins/data/common';
 import type { FieldFormatsRegistry } from '../../../../../src/plugins/field_formats/common';
 
 export type IndexPatternTitle = string;
@@ -18,7 +17,6 @@ export interface Route {
   k7Breadcrumbs: () => any;
 }
 
-export type IndexPatternSavedObject = SimpleSavedObject<IndexPatternAttributes>;
 // TODO define saved object type
 export type SavedSearchSavedObject = SimpleSavedObject<any>;
 
diff --git a/x-pack/plugins/ml/kibana.json b/x-pack/plugins/ml/kibana.json
index 310ac5d65c9866..9ed05bbdc2edf3 100644
--- a/x-pack/plugins/ml/kibana.json
+++ b/x-pack/plugins/ml/kibana.json
@@ -8,6 +8,7 @@
   ],
   "requiredPlugins": [
     "data",
+    "dataViews",
     "cloud",
     "features",
     "dataVisualizer",
diff --git a/x-pack/plugins/ml/public/application/app.tsx b/x-pack/plugins/ml/public/application/app.tsx
index c7e457c0b5e001..6259cecae78b59 100644
--- a/x-pack/plugins/ml/public/application/app.tsx
+++ b/x-pack/plugins/ml/public/application/app.tsx
@@ -135,6 +135,7 @@ export const renderApp = (
     urlGenerators: deps.share.urlGenerators,
     maps: deps.maps,
     dataVisualizer: deps.dataVisualizer,
+    dataViews: deps.data.dataViews,
   });
 
   appMountParams.onAppLeave((actions) => actions.default());
diff --git a/x-pack/plugins/ml/public/application/components/data_grid/common.ts b/x-pack/plugins/ml/public/application/components/data_grid/common.ts
index a64594e86a7574..6fc6f298e73d8d 100644
--- a/x-pack/plugins/ml/public/application/components/data_grid/common.ts
+++ b/x-pack/plugins/ml/public/application/components/data_grid/common.ts
@@ -19,12 +19,9 @@ import { i18n } from '@kbn/i18n';
 
 import { CoreSetup } from 'src/core/public';
 
-import {
-  IndexPattern,
-  IFieldType,
-  ES_FIELD_TYPES,
-  KBN_FIELD_TYPES,
-} from '../../../../../../../src/plugins/data/public';
+import { ES_FIELD_TYPES, KBN_FIELD_TYPES } from '../../../../../../../src/plugins/data/public';
+
+import type { DataView, DataViewField } from '../../../../../../../src/plugins/data_views/common';
 
 import { DEFAULT_RESULTS_FIELD } from '../../../../common/constants/data_frame_analytics';
 import { extractErrorMessage } from '../../../../common/util/errors';
@@ -72,7 +69,7 @@ export const euiDataGridToolbarSettings = {
   showFullScreenSelector: false,
 };
 
-export const getFieldsFromKibanaIndexPattern = (indexPattern: IndexPattern): string[] => {
+export const getFieldsFromKibanaIndexPattern = (indexPattern: DataView): string[] => {
   const allFields = indexPattern.fields.map((f) => f.name);
   const indexPatternFields: string[] = allFields.filter((f) => {
     if (indexPattern.metaFields.includes(f)) {
@@ -98,7 +95,7 @@ export const getFieldsFromKibanaIndexPattern = (indexPattern: IndexPattern): str
  * @param RuntimeMappings
  */
 export function getCombinedRuntimeMappings(
-  indexPattern: IndexPattern | undefined,
+  indexPattern: DataView | undefined,
   runtimeMappings?: RuntimeMappings
 ): RuntimeMappings | undefined {
   let combinedRuntimeMappings = {};
@@ -219,7 +216,7 @@ export const getDataGridSchemaFromESFieldType = (
 };
 
 export const getDataGridSchemaFromKibanaFieldType = (
-  field: IFieldType | undefined
+  field: DataViewField | undefined
 ): string | undefined => {
   // Built-in values are ['boolean', 'currency', 'datetime', 'numeric', 'json']
   // To fall back to the default string schema it needs to be undefined.
@@ -312,7 +309,7 @@ export const getTopClasses = (row: Record<string, any>, mlResultsField: string):
 };
 
 export const useRenderCellValue = (
-  indexPattern: IndexPattern | undefined,
+  indexPattern: DataView | undefined,
   pagination: IndexPagination,
   tableItems: DataGridItem[],
   resultsField?: string,
diff --git a/x-pack/plugins/ml/public/application/components/data_recognizer/data_recognizer.d.ts b/x-pack/plugins/ml/public/application/components/data_recognizer/data_recognizer.d.ts
index ff6363ea2cc6ed..fb9648f5ef4af2 100644
--- a/x-pack/plugins/ml/public/application/components/data_recognizer/data_recognizer.d.ts
+++ b/x-pack/plugins/ml/public/application/components/data_recognizer/data_recognizer.d.ts
@@ -7,10 +7,10 @@
 
 import { FC } from 'react';
 import { SavedSearchSavedObject } from '../../../../common/types/kibana';
-import type { IIndexPattern } from '../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../src/plugins/data_views/public';
 
 declare const DataRecognizer: FC<{
-  indexPattern: IIndexPattern;
+  indexPattern: DataView;
   savedSearch: SavedSearchSavedObject | null;
   results: {
     count: number;
diff --git a/x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.test.tsx b/x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.test.tsx
index f9f8d9a370bab6..72641499fe6afb 100644
--- a/x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.test.tsx
+++ b/x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.test.tsx
@@ -8,15 +8,15 @@
 import React from 'react';
 import { shallowWithIntl } from '@kbn/test/jest';
 import { FullTimeRangeSelector } from './index';
-import { Query } from 'src/plugins/data/public';
-import { IndexPattern } from '../../../../../../../src/plugins/data/public';
+import type { Query } from 'src/plugins/data/public';
+import type { DataView } from '../../../../../../../src/plugins/data_views/public';
 
 // Create a mock for the setFullTimeRange function in the service.
 // The mock is hoisted to the top, so need to prefix the mock function
 // with 'mock' so it can be used lazily.
-const mockSetFullTimeRange = jest.fn((indexPattern: IndexPattern, query: Query) => true);
+const mockSetFullTimeRange = jest.fn((indexPattern: DataView, query: Query) => true);
 jest.mock('./full_time_range_selector_service', () => ({
-  setFullTimeRange: (indexPattern: IndexPattern, query: Query) =>
+  setFullTimeRange: (indexPattern: DataView, query: Query) =>
     mockSetFullTimeRange(indexPattern, query),
 }));
 
@@ -26,7 +26,7 @@ describe('FullTimeRangeSelector', () => {
     fields: [],
     title: 'test-index-pattern',
     timeFieldName: '@timestamp',
-  } as unknown as IndexPattern;
+  } as unknown as DataView;
 
   const query: Query = {
     language: 'kuery',
diff --git a/x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.tsx b/x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.tsx
index f087754bd275b0..3c9689c8c108bb 100644
--- a/x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.tsx
+++ b/x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.tsx
@@ -8,12 +8,13 @@
 import React, { FC } from 'react';
 
 import { FormattedMessage } from '@kbn/i18n/react';
-import { Query, IndexPattern } from 'src/plugins/data/public';
+import type { Query } from 'src/plugins/data/public';
 import { EuiButton } from '@elastic/eui';
+import type { DataView } from '../../../../../../../src/plugins/data_views/public';
 import { setFullTimeRange } from './full_time_range_selector_service';
 
 interface Props {
-  indexPattern: IndexPattern;
+  indexPattern: DataView;
   query: Query;
   disabled: boolean;
   callback?: (a: any) => void;
@@ -23,7 +24,7 @@ interface Props {
 // to the time range of data in the index(es) mapped to the supplied Kibana index pattern or query.
 export const FullTimeRangeSelector: FC<Props> = ({ indexPattern, query, disabled, callback }) => {
   // wrapper around setFullTimeRange to allow for the calling of the optional callBack prop
-  async function setRange(i: IndexPattern, q: Query) {
+  async function setRange(i: DataView, q: Query) {
     const fullTimeRange = await setFullTimeRange(i, q);
     if (typeof callback === 'function') {
       callback(fullTimeRange);
diff --git a/x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector_service.ts b/x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector_service.ts
index 1e9c1e2c1b74da..8f0d344a36f36e 100644
--- a/x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector_service.ts
+++ b/x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector_service.ts
@@ -8,11 +8,11 @@
 import moment from 'moment';
 
 import { i18n } from '@kbn/i18n';
-import { Query } from 'src/plugins/data/public';
+import type { Query } from 'src/plugins/data/public';
 import dateMath from '@elastic/datemath';
 import { getTimefilter, getToastNotifications } from '../../util/dependency_cache';
 import { ml, GetTimeFieldRangeResponse } from '../../services/ml_api_service';
-import { IndexPattern } from '../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../src/plugins/data_views/public';
 import { isPopulatedObject } from '../../../../common/util/object_utils';
 import { RuntimeMappings } from '../../../../common/types/fields';
 
@@ -22,7 +22,7 @@ export interface TimeRange {
 }
 
 export async function setFullTimeRange(
-  indexPattern: IndexPattern,
+  indexPattern: DataView,
   query: Query
 ): Promise<GetTimeFieldRangeResponse> {
   try {
diff --git a/x-pack/plugins/ml/public/application/components/scatterplot_matrix/scatterplot_matrix.tsx b/x-pack/plugins/ml/public/application/components/scatterplot_matrix/scatterplot_matrix.tsx
index b83965b52befc3..d64a180bfa8b6e 100644
--- a/x-pack/plugins/ml/public/application/components/scatterplot_matrix/scatterplot_matrix.tsx
+++ b/x-pack/plugins/ml/public/application/components/scatterplot_matrix/scatterplot_matrix.tsx
@@ -24,7 +24,7 @@ import {
 
 import { i18n } from '@kbn/i18n';
 
-import { IndexPattern } from '../../../../../../../src/plugins/data/public';
+import { DataView } from '../../../../../../../src/plugins/data_views/public';
 import { extractErrorMessage } from '../../../../common';
 import { isRuntimeMappings } from '../../../../common/util/runtime_field_utils';
 import { stringHash } from '../../../../common/util/string_utils';
@@ -89,7 +89,7 @@ export interface ScatterplotMatrixProps {
   legendType?: LegendType;
   searchQuery?: ResultsSearchQuery;
   runtimeMappings?: RuntimeMappings;
-  indexPattern?: IndexPattern;
+  indexPattern?: DataView;
 }
 
 export const ScatterplotMatrix: FC<ScatterplotMatrixProps> = ({
diff --git a/x-pack/plugins/ml/public/application/components/scatterplot_matrix/use_scatterplot_field_options.ts b/x-pack/plugins/ml/public/application/components/scatterplot_matrix/use_scatterplot_field_options.ts
index d8b5b23f688474..543ab0a0c0982f 100644
--- a/x-pack/plugins/ml/public/application/components/scatterplot_matrix/use_scatterplot_field_options.ts
+++ b/x-pack/plugins/ml/public/application/components/scatterplot_matrix/use_scatterplot_field_options.ts
@@ -7,12 +7,12 @@
 
 import { useMemo } from 'react';
 
-import type { IndexPattern } from '../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../src/plugins/data_views/public';
 
 import { ML__INCREMENTAL_ID } from '../../data_frame_analytics/common/fields';
 
 export const useScatterplotFieldOptions = (
-  indexPattern?: IndexPattern,
+  indexPattern?: DataView,
   includes?: string[],
   excludes?: string[],
   resultsField = ''
diff --git a/x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_pattern.ts b/x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_pattern.ts
index 9d53efad86d381..93f92002c4bfdc 100644
--- a/x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_pattern.ts
+++ b/x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_pattern.ts
@@ -5,10 +5,10 @@
  * 2.0.
  */
 
-import { IndexPattern } from '../../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../../src/plugins/data_views/public';
 
 export const indexPatternMock = {
   id: 'the-index-pattern-id',
   title: 'the-index-pattern-title',
   fields: [],
-} as unknown as IndexPattern;
+} as unknown as DataView;
diff --git a/x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_patterns.ts b/x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_patterns.ts
index 7dfbcf1675692c..571ce8ac3f4232 100644
--- a/x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_patterns.ts
+++ b/x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_patterns.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { IndexPatternsContract } from '../../../../../../../../src/plugins/data/public';
+import type { DataViewsContract } from '../../../../../../../../src/plugins/data_views/public';
 
 export const indexPatternsMock = new (class {
   fieldFormats = [];
@@ -19,4 +19,4 @@ export const indexPatternsMock = new (class {
   getIds = jest.fn();
   getTitles = jest.fn();
   make = jest.fn();
-})() as unknown as IndexPatternsContract;
+})() as unknown as DataViewsContract;
diff --git a/x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts b/x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts
index 02c0945cf998f4..cd7059b5302f23 100644
--- a/x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts
+++ b/x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts
@@ -6,15 +6,15 @@
  */
 
 import React from 'react';
-import { IndexPattern, IndexPatternsContract } from '../../../../../../../src/plugins/data/public';
+import { DataView, DataViewsContract } from '../../../../../../../src/plugins/data_views/public';
 import { SavedSearchSavedObject } from '../../../../common/types/kibana';
 import { MlServicesContext } from '../../app';
 
 export interface MlContextValue {
   combinedQuery: any;
-  currentIndexPattern: IndexPattern; // TODO this should be IndexPattern or null
+  currentIndexPattern: DataView; // TODO this should be IndexPattern or null
   currentSavedSearch: SavedSearchSavedObject | null;
-  indexPatterns: IndexPatternsContract;
+  indexPatterns: DataViewsContract;
   kibanaConfig: any; // IUiSettingsClient;
   kibanaVersion: string;
 }
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts
index e1f0db4e9291c0..a235885a9a5b7e 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts
@@ -9,7 +9,7 @@ import { useEffect, useState } from 'react';
 
 import { i18n } from '@kbn/i18n';
 
-import { IndexPattern } from '../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../src/plugins/data_views/public';
 
 import { extractErrorMessage } from '../../../../common/util/errors';
 
@@ -34,7 +34,7 @@ export const useResultsViewConfig = (jobId: string) => {
   const mlContext = useMlContext();
   const trainedModelsApiService = useTrainedModelsApiService();
 
-  const [indexPattern, setIndexPattern] = useState<IndexPattern | undefined>(undefined);
+  const [indexPattern, setIndexPattern] = useState<DataView | undefined>(undefined);
   const [indexPatternErrorMessage, setIndexPatternErrorMessage] = useState<undefined | string>(
     undefined
   );
@@ -99,7 +99,7 @@ export const useResultsViewConfig = (jobId: string) => {
               ? jobConfigUpdate.dest.index[0]
               : jobConfigUpdate.dest.index;
             const destIndexPatternId = getIndexPatternIdFromName(destIndex) || destIndex;
-            let indexP: IndexPattern | undefined;
+            let indexP: DataView | undefined;
 
             try {
               indexP = await mlContext.indexPatterns.get(destIndexPatternId);
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts
index 60a5a548c8621b..f3779e1968985d 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts
@@ -11,7 +11,7 @@ import { estypes } from '@elastic/elasticsearch';
 import { EuiDataGridColumn } from '@elastic/eui';
 import { CoreSetup } from 'src/core/public';
 
-import { IndexPattern } from '../../../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../../../src/plugins/data_views/public';
 import { isRuntimeMappings } from '../../../../../../common/util/runtime_field_utils';
 import { RuntimeMappings } from '../../../../../../common/types/fields';
 import { DEFAULT_SAMPLER_SHARD_SIZE } from '../../../../../../common/constants/field_histograms';
@@ -52,13 +52,14 @@ function getRuntimeFieldColumns(runtimeMappings: RuntimeMappings) {
   });
 }
 
-function getIndexPatternColumns(indexPattern: IndexPattern, fieldsFilter: string[]) {
+function getIndexPatternColumns(indexPattern: DataView, fieldsFilter: string[]) {
   const { fields } = newJobCapsServiceAnalytics;
 
   return fields
     .filter((field) => fieldsFilter.includes(field.name))
     .map((field) => {
       const schema =
+        // @ts-expect-error field is not DataViewField
         getDataGridSchemaFromESFieldType(field.type) || getDataGridSchemaFromKibanaFieldType(field);
 
       return {
@@ -71,7 +72,7 @@ function getIndexPatternColumns(indexPattern: IndexPattern, fieldsFilter: string
 }
 
 export const useIndexData = (
-  indexPattern: IndexPattern,
+  indexPattern: DataView,
   query: Record<string, any> | undefined,
   toastNotifications: CoreSetup['notifications']['toasts'],
   runtimeMappings?: RuntimeMappings
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/expandable_section/expandable_section_results.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/expandable_section/expandable_section_results.tsx
index d67473d9d3220b..2c2df0cd3d9052 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/expandable_section/expandable_section_results.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/expandable_section/expandable_section_results.tsx
@@ -12,7 +12,7 @@ import { FormattedMessage } from '@kbn/i18n/react';
 
 import { EuiDataGridColumn, EuiSpacer, EuiText } from '@elastic/eui';
 
-import { IndexPattern } from '../../../../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../../../../src/plugins/data_views/public';
 
 import {
   isClassificationAnalysis,
@@ -104,7 +104,7 @@ const getResultsSectionHeaderItems = (
 interface ExpandableSectionResultsProps {
   colorRange?: ReturnType<typeof useColorRange>;
   indexData: UseIndexDataReturnType;
-  indexPattern?: IndexPattern;
+  indexPattern?: DataView;
   jobConfig?: DataFrameAnalyticsConfig;
   needsDestIndexPattern: boolean;
   searchQuery: SavedSearchQuery;
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_query_bar/exploration_query_bar.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_query_bar/exploration_query_bar.tsx
index 1a5f1bad997e2c..3639836c6be01e 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_query_bar/exploration_query_bar.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_query_bar/exploration_query_bar.tsx
@@ -13,7 +13,7 @@ import { debounce } from 'lodash';
 import { fromKueryExpression, luceneStringToDsl, toElasticsearchQuery } from '@kbn/es-query';
 import { estypes } from '@elastic/elasticsearch';
 import { Dictionary } from '../../../../../../../common/types/common';
-import { IIndexPattern } from '../../../../../../../../../../src/plugins/data/common';
+import { DataView } from '../../../../../../../../../../src/plugins/data_views/common';
 import { Query, QueryStringInput } from '../../../../../../../../../../src/plugins/data/public';
 
 import {
@@ -29,7 +29,7 @@ interface ErrorMessage {
 }
 
 export interface ExplorationQueryBarProps {
-  indexPattern: IIndexPattern;
+  indexPattern: DataView;
   setSearchQuery: (update: {
     queryString: string;
     query?: SavedSearchQuery;
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/exploration_results_table.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/exploration_results_table.tsx
index 416d2f8b29d3b6..41c434c7160cfe 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/exploration_results_table.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/exploration_results_table.tsx
@@ -7,7 +7,7 @@
 
 import React, { FC } from 'react';
 
-import { IndexPattern } from '../../../../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../../../../src/plugins/data_views/public';
 
 import { getToastNotifications } from '../../../../../util/dependency_cache';
 import { useMlKibana } from '../../../../../contexts/kibana';
@@ -22,7 +22,7 @@ import { ExpandableSectionResults } from '../expandable_section';
 import { useExplorationResults } from './use_exploration_results';
 
 interface Props {
-  indexPattern: IndexPattern;
+  indexPattern: DataView;
   jobConfig: DataFrameAnalyticsConfig;
   jobStatus?: DataFrameTaskStateType;
   needsDestIndexPattern: boolean;
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/use_exploration_results.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/use_exploration_results.ts
index 02e3f0abac4be1..6e0d513a35b9a7 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/use_exploration_results.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/use_exploration_results.ts
@@ -13,7 +13,7 @@ import { CoreSetup } from 'src/core/public';
 
 import { i18n } from '@kbn/i18n';
 import { MlApiServices } from '../../../../../services/ml_api_service';
-import { IndexPattern } from '../../../../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../../../../src/plugins/data_views/public';
 
 import { DataLoader } from '../../../../../datavisualizer/index_based/data_loader';
 
@@ -41,7 +41,7 @@ import { FeatureImportanceBaseline } from '../../../../../../../common/types/fea
 import { useExplorationDataGrid } from './use_exploration_data_grid';
 
 export const useExplorationResults = (
-  indexPattern: IndexPattern | undefined,
+  indexPattern: DataView | undefined,
   jobConfig: DataFrameAnalyticsConfig | undefined,
   searchQuery: SavedSearchQuery,
   toastNotifications: CoreSetup['notifications']['toasts'],
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/outlier_exploration/use_outlier_data.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/outlier_exploration/use_outlier_data.ts
index d630fedc72d3f7..d0f048ac02606a 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/outlier_exploration/use_outlier_data.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/outlier_exploration/use_outlier_data.ts
@@ -9,7 +9,7 @@ import { useEffect, useMemo } from 'react';
 
 import { EuiDataGridColumn } from '@elastic/eui';
 
-import { IndexPattern } from '../../../../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../../../../src/plugins/data_views/public';
 
 import { DataLoader } from '../../../../../datavisualizer/index_based/data_loader';
 
@@ -41,7 +41,7 @@ import { getFeatureCount, getOutlierScoreFieldName } from './common';
 import { useExplorationDataGrid } from '../exploration_results_table/use_exploration_data_grid';
 
 export const useOutlierData = (
-  indexPattern: IndexPattern | undefined,
+  indexPattern: DataView | undefined,
   jobConfig: DataFrameAnalyticsConfig | undefined,
   searchQuery: SavedSearchQuery
 ): UseIndexDataReturnType => {
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/clone_action_name.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/clone_action_name.tsx
index a3f18801b88f9e..8ef743d2eea9fd 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/clone_action_name.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/clone_action_name.tsx
@@ -9,7 +9,6 @@ import { EuiToolTip } from '@elastic/eui';
 import React, { FC } from 'react';
 import { cloneDeep, isEqual } from 'lodash';
 import { i18n } from '@kbn/i18n';
-import { IIndexPattern } from 'src/plugins/data/common';
 import { DeepReadonly } from '../../../../../../../common/types/common';
 import { DataFrameAnalyticsConfig, isOutlierAnalysis } from '../../../../common';
 import { isClassificationAnalysis, isRegressionAnalysis } from '../../../../common/analytics';
@@ -401,13 +400,11 @@ export const useNavigateToWizardWithClonedJob = () => {
   const {
     services: {
       notifications: { toasts },
-      savedObjects,
+      data: { dataViews },
     },
   } = useMlKibana();
   const navigateToPath = useNavigateToPath();
 
-  const savedObjectsClient = savedObjects.client;
-
   return async (item: Pick<DataFrameAnalyticsListRow, 'config' | 'stats'>) => {
     const sourceIndex = Array.isArray(item.config.source.index)
       ? item.config.source.index.join(',')
@@ -415,19 +412,9 @@ export const useNavigateToWizardWithClonedJob = () => {
     let sourceIndexId;
 
     try {
-      const response = await savedObjectsClient.find<IIndexPattern>({
-        type: 'index-pattern',
-        perPage: 10,
-        search: `"${sourceIndex}"`,
-        searchFields: ['title'],
-        fields: ['title'],
-      });
-
-      const ip = response.savedObjects.find(
-        (obj) => obj.attributes.title.toLowerCase() === sourceIndex.toLowerCase()
-      );
-      if (ip !== undefined) {
-        sourceIndexId = ip.id;
+      const dv = (await dataViews.find(sourceIndex)).find(({ title }) => title === sourceIndex);
+      if (dv !== undefined) {
+        sourceIndexId = dv.id;
       } else {
         toasts.addDanger(
           i18n.translate('xpack.ml.dataframe.analyticsList.noSourceIndexPatternForClone', {
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/delete_action_name.test.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/delete_action_name.test.tsx
index 6b26e3823d2efa..ad6a59bf01c0e6 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/delete_action_name.test.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/delete_action_name.test.tsx
@@ -30,7 +30,7 @@ jest.mock('../../../../../../application/util/dependency_cache', () => ({
 
 jest.mock('../../../../../contexts/kibana', () => ({
   useMlKibana: () => ({
-    services: mockCoreServices.createStart(),
+    services: { ...mockCoreServices.createStart(), data: { data_view: { find: jest.fn() } } },
   }),
   useNotifications: () => {
     return {
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/use_delete_action.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/use_delete_action.tsx
index 91871015d2adde..0d2025c0d049a0 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/use_delete_action.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/use_delete_action.tsx
@@ -8,9 +8,6 @@
 import React, { useEffect, useMemo, useState } from 'react';
 
 import { i18n } from '@kbn/i18n';
-
-import { IIndexPattern } from 'src/plugins/data/common';
-
 import { extractErrorMessage } from '../../../../../../../common/util/errors';
 
 import { useMlKibana } from '../../../../../contexts/kibana';
@@ -48,8 +45,9 @@ export const useDeleteAction = (canDeleteDataFrameAnalytics: boolean) => {
   const [indexPatternExists, setIndexPatternExists] = useState<boolean>(false);
   const [isLoading, setIsLoading] = useState<boolean>(false);
 
-  const { savedObjects } = useMlKibana().services;
-  const savedObjectsClient = savedObjects.client;
+  const {
+    data: { dataViews },
+  } = useMlKibana().services;
 
   const indexName = item?.config.dest.index ?? '';
 
@@ -57,17 +55,8 @@ export const useDeleteAction = (canDeleteDataFrameAnalytics: boolean) => {
 
   const checkIndexPatternExists = async () => {
     try {
-      const response = await savedObjectsClient.find<IIndexPattern>({
-        type: 'index-pattern',
-        perPage: 10,
-        search: `"${indexName}"`,
-        searchFields: ['title'],
-        fields: ['title'],
-      });
-      const ip = response.savedObjects.find(
-        (obj) => obj.attributes.title.toLowerCase() === indexName.toLowerCase()
-      );
-      if (ip !== undefined) {
+      const dv = (await dataViews.find(indexName)).find(({ title }) => title === indexName);
+      if (dv !== undefined) {
         setIndexPatternExists(true);
       } else {
         setIndexPatternExists(false);
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/source_selection/source_selection.test.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/source_selection/source_selection.test.tsx
index 7e90a4e3ed44ac..6e663318d2dc64 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/source_selection/source_selection.test.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/source_selection/source_selection.test.tsx
@@ -87,6 +87,7 @@ jest.mock('../../../../../util/index_utils', () => {
       async (id: string): Promise<IndexPatternAndSavedSearch> => {
         return {
           indexPattern: {
+            // @ts-expect-error fields should not be empty
             fields: [],
             title:
               id === 'the-remote-saved-search-id'
diff --git a/x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts b/x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts
index a5fabc12c83df5..1dccd54f68a386 100644
--- a/x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts
+++ b/x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts
@@ -7,7 +7,7 @@
 
 import { CoreSetup } from 'src/core/public';
 
-import { IndexPattern } from '../../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../../src/plugins/data_views/public';
 
 import { SavedSearchQuery } from '../../../contexts/ml';
 import { OMIT_FIELDS } from '../../../../../common/constants/field_types';
@@ -22,15 +22,12 @@ import { RuntimeMappings } from '../../../../../common/types/fields';
 const MAX_EXAMPLES_DEFAULT: number = 10;
 
 export class DataLoader {
-  private _indexPattern: IndexPattern;
+  private _indexPattern: DataView;
   private _runtimeMappings: RuntimeMappings;
   private _indexPatternTitle: IndexPatternTitle = '';
   private _maxExamples: number = MAX_EXAMPLES_DEFAULT;
 
-  constructor(
-    indexPattern: IndexPattern,
-    toastNotifications?: CoreSetup['notifications']['toasts']
-  ) {
+  constructor(indexPattern: DataView, toastNotifications?: CoreSetup['notifications']['toasts']) {
     this._indexPattern = indexPattern;
     this._runtimeMappings = this._indexPattern.getComputedFields().runtimeFields as RuntimeMappings;
     this._indexPatternTitle = indexPattern.title;
diff --git a/x-pack/plugins/ml/public/application/explorer/components/explorer_query_bar/explorer_query_bar.tsx b/x-pack/plugins/ml/public/application/explorer/components/explorer_query_bar/explorer_query_bar.tsx
index 6e8b5f762558ff..f57d2c1b01d983 100644
--- a/x-pack/plugins/ml/public/application/explorer/components/explorer_query_bar/explorer_query_bar.tsx
+++ b/x-pack/plugins/ml/public/application/explorer/components/explorer_query_bar/explorer_query_bar.tsx
@@ -10,7 +10,7 @@ import { EuiCode, EuiInputPopover } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { fromKueryExpression, luceneStringToDsl, toElasticsearchQuery } from '@kbn/es-query';
 import { Query, QueryStringInput } from '../../../../../../../../src/plugins/data/public';
-import { IIndexPattern } from '../../../../../../../../src/plugins/data/common';
+import { DataView } from '../../../../../../../../src/plugins/data_views/common';
 import { SEARCH_QUERY_LANGUAGE, ErrorMessage } from '../../../../../common/constants/search';
 import { explorerService } from '../../explorer_dashboard_service';
 import { InfluencersFilterQuery } from '../../../../../common/types/es_client';
@@ -24,7 +24,7 @@ export function getKqlQueryValues({
 }: {
   inputString: string | { [key: string]: any };
   queryLanguage: string;
-  indexPattern: IIndexPattern;
+  indexPattern: DataView;
 }): { clearSettings: boolean; settings: any } {
   let influencersFilterQuery: InfluencersFilterQuery = {};
   const filteredFields: string[] = [];
@@ -89,7 +89,7 @@ function getInitSearchInputState({
 interface ExplorerQueryBarProps {
   filterActive: boolean;
   filterPlaceHolder: string;
-  indexPattern: IIndexPattern;
+  indexPattern: DataView;
   queryString?: string;
   updateLanguage: (language: string) => void;
 }
diff --git a/x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/editor.test.tsx b/x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/editor.test.tsx
index f6769abb610b89..11e4c14cd4ab27 100644
--- a/x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/editor.test.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/editor.test.tsx
@@ -16,7 +16,7 @@ import React from 'react';
 import { CustomUrlEditor } from './editor';
 import { TIME_RANGE_TYPE, URL_TYPE } from './constants';
 import { CustomUrlSettings } from './utils';
-import { IIndexPattern } from '../../../../../../../../src/plugins/data/common';
+import { DataView } from '../../../../../../../../src/plugins/data_views/common';
 
 function prepareTest(customUrl: CustomUrlSettings, setEditCustomUrlFn: (url: UrlConfig) => void) {
   const savedCustomUrls = [
@@ -50,7 +50,7 @@ function prepareTest(customUrl: CustomUrlSettings, setEditCustomUrlFn: (url: Url
   const indexPatterns = [
     { id: 'pattern1', title: 'Index Pattern 1' },
     { id: 'pattern2', title: 'Index Pattern 2' },
-  ] as IIndexPattern[];
+  ] as DataView[];
 
   const queryEntityFieldNames = ['airline'];
 
diff --git a/x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/editor.tsx b/x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/editor.tsx
index e22eb1484df2e8..7dd779ead78926 100644
--- a/x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/editor.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/editor.tsx
@@ -29,7 +29,7 @@ import { isValidLabel } from '../../../util/custom_url_utils';
 
 import { TIME_RANGE_TYPE, URL_TYPE } from './constants';
 import { UrlConfig } from '../../../../../common/types/custom_urls';
-import { IIndexPattern } from '../../../../../../../../src/plugins/data/common';
+import { DataView } from '../../../../../../../../src/plugins/data_views/common';
 
 function getLinkToOptions() {
   return [
@@ -59,7 +59,7 @@ interface CustomUrlEditorProps {
   setEditCustomUrl: (url: any) => void;
   savedCustomUrls: UrlConfig[];
   dashboards: any[];
-  indexPatterns: IIndexPattern[];
+  indexPatterns: DataView[];
   queryEntityFieldNames: string[];
 }
 
diff --git a/x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/utils.d.ts b/x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/utils.d.ts
index 87000cdabd9137..1f815759c62429 100644
--- a/x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/utils.d.ts
+++ b/x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/utils.d.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { IIndexPattern } from 'src/plugins/data/common';
+import { DataView } from '../../../../../../../../src/plugins/data_views/common';
 import { UrlConfig } from '../../../../../common/types/custom_urls';
 import { Job } from '../../../../../common/types/anomaly_detection_jobs';
 import { TimeRangeType } from './constants';
@@ -34,7 +34,7 @@ export function isValidCustomUrlSettingsTimeRange(timeRangeSettings: any): boole
 export function getNewCustomUrlDefaults(
   job: Job,
   dashboards: any[],
-  indexPatterns: IIndexPattern[]
+  indexPatterns: DataView[]
 ): CustomUrlSettings;
 export function getQueryEntityFieldNames(job: Job): string[];
 export function isValidCustomUrlSettings(
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_utils.d.ts b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_utils.d.ts
index 3a14715bca4b92..32e99e3e433e0b 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_utils.d.ts
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_utils.d.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { IIndexPattern } from 'src/plugins/data/common';
+import type { DataView } from 'src/plugins/data_views/common';
 
 export function loadSavedDashboards(maxNumber: number): Promise<any[]>;
-export function loadIndexPatterns(maxNumber: number): Promise<IIndexPattern[]>;
+export function loadIndexPatterns(maxNumber: number): Promise<DataView[]>;
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_utils.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_utils.js
index 8ce92ffa384798..ad192a738174e5 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_utils.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_utils.js
@@ -8,7 +8,7 @@
 import { difference } from 'lodash';
 import { getNewJobLimits } from '../../../../services/ml_server_info';
 import { processCreatedBy } from '../../../../../../common/util/job_utils';
-import { getSavedObjectsClient } from '../../../../util/dependency_cache';
+import { getSavedObjectsClient, getDataViews } from '../../../../util/dependency_cache';
 import { ml } from '../../../../services/ml_api_service';
 
 export function saveJob(job, newJobData, finish) {
@@ -107,26 +107,12 @@ export function loadIndexPatterns(maxNumber) {
   // TODO - amend loadIndexPatterns in index_utils.js to do the request,
   // without needing an Angular Provider.
   return new Promise((resolve, reject) => {
-    const savedObjectsClient = getSavedObjectsClient();
-    savedObjectsClient
-      .find({
-        type: 'index-pattern',
-        fields: ['title'],
-        perPage: maxNumber,
-      })
-      .then((resp) => {
-        const savedObjects = resp.savedObjects;
-        if (savedObjects !== undefined) {
-          const indexPatterns = savedObjects.map((savedObj) => {
-            return { id: savedObj.id, title: savedObj.attributes.title };
-          });
-
-          indexPatterns.sort((dash1, dash2) => {
-            return dash1.title.localeCompare(dash2.title);
-          });
-
-          resolve(indexPatterns);
-        }
+    const dataViewsContract = getDataViews();
+    dataViewsContract
+      .find('*', maxNumber)
+      .then((dataViews) => {
+        const sortedDataViews = dataViews.sort((a, b) => a.title.localeCompare(b.title));
+        resolve(sortedDataViews);
       })
       .catch((resp) => {
         reject(resp);
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/tabs/custom_urls.tsx b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/tabs/custom_urls.tsx
index ce93080558016a..46ac1dbd01b7f7 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/tabs/custom_urls.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/tabs/custom_urls.tsx
@@ -37,7 +37,7 @@ import { loadSavedDashboards, loadIndexPatterns } from '../edit_utils';
 import { openCustomUrlWindow } from '../../../../../util/custom_url_utils';
 import { Job } from '../../../../../../../common/types/anomaly_detection_jobs';
 import { UrlConfig } from '../../../../../../../common/types/custom_urls';
-import { IIndexPattern } from '../../../../../../../../../../src/plugins/data/common';
+import { DataView } from '../../../../../../../../../../src/plugins/data_views/common';
 import { MlKibanaReactContextValue } from '../../../../../contexts/kibana';
 
 const MAX_NUMBER_DASHBOARDS = 1000;
@@ -54,7 +54,7 @@ interface CustomUrlsProps {
 interface CustomUrlsState {
   customUrls: UrlConfig[];
   dashboards: any[];
-  indexPatterns: IIndexPattern[];
+  indexPatterns: DataView[];
   queryEntityFieldNames: string[];
   editorOpen: boolean;
   editorSettings?: CustomUrlSettings;
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts
index 9c8f34260def03..5898a9dec1ad32 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts
@@ -19,7 +19,7 @@ import { ml } from '../../../../services/ml_api_service';
 import { mlResultsService } from '../../../../services/results_service';
 import { getCategoryFields as getCategoryFieldsOrig } from './searches';
 import { aggFieldPairsCanBeCharted } from '../job_creator/util/general';
-import { IndexPattern } from '../../../../../../../../../src/plugins/data/common';
+import type { DataView } from '../../../../../../../../../src/plugins/data_views/common';
 
 type DetectorIndex = number;
 export interface LineChartPoint {
@@ -41,7 +41,7 @@ export class ChartLoader {
   private _timeFieldName: string = '';
   private _query: object = {};
 
-  constructor(indexPattern: IndexPattern, query: object) {
+  constructor(indexPattern: DataView, query: object) {
     this._indexPatternTitle = indexPattern.title;
     this._query = query;
 
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/index_pattern_context.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/index_pattern_context.ts
index cb842937f1edef..9667465eb210d9 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/index_pattern_context.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/index_pattern_context.ts
@@ -7,7 +7,7 @@
 
 import React from 'react';
 
-import { IIndexPattern } from 'src/plugins/data/public';
+import { DataView } from '../../../../../../../../src/plugins/data_views/common';
 
-export type IndexPatternContextValue = IIndexPattern | null;
+export type IndexPatternContextValue = DataView | null;
 export const IndexPatternContext = React.createContext<IndexPatternContextValue>(null);
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/advanced_job_creator.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/advanced_job_creator.ts
index 35847839b02a02..3d8c34e0e5967f 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/advanced_job_creator.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/advanced_job_creator.ts
@@ -21,7 +21,7 @@ import { JOB_TYPE } from '../../../../../../common/constants/new_job';
 import { getRichDetectors } from './util/general';
 import { isValidJson } from '../../../../../../common/util/validation_utils';
 import { ml } from '../../../../services/ml_api_service';
-import { IndexPattern } from '../../../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../../../src/plugins/data_views/public';
 
 export interface RichDetector {
   agg: Aggregation | null;
@@ -40,11 +40,7 @@ export class AdvancedJobCreator extends JobCreator {
   private _richDetectors: RichDetector[] = [];
   private _queryString: string;
 
-  constructor(
-    indexPattern: IndexPattern,
-    savedSearch: SavedSearchSavedObject | null,
-    query: object
-  ) {
+  constructor(indexPattern: DataView, savedSearch: SavedSearchSavedObject | null, query: object) {
     super(indexPattern, savedSearch, query);
 
     this._queryString = JSON.stringify(this._datafeed_config.query);
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/categorization_job_creator.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/categorization_job_creator.ts
index 128a541ff9f960..b46d3b539b44a7 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/categorization_job_creator.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/categorization_job_creator.ts
@@ -6,7 +6,7 @@
  */
 
 import { isEqual } from 'lodash';
-import { IndexPattern } from '../../../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../../../src/plugins/data_views/public';
 import { SavedSearchSavedObject } from '../../../../../../common/types/kibana';
 import { JobCreator } from './job_creator';
 import { Field, Aggregation, mlCategory } from '../../../../../../common/types/fields';
@@ -47,11 +47,7 @@ export class CategorizationJobCreator extends JobCreator {
   private _partitionFieldName: string | null = null;
   private _ccsVersionFailure: boolean = false;
 
-  constructor(
-    indexPattern: IndexPattern,
-    savedSearch: SavedSearchSavedObject | null,
-    query: object
-  ) {
+  constructor(indexPattern: DataView, savedSearch: SavedSearchSavedObject | null, query: object) {
     super(indexPattern, savedSearch, query);
     this.createdBy = CREATED_BY_LABEL.CATEGORIZATION;
     this._examplesLoader = new CategorizationExamplesLoader(this, indexPattern, query);
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts
index e6cfe52933617c..a44b4bdef60c40 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts
@@ -40,13 +40,13 @@ import { filterRuntimeMappings } from './util/filter_runtime_mappings';
 import { parseInterval } from '../../../../../../common/util/parse_interval';
 import { Calendar } from '../../../../../../common/types/calendars';
 import { mlCalendarService } from '../../../../services/calendar_service';
-import { IndexPattern } from '../../../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../../../src/plugins/data_views/public';
 import { getDatafeedAggregations } from '../../../../../../common/util/datafeed_utils';
 import { getFirstKeyInObject } from '../../../../../../common/util/object_utils';
 
 export class JobCreator {
   protected _type: JOB_TYPE = JOB_TYPE.SINGLE_METRIC;
-  protected _indexPattern: IndexPattern;
+  protected _indexPattern: DataView;
   protected _savedSearch: SavedSearchSavedObject | null;
   protected _indexPatternTitle: IndexPatternTitle = '';
   protected _job_config: Job;
@@ -74,11 +74,7 @@ export class JobCreator {
   protected _wizardInitialized$ = new BehaviorSubject<boolean>(false);
   public wizardInitialized$ = this._wizardInitialized$.asObservable();
 
-  constructor(
-    indexPattern: IndexPattern,
-    savedSearch: SavedSearchSavedObject | null,
-    query: object
-  ) {
+  constructor(indexPattern: DataView, savedSearch: SavedSearchSavedObject | null, query: object) {
     this._indexPattern = indexPattern;
     this._savedSearch = savedSearch;
     this._indexPatternTitle = indexPattern.title;
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator_factory.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator_factory.ts
index 8c77ae5def1029..6af3df888514c0 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator_factory.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator_factory.ts
@@ -10,7 +10,7 @@ import { SingleMetricJobCreator } from './single_metric_job_creator';
 import { MultiMetricJobCreator } from './multi_metric_job_creator';
 import { PopulationJobCreator } from './population_job_creator';
 import { AdvancedJobCreator } from './advanced_job_creator';
-import { IndexPattern } from '../../../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../../../src/plugins/data_views/public';
 import { CategorizationJobCreator } from './categorization_job_creator';
 import { RareJobCreator } from './rare_job_creator';
 
@@ -18,7 +18,7 @@ import { JOB_TYPE } from '../../../../../../common/constants/new_job';
 
 export const jobCreatorFactory =
   (jobType: JOB_TYPE) =>
-  (indexPattern: IndexPattern, savedSearch: SavedSearchSavedObject | null, query: object) => {
+  (indexPattern: DataView, savedSearch: SavedSearchSavedObject | null, query: object) => {
     let jc;
     switch (jobType) {
       case JOB_TYPE.SINGLE_METRIC:
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/multi_metric_job_creator.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/multi_metric_job_creator.ts
index f63aa1b569a2c6..12543f34003d52 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/multi_metric_job_creator.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/multi_metric_job_creator.ts
@@ -17,7 +17,7 @@ import { Job, Datafeed, Detector } from '../../../../../../common/types/anomaly_
 import { createBasicDetector } from './util/default_configs';
 import { JOB_TYPE, CREATED_BY_LABEL } from '../../../../../../common/constants/new_job';
 import { getRichDetectors } from './util/general';
-import { IndexPattern } from '../../../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../../../src/plugins/data_views/public';
 import { isSparseDataJob } from './util/general';
 
 export class MultiMetricJobCreator extends JobCreator {
@@ -27,11 +27,7 @@ export class MultiMetricJobCreator extends JobCreator {
 
   protected _type: JOB_TYPE = JOB_TYPE.MULTI_METRIC;
 
-  constructor(
-    indexPattern: IndexPattern,
-    savedSearch: SavedSearchSavedObject | null,
-    query: object
-  ) {
+  constructor(indexPattern: DataView, savedSearch: SavedSearchSavedObject | null, query: object) {
     super(indexPattern, savedSearch, query);
     this.createdBy = CREATED_BY_LABEL.MULTI_METRIC;
     this._wizardInitialized$.next(true);
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/population_job_creator.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/population_job_creator.ts
index 24b31922312113..7f001ce3344622 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/population_job_creator.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/population_job_creator.ts
@@ -17,7 +17,7 @@ import { Job, Datafeed, Detector } from '../../../../../../common/types/anomaly_
 import { createBasicDetector } from './util/default_configs';
 import { JOB_TYPE, CREATED_BY_LABEL } from '../../../../../../common/constants/new_job';
 import { getRichDetectors } from './util/general';
-import { IndexPattern } from '../../../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../../../src/plugins/data_views/public';
 
 export class PopulationJobCreator extends JobCreator {
   // a population job has one overall over (split) field, which is the same for all detectors
@@ -26,11 +26,7 @@ export class PopulationJobCreator extends JobCreator {
   private _byFields: SplitField[] = [];
   protected _type: JOB_TYPE = JOB_TYPE.POPULATION;
 
-  constructor(
-    indexPattern: IndexPattern,
-    savedSearch: SavedSearchSavedObject | null,
-    query: object
-  ) {
+  constructor(indexPattern: DataView, savedSearch: SavedSearchSavedObject | null, query: object) {
     super(indexPattern, savedSearch, query);
     this.createdBy = CREATED_BY_LABEL.POPULATION;
     this._wizardInitialized$.next(true);
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/rare_job_creator.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/rare_job_creator.ts
index 73050dc4b78349..8973aa655b83db 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/rare_job_creator.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/rare_job_creator.ts
@@ -11,7 +11,7 @@ import { Field, SplitField, Aggregation } from '../../../../../../common/types/f
 import { Job, Datafeed, Detector } from '../../../../../../common/types/anomaly_detection_jobs';
 import { JOB_TYPE, CREATED_BY_LABEL } from '../../../../../../common/constants/new_job';
 import { getRichDetectors } from './util/general';
-import { IndexPattern } from '../../../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../../../src/plugins/data_views/public';
 import { isSparseDataJob } from './util/general';
 import { ML_JOB_AGGREGATION } from '../../../../../../common/constants/aggregation_types';
 
@@ -26,11 +26,7 @@ export class RareJobCreator extends JobCreator {
   private _rareAgg: Aggregation;
   private _freqRareAgg: Aggregation;
 
-  constructor(
-    indexPattern: IndexPattern,
-    savedSearch: SavedSearchSavedObject | null,
-    query: object
-  ) {
+  constructor(indexPattern: DataView, savedSearch: SavedSearchSavedObject | null, query: object) {
     super(indexPattern, savedSearch, query);
     this.createdBy = CREATED_BY_LABEL.RARE;
     this._wizardInitialized$.next(true);
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/single_metric_job_creator.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/single_metric_job_creator.ts
index 57ff76979ea14b..9c4fd52888c82c 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/single_metric_job_creator.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/single_metric_job_creator.ts
@@ -22,17 +22,13 @@ import {
 } from '../../../../../../common/constants/aggregation_types';
 import { JOB_TYPE, CREATED_BY_LABEL } from '../../../../../../common/constants/new_job';
 import { getRichDetectors } from './util/general';
-import { IndexPattern } from '../../../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../../../src/plugins/data_views/public';
 import { isSparseDataJob } from './util/general';
 
 export class SingleMetricJobCreator extends JobCreator {
   protected _type: JOB_TYPE = JOB_TYPE.SINGLE_METRIC;
 
-  constructor(
-    indexPattern: IndexPattern,
-    savedSearch: SavedSearchSavedObject | null,
-    query: object
-  ) {
+  constructor(indexPattern: DataView, savedSearch: SavedSearchSavedObject | null, query: object) {
     super(indexPattern, savedSearch, query);
     this.createdBy = CREATED_BY_LABEL.SINGLE_METRIC;
     this._wizardInitialized$.next(true);
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/categorization_examples_loader.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/categorization_examples_loader.ts
index 641eda3dbf3e81..6e65bde8793793 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/categorization_examples_loader.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/categorization_examples_loader.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { IndexPattern } from '../../../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../../../src/plugins/data_views/public';
 import { IndexPatternTitle } from '../../../../../../common/types/kibana';
 import { CategorizationJobCreator } from '../job_creator';
 import { ml } from '../../../../services/ml_api_service';
@@ -20,7 +20,7 @@ export class CategorizationExamplesLoader {
   private _timeFieldName: string = '';
   private _query: object = {};
 
-  constructor(jobCreator: CategorizationJobCreator, indexPattern: IndexPattern, query: object) {
+  constructor(jobCreator: CategorizationJobCreator, indexPattern: DataView, query: object) {
     this._jobCreator = jobCreator;
     this._indexPatternTitle = indexPattern.title;
     this._query = query;
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts b/x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts
index ba750795e4f8ff..03428bd47e4904 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts
@@ -5,15 +5,15 @@
  * 2.0.
  */
 
-import { ApplicationStart } from 'kibana/public';
-import { IndexPatternsContract } from '../../../../../../../../../src/plugins/data/public';
+import type { ApplicationStart } from 'kibana/public';
+import type { DataViewsContract } from '../../../../../../../../../src/plugins/data_views/public';
 import { mlJobService } from '../../../../services/job_service';
 import { loadIndexPatterns, getIndexPatternIdFromName } from '../../../../util/index_utils';
 import { Datafeed, Job } from '../../../../../../common/types/anomaly_detection_jobs';
 import { CREATED_BY_LABEL, JOB_TYPE } from '../../../../../../common/constants/new_job';
 
 export async function preConfiguredJobRedirect(
-  indexPatterns: IndexPatternsContract,
+  indexPatterns: DataViewsContract,
   basePath: string,
   navigateToUrl: ApplicationStart['navigateToUrl']
 ) {
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.test.ts b/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.test.ts
index 3f19f3137934ed..12beda414bbead 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.test.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.test.ts
@@ -6,7 +6,7 @@
  */
 
 import { IUiSettingsClient } from 'kibana/public';
-import { IIndexPattern } from '../../../../../../../../src/plugins/data/common';
+import { DataView } from '../../../../../../../../src/plugins/data_views/common';
 import { SavedSearchSavedObject } from '../../../../../common/types/kibana';
 import { createSearchItems } from './new_job_utils';
 
@@ -14,7 +14,7 @@ describe('createSearchItems', () => {
   const kibanaConfig = {} as IUiSettingsClient;
   const indexPattern = {
     fields: [],
-  } as unknown as IIndexPattern;
+  } as unknown as DataView;
 
   let savedSearch = {} as unknown as SavedSearchSavedObject;
   beforeEach(() => {
diff --git a/x-pack/plugins/ml/public/application/routing/resolvers.ts b/x-pack/plugins/ml/public/application/routing/resolvers.ts
index f6364ecc6568f5..3479005809efba 100644
--- a/x-pack/plugins/ml/public/application/routing/resolvers.ts
+++ b/x-pack/plugins/ml/public/application/routing/resolvers.ts
@@ -11,7 +11,7 @@ import { checkGetJobsCapabilitiesResolver } from '../capabilities/check_capabili
 import { getMlNodeCount } from '../ml_nodes_check/check_ml_nodes';
 import { loadMlServerInfo } from '../services/ml_server_info';
 
-import { IndexPatternsContract } from '../../../../../../src/plugins/data/public';
+import type { DataViewsContract } from '../../../../../../src/plugins/data_views/public';
 
 export interface Resolvers {
   [name: string]: () => Promise<any>;
@@ -21,7 +21,7 @@ export interface ResolverResults {
 }
 
 interface BasicResolverDependencies {
-  indexPatterns: IndexPatternsContract;
+  indexPatterns: DataViewsContract;
   redirectToMlAccessDeniedPage: () => Promise<void>;
 }
 
diff --git a/x-pack/plugins/ml/public/application/routing/router.tsx b/x-pack/plugins/ml/public/application/routing/router.tsx
index c2129ef18df3a0..847dcc1ae11078 100644
--- a/x-pack/plugins/ml/public/application/routing/router.tsx
+++ b/x-pack/plugins/ml/public/application/routing/router.tsx
@@ -9,9 +9,13 @@ import React, { useEffect, FC } from 'react';
 import { useHistory, useLocation, Router, Route, RouteProps } from 'react-router-dom';
 import { Location } from 'history';
 
-import { AppMountParameters, IUiSettingsClient, ChromeStart } from 'kibana/public';
-import { ChromeBreadcrumb } from 'kibana/public';
-import { IndexPatternsContract } from 'src/plugins/data/public';
+import type {
+  AppMountParameters,
+  IUiSettingsClient,
+  ChromeStart,
+  ChromeBreadcrumb,
+} from 'kibana/public';
+import type { DataViewsContract } from 'src/plugins/data_views/public';
 
 import { useMlKibana, useNavigateToPath } from '../contexts/kibana';
 import { MlContext, MlContextValue } from '../contexts/ml';
@@ -39,7 +43,7 @@ export interface PageProps {
 interface PageDependencies {
   config: IUiSettingsClient;
   history: AppMountParameters['history'];
-  indexPatterns: IndexPatternsContract;
+  indexPatterns: DataViewsContract;
   setBreadcrumbs: ChromeStart['setBreadcrumbs'];
   redirectToMlAccessDeniedPage: () => Promise<void>;
 }
diff --git a/x-pack/plugins/ml/public/application/services/field_format_service.ts b/x-pack/plugins/ml/public/application/services/field_format_service.ts
index 18b489682318e5..fe6fc7751bb85b 100644
--- a/x-pack/plugins/ml/public/application/services/field_format_service.ts
+++ b/x-pack/plugins/ml/public/application/services/field_format_service.ts
@@ -8,7 +8,7 @@
 import { mlFunctionToESAggregation } from '../../../common/util/job_utils';
 import { getIndexPatternById, getIndexPatternIdFromName } from '../util/index_utils';
 import { mlJobService } from './job_service';
-import { IndexPattern } from '../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../src/plugins/data_views/public';
 
 type FormatsByJobId = Record<string, any>;
 type IndexPatternIdsByJob = Record<string, any>;
@@ -66,11 +66,7 @@ class FieldFormatService {
 
   // Utility for returning the FieldFormat from a full populated Kibana index pattern object
   // containing the list of fields by name with their formats.
-  getFieldFormatFromIndexPattern(
-    fullIndexPattern: IndexPattern,
-    fieldName: string,
-    esAggName: string
-  ) {
+  getFieldFormatFromIndexPattern(fullIndexPattern: DataView, fieldName: string, esAggName: string) {
     // Don't use the field formatter for distinct count detectors as
     // e.g. distinct_count(clientip) should be formatted as a count, not as an IP address.
     let fieldFormat;
diff --git a/x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts b/x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts
index d3b407c2bb65a8..02b2e573f8c699 100644
--- a/x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts
+++ b/x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { IIndexPattern, IndexPatternsContract } from '../../../../../../../src/plugins/data/public';
+import { DataView, DataViewsContract } from '../../../../../../../src/plugins/data_views/public';
 import { getIndexPatternAndSavedSearch } from '../../util/index_utils';
 import { JobType } from '../../../../common/types/saved_objects';
 import { newJobCapsServiceAnalytics } from '../new_job_capabilities/new_job_capabilities_service_analytics';
@@ -19,7 +19,7 @@ export const DATA_FRAME_ANALYTICS = 'data-frame-analytics';
 export function loadNewJobCapabilities(
   indexPatternId: string,
   savedSearchId: string,
-  indexPatterns: IndexPatternsContract,
+  indexPatterns: DataViewsContract,
   jobType: JobType
 ) {
   return new Promise(async (resolve, reject) => {
@@ -29,7 +29,7 @@ export function loadNewJobCapabilities(
 
       if (indexPatternId !== undefined) {
         // index pattern is being used
-        const indexPattern: IIndexPattern = await indexPatterns.get(indexPatternId);
+        const indexPattern: DataView = await indexPatterns.get(indexPatternId);
         await serviceToUse.initializeFromIndexPattern(indexPattern);
         resolve(serviceToUse.newJobCaps);
       } else if (savedSearchId !== undefined) {
diff --git a/x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities._service.test.ts b/x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities._service.test.ts
index 8c515255927b43..49c8b08007d52d 100644
--- a/x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities._service.test.ts
+++ b/x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities._service.test.ts
@@ -6,7 +6,7 @@
  */
 
 import { newJobCapsService } from './new_job_capabilities_service';
-import { IndexPattern } from '../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../src/plugins/data_views/public';
 
 // there is magic happening here. starting the include name with `mock..`
 // ensures it can be lazily loaded by the jest.mock function below.
@@ -23,7 +23,7 @@ jest.mock('../ml_api_service', () => ({
 const indexPattern = {
   id: 'cloudwatch-*',
   title: 'cloudwatch-*',
-} as unknown as IndexPattern;
+} as unknown as DataView;
 
 describe('new_job_capabilities_service', () => {
   describe('cloudwatch newJobCaps()', () => {
diff --git a/x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service.ts b/x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service.ts
index c17f379355cea8..45dc71ed6a6b93 100644
--- a/x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service.ts
+++ b/x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service.ts
@@ -11,7 +11,8 @@ import {
   FieldId,
   EVENT_RATE_FIELD_ID,
 } from '../../../../common/types/fields';
-import { ES_FIELD_TYPES, IIndexPattern } from '../../../../../../../src/plugins/data/public';
+import { ES_FIELD_TYPES } from '../../../../../../../src/plugins/data/public';
+import { DataView } from '../../../../../../../src/plugins/data_views/public';
 import { ml } from '../ml_api_service';
 import { processTextAndKeywordFields, NewJobCapabilitiesServiceBase } from './new_job_capabilities';
 
@@ -36,7 +37,7 @@ class NewJobCapsService extends NewJobCapabilitiesServiceBase {
   }
 
   public async initializeFromIndexPattern(
-    indexPattern: IIndexPattern,
+    indexPattern: DataView,
     includeEventRateField = true,
     removeTextFields = true
   ) {
diff --git a/x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service_analytics.ts b/x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service_analytics.ts
index 3a362a88e40bbc..f8f9ae6b2b0a37 100644
--- a/x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service_analytics.ts
+++ b/x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service_analytics.ts
@@ -6,7 +6,8 @@
  */
 
 import { Field, NewJobCapsResponse } from '../../../../common/types/fields';
-import { ES_FIELD_TYPES, IIndexPattern } from '../../../../../../../src/plugins/data/public';
+import { ES_FIELD_TYPES } from '../../../../../../../src/plugins/data/public';
+import { DataView } from '../../../../../../../src/plugins/data_views/public';
 import { processTextAndKeywordFields, NewJobCapabilitiesServiceBase } from './new_job_capabilities';
 import { ml } from '../ml_api_service';
 
@@ -42,7 +43,7 @@ export function removeNestedFieldChildren(resp: NewJobCapsResponse, indexPattern
 }
 
 class NewJobCapsServiceAnalytics extends NewJobCapabilitiesServiceBase {
-  public async initializeFromIndexPattern(indexPattern: IIndexPattern) {
+  public async initializeFromIndexPattern(indexPattern: DataView) {
     try {
       const resp: NewJobCapsResponse = await ml.dataFrameAnalytics.newJobCapsAnalytics(
         indexPattern.title,
diff --git a/x-pack/plugins/ml/public/application/services/new_job_capabilities/remove_nested_field_children.test.ts b/x-pack/plugins/ml/public/application/services/new_job_capabilities/remove_nested_field_children.test.ts
index eaf30d9894f605..ec2a2a1077a7fa 100644
--- a/x-pack/plugins/ml/public/application/services/new_job_capabilities/remove_nested_field_children.test.ts
+++ b/x-pack/plugins/ml/public/application/services/new_job_capabilities/remove_nested_field_children.test.ts
@@ -6,7 +6,7 @@
  */
 
 import { removeNestedFieldChildren } from './new_job_capabilities_service_analytics';
-import { IndexPattern } from '../../../../../../../src/plugins/data/public';
+import type { DataView } from '../../../../../../../src/plugins/data_views/public';
 
 // there is magic happening here. starting the include name with `mock..`
 // ensures it can be lazily loaded by the jest.mock function below.
@@ -15,7 +15,7 @@ import nestedFieldIndexResponse from '../__mocks__/nested_field_index_response.j
 const indexPattern = {
   id: 'nested-field-index',
   title: 'nested-field-index',
-} as unknown as IndexPattern;
+} as unknown as DataView;
 
 describe('removeNestedFieldChildren', () => {
   describe('cloudwatch newJobCapsAnalytics()', () => {
diff --git a/x-pack/plugins/ml/public/application/util/dependency_cache.ts b/x-pack/plugins/ml/public/application/util/dependency_cache.ts
index 4a3194ed4113fc..7b6b75677dddd3 100644
--- a/x-pack/plugins/ml/public/application/util/dependency_cache.ts
+++ b/x-pack/plugins/ml/public/application/util/dependency_cache.ts
@@ -19,8 +19,9 @@ import type {
   ChromeRecentlyAccessed,
   IBasePath,
 } from 'kibana/public';
-import type { IndexPatternsContract, DataPublicPluginStart } from 'src/plugins/data/public';
+import type { DataPublicPluginStart } from 'src/plugins/data/public';
 import type { SharePluginStart } from 'src/plugins/share/public';
+import type { DataViewsContract } from '../../../../../../src/plugins/data_views/public';
 import type { SecurityPluginSetup } from '../../../../security/public';
 import type { MapsStartApi } from '../../../../maps/public';
 import type { DataVisualizerPluginStart } from '../../../../data_visualizer/public';
@@ -28,7 +29,7 @@ import type { DataVisualizerPluginStart } from '../../../../data_visualizer/publ
 export interface DependencyCache {
   timefilter: DataPublicPluginSetup['query']['timefilter'] | null;
   config: IUiSettingsClient | null;
-  indexPatterns: IndexPatternsContract | null;
+  indexPatterns: DataViewsContract | null;
   chrome: ChromeStart | null;
   docLinks: DocLinksStart | null;
   toastNotifications: ToastsStart | null;
@@ -45,6 +46,7 @@ export interface DependencyCache {
   urlGenerators: SharePluginStart['urlGenerators'] | null;
   maps: MapsStartApi | null;
   dataVisualizer: DataVisualizerPluginStart | null;
+  dataViews: DataViewsContract | null;
 }
 
 const cache: DependencyCache = {
@@ -67,6 +69,7 @@ const cache: DependencyCache = {
   urlGenerators: null,
   maps: null,
   dataVisualizer: null,
+  dataViews: null,
 };
 
 export function setDependencyCache(deps: Partial<DependencyCache>) {
@@ -88,6 +91,7 @@ export function setDependencyCache(deps: Partial<DependencyCache>) {
   cache.i18n = deps.i18n || null;
   cache.urlGenerators = deps.urlGenerators || null;
   cache.dataVisualizer = deps.dataVisualizer || null;
+  cache.dataViews = deps.dataViews || null;
 }
 
 export function getTimefilter() {
@@ -208,6 +212,13 @@ export function getGetUrlGenerator() {
   return cache.urlGenerators.getUrlGenerator;
 }
 
+export function getDataViews() {
+  if (cache.dataViews === null) {
+    throw new Error("dataViews hasn't been initialized");
+  }
+  return cache.dataViews;
+}
+
 export function clearCache() {
   Object.keys(cache).forEach((k) => {
     cache[k as keyof DependencyCache] = null;
diff --git a/x-pack/plugins/ml/public/application/util/field_types_utils.test.ts b/x-pack/plugins/ml/public/application/util/field_types_utils.test.ts
index 440ac411e8ee78..0c50dc9efa343b 100644
--- a/x-pack/plugins/ml/public/application/util/field_types_utils.test.ts
+++ b/x-pack/plugins/ml/public/application/util/field_types_utils.test.ts
@@ -5,7 +5,8 @@
  * 2.0.
  */
 
-import { IFieldType, KBN_FIELD_TYPES } from '../../../../../../src/plugins/data/public';
+import { KBN_FIELD_TYPES } from '../../../../../../src/plugins/data/public';
+import { DataViewField } from '../../../../../../src/plugins/data_views/common';
 import { ML_JOB_FIELD_TYPES } from '../../../common/constants/field_types';
 import {
   kbnTypeToMLJobType,
@@ -16,28 +17,34 @@ import {
 describe('ML - field type utils', () => {
   describe('kbnTypeToMLJobType', () => {
     test('returns correct ML_JOB_FIELD_TYPES for KBN_FIELD_TYPES', () => {
-      const field: IFieldType = {
+      // @ts-ignore reassigning missing properties
+      const field: DataViewField = {
         type: KBN_FIELD_TYPES.NUMBER,
         name: KBN_FIELD_TYPES.NUMBER,
         aggregatable: true,
       };
       expect(kbnTypeToMLJobType(field)).toBe(ML_JOB_FIELD_TYPES.NUMBER);
 
+      // @ts-ignore reassigning read-only type
       field.type = KBN_FIELD_TYPES.DATE;
       expect(kbnTypeToMLJobType(field)).toBe(ML_JOB_FIELD_TYPES.DATE);
 
+      // @ts-ignore reassigning read-only type
       field.type = KBN_FIELD_TYPES.IP;
       expect(kbnTypeToMLJobType(field)).toBe(ML_JOB_FIELD_TYPES.IP);
 
+      // @ts-ignore reassigning read-only type
       field.type = KBN_FIELD_TYPES.BOOLEAN;
       expect(kbnTypeToMLJobType(field)).toBe(ML_JOB_FIELD_TYPES.BOOLEAN);
 
+      // @ts-ignore reassigning read-only type
       field.type = KBN_FIELD_TYPES.GEO_POINT;
       expect(kbnTypeToMLJobType(field)).toBe(ML_JOB_FIELD_TYPES.GEO_POINT);
     });
 
     test('returns ML_JOB_FIELD_TYPES.KEYWORD for aggregatable KBN_FIELD_TYPES.STRING', () => {
-      const field: IFieldType = {
+      // @ts-ignore reassigning missing properties
+      const field: DataViewField = {
         type: KBN_FIELD_TYPES.STRING,
         name: KBN_FIELD_TYPES.STRING,
         aggregatable: true,
@@ -46,7 +53,8 @@ describe('ML - field type utils', () => {
     });
 
     test('returns ML_JOB_FIELD_TYPES.TEXT for non-aggregatable KBN_FIELD_TYPES.STRING', () => {
-      const field: IFieldType = {
+      // @ts-ignore reassigning missing properties
+      const field: DataViewField = {
         type: KBN_FIELD_TYPES.STRING,
         name: KBN_FIELD_TYPES.STRING,
         aggregatable: false,
@@ -55,7 +63,8 @@ describe('ML - field type utils', () => {
     });
 
     test('returns undefined for non-aggregatable "foo"', () => {
-      const field: IFieldType = {
+      // @ts-ignore reassigning missing properties
+      const field: DataViewField = {
         type: 'foo',
         name: 'foo',
         aggregatable: false,
diff --git a/x-pack/plugins/ml/public/application/util/field_types_utils.ts b/x-pack/plugins/ml/public/application/util/field_types_utils.ts
index 0cb21fec1862ff..c02a1cbec56eca 100644
--- a/x-pack/plugins/ml/public/application/util/field_types_utils.ts
+++ b/x-pack/plugins/ml/public/application/util/field_types_utils.ts
@@ -8,12 +8,13 @@
 import { i18n } from '@kbn/i18n';
 import { ML_JOB_FIELD_TYPES } from '../../../common/constants/field_types';
 
-import { IFieldType, KBN_FIELD_TYPES } from '../../../../../../src/plugins/data/public';
+import { KBN_FIELD_TYPES } from '../../../../../../src/plugins/data/public';
+import { DataViewField } from '../../../../../../src/plugins/data_views/common';
 
 // convert kibana types to ML Job types
 // this is needed because kibana types only have string and not text and keyword.
 // and we can't use ES_FIELD_TYPES because it has no NUMBER type
-export function kbnTypeToMLJobType(field: IFieldType) {
+export function kbnTypeToMLJobType(field: DataViewField) {
   // Return undefined if not one of the supported data visualizer field types.
   let type;
   switch (field.type) {
diff --git a/x-pack/plugins/ml/public/application/util/index_utils.ts b/x-pack/plugins/ml/public/application/util/index_utils.ts
index 9d705c8cd725fb..b4f46d4df0cbb9 100644
--- a/x-pack/plugins/ml/public/application/util/index_utils.ts
+++ b/x-pack/plugins/ml/public/application/util/index_utils.ts
@@ -6,33 +6,20 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import {
-  IndexPattern,
-  IIndexPattern,
-  IndexPatternsContract,
-  Query,
-  IndexPatternAttributes,
-} from '../../../../../../src/plugins/data/public';
-import { getToastNotifications, getSavedObjectsClient } from './dependency_cache';
-import { IndexPatternSavedObject, SavedSearchSavedObject } from '../../../common/types/kibana';
-
-let indexPatternCache: IndexPatternSavedObject[] = [];
+import type { Query } from '../../../../../../src/plugins/data/public';
+import type { DataView, DataViewsContract } from '../../../../../../src/plugins/data_views/public';
+import type { SavedSearchSavedObject } from '../../../common/types/kibana';
+import { getToastNotifications, getSavedObjectsClient, getDataViews } from './dependency_cache';
+
+let indexPatternCache: DataView[] = [];
 let savedSearchesCache: SavedSearchSavedObject[] = [];
-let indexPatternsContract: IndexPatternsContract | null = null;
+let indexPatternsContract: DataViewsContract | null = null;
 
-export function loadIndexPatterns(indexPatterns: IndexPatternsContract) {
+export async function loadIndexPatterns(indexPatterns: DataViewsContract) {
   indexPatternsContract = indexPatterns;
-  const savedObjectsClient = getSavedObjectsClient();
-  return savedObjectsClient
-    .find<IndexPatternAttributes>({
-      type: 'index-pattern',
-      fields: ['id', 'title', 'type', 'fields'],
-      perPage: 10000,
-    })
-    .then((response) => {
-      indexPatternCache = response.savedObjects;
-      return indexPatternCache;
-    });
+  const dataViewsContract = getDataViews();
+  indexPatternCache = await dataViewsContract.find('*', 10000);
+  return indexPatternCache;
 }
 
 export function loadSavedSearches() {
@@ -63,20 +50,15 @@ export function getIndexPatternsContract() {
 }
 
 export function getIndexPatternNames() {
-  return indexPatternCache.map((i) => i.attributes && i.attributes.title);
+  return indexPatternCache.map((i) => i.title);
 }
 
 export function getIndexPatternIdFromName(name: string) {
-  for (let j = 0; j < indexPatternCache.length; j++) {
-    if (indexPatternCache[j].get('title') === name) {
-      return indexPatternCache[j].id;
-    }
-  }
-  return null;
+  return indexPatternCache.find((i) => i.title === name)?.id ?? null;
 }
 export interface IndexPatternAndSavedSearch {
   savedSearch: SavedSearchSavedObject | null;
-  indexPattern: IIndexPattern | null;
+  indexPattern: DataView | null;
 }
 export async function getIndexPatternAndSavedSearch(savedSearchId: string) {
   const resp: IndexPatternAndSavedSearch = {
@@ -106,7 +88,7 @@ export function getQueryFromSavedSearch(savedSearch: SavedSearchSavedObject) {
   };
 }
 
-export function getIndexPatternById(id: string): Promise<IndexPattern> {
+export function getIndexPatternById(id: string): Promise<DataView> {
   if (indexPatternsContract !== null) {
     if (id) {
       return indexPatternsContract.get(id);
@@ -127,7 +109,7 @@ export function getSavedSearchById(id: string): SavedSearchSavedObject | undefin
  * an optional flag will trigger the display a notification at the top of the page
  * warning that the index is not time based
  */
-export function timeBasedIndexCheck(indexPattern: IndexPattern, showNotification = false) {
+export function timeBasedIndexCheck(indexPattern: DataView, showNotification = false) {
   if (!indexPattern.isTimeBased()) {
     if (showNotification) {
       const toastNotifications = getToastNotifications();
diff --git a/x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx b/x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx
index 65d26b844e960e..47be6065aa99b6 100644
--- a/x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx
+++ b/x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx
@@ -21,7 +21,7 @@ import {
   AnomalyChartsEmbeddableOutput,
   AnomalyChartsServices,
 } from '..';
-import type { IndexPattern } from '../../../../../../src/plugins/data/common';
+import type { DataView } from '../../../../../../src/plugins/data_views/common';
 import { EmbeddableLoading } from '../common/components/embeddable_loading_fallback';
 export const getDefaultExplorerChartsPanelTitle = (jobIds: JobId[]) =>
   i18n.translate('xpack.ml.anomalyChartsEmbeddable.title', {
@@ -66,7 +66,7 @@ export class AnomalyChartsEmbeddable extends Embeddable<
       const indices = new Set(jobs.map((j) => j.datafeed_config.indices).flat());
 
       // Then find the index patterns assuming the index pattern title matches the index name
-      const indexPatterns: Record<string, IndexPattern> = {};
+      const indexPatterns: Record<string, DataView> = {};
       for (const indexName of indices) {
         const response = await indexPatternsService.find(`"${indexName}"`);
 
diff --git a/x-pack/plugins/ml/public/embeddables/types.ts b/x-pack/plugins/ml/public/embeddables/types.ts
index 7c93fb31e9a6cb..bf23f397fe08cd 100644
--- a/x-pack/plugins/ml/public/embeddables/types.ts
+++ b/x-pack/plugins/ml/public/embeddables/types.ts
@@ -27,7 +27,7 @@ import {
   ANOMALY_SWIMLANE_EMBEDDABLE_TYPE,
 } from './constants';
 import { MlResultsService } from '../application/services/results_service';
-import { IndexPattern } from '../../../../../src/plugins/data/common';
+import type { DataView } from '../../../../../src/plugins/data_views/common';
 
 export interface AnomalySwimlaneEmbeddableCustomInput {
   jobIds: JobId[];
@@ -110,7 +110,7 @@ export type AnomalyChartsEmbeddableServices = [CoreStart, MlDependencies, Anomal
 export interface AnomalyChartsCustomOutput {
   entityFields?: EntityField[];
   severity?: number;
-  indexPatterns?: IndexPattern[];
+  indexPatterns?: DataView[];
 }
 export type AnomalyChartsEmbeddableOutput = EmbeddableOutput & AnomalyChartsCustomOutput;
 export interface EditAnomalyChartsPanelContext {
diff --git a/x-pack/plugins/ml/server/lib/data_views_utils.ts b/x-pack/plugins/ml/server/lib/data_views_utils.ts
new file mode 100644
index 00000000000000..497404425eff83
--- /dev/null
+++ b/x-pack/plugins/ml/server/lib/data_views_utils.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { IScopedClusterClient, SavedObjectsClientContract } from 'kibana/server';
+
+import type { DataViewsService } from '../../../../../src/plugins/data_views/common';
+import type { PluginStart as DataViewsPluginStart } from '../../../../../src/plugins/data_views/server';
+
+export type GetDataViewsService = () => Promise<DataViewsService>;
+
+export function getDataViewsServiceFactory(
+  getDataViews: () => DataViewsPluginStart | null,
+  savedObjectClient: SavedObjectsClientContract,
+  scopedClient: IScopedClusterClient
+): GetDataViewsService {
+  const dataViews = getDataViews();
+  if (dataViews === null) {
+    throw Error('data views service has not been initialized');
+  }
+
+  return () => dataViews.dataViewsServiceFactory(savedObjectClient, scopedClient.asInternalUser);
+}
diff --git a/x-pack/plugins/ml/server/lib/route_guard.ts b/x-pack/plugins/ml/server/lib/route_guard.ts
index 1a066660d4ee0b..b7b0568c10a312 100644
--- a/x-pack/plugins/ml/server/lib/route_guard.ts
+++ b/x-pack/plugins/ml/server/lib/route_guard.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import {
+import type {
   KibanaRequest,
   KibanaResponseFactory,
   RequestHandlerContext,
@@ -13,14 +13,17 @@ import {
   RequestHandler,
   SavedObjectsClientContract,
 } from 'kibana/server';
-import { SpacesPluginSetup } from '../../../spaces/server';
+import type { SpacesPluginSetup } from '../../../spaces/server';
 import type { SecurityPluginSetup } from '../../../security/server';
 
 import { jobSavedObjectServiceFactory, JobSavedObjectService } from '../saved_objects';
-import { MlLicense } from '../../common/license';
+import type { MlLicense } from '../../common/license';
 
 import { MlClient, getMlClient } from '../lib/ml_client';
 import type { AlertingApiRequestHandlerContext } from '../../../alerting/server';
+import type { PluginStart as DataViewsPluginStart } from '../../../../../src/plugins/data_views/server';
+import type { DataViewsService } from '../../../../../src/plugins/data_views/common';
+import { getDataViewsServiceFactory } from './data_views_utils';
 
 type MLRequestHandlerContext = RequestHandlerContext & {
   alerting?: AlertingApiRequestHandlerContext;
@@ -33,10 +36,12 @@ type Handler<P = unknown, Q = unknown, B = unknown> = (handlerParams: {
   context: MLRequestHandlerContext;
   jobSavedObjectService: JobSavedObjectService;
   mlClient: MlClient;
+  getDataViewsService(): Promise<DataViewsService>;
 }) => ReturnType<RequestHandler<P, Q, B>>;
 
 type GetMlSavedObjectClient = (request: KibanaRequest) => SavedObjectsClientContract | null;
 type GetInternalSavedObjectClient = () => SavedObjectsClientContract | null;
+type GetDataViews = () => DataViewsPluginStart | null;
 
 export class RouteGuard {
   private _mlLicense: MlLicense;
@@ -45,6 +50,7 @@ export class RouteGuard {
   private _spacesPlugin: SpacesPluginSetup | undefined;
   private _authorization: SecurityPluginSetup['authz'] | undefined;
   private _isMlReady: () => Promise<void>;
+  private _getDataViews: GetDataViews;
 
   constructor(
     mlLicense: MlLicense,
@@ -52,7 +58,8 @@ export class RouteGuard {
     getInternalSavedObject: GetInternalSavedObjectClient,
     spacesPlugin: SpacesPluginSetup | undefined,
     authorization: SecurityPluginSetup['authz'] | undefined,
-    isMlReady: () => Promise<void>
+    isMlReady: () => Promise<void>,
+    getDataViews: GetDataViews
   ) {
     this._mlLicense = mlLicense;
     this._getMlSavedObjectClient = getSavedObject;
@@ -60,6 +67,7 @@ export class RouteGuard {
     this._spacesPlugin = spacesPlugin;
     this._authorization = authorization;
     this._isMlReady = isMlReady;
+    this._getDataViews = getDataViews;
   }
 
   public fullLicenseAPIGuard<P, Q, B>(handler: Handler<P, Q, B>) {
@@ -79,6 +87,7 @@ export class RouteGuard {
         return response.forbidden();
       }
 
+      const client = context.core.elasticsearch.client;
       const mlSavedObjectClient = this._getMlSavedObjectClient(request);
       const internalSavedObjectsClient = this._getInternalSavedObjectClient();
       if (mlSavedObjectClient === null || internalSavedObjectsClient === null) {
@@ -94,7 +103,6 @@ export class RouteGuard {
         this._authorization,
         this._isMlReady
       );
-      const client = context.core.elasticsearch.client;
 
       return handler({
         client,
@@ -103,6 +111,11 @@ export class RouteGuard {
         context,
         jobSavedObjectService,
         mlClient: getMlClient(client, jobSavedObjectService),
+        getDataViewsService: getDataViewsServiceFactory(
+          this._getDataViews,
+          context.core.savedObjects.client,
+          client
+        ),
       });
     };
   }
diff --git a/x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts b/x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts
index 15b4cfa5be8b16..568be4197baf8f 100644
--- a/x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts
+++ b/x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts
@@ -5,29 +5,19 @@
  * 2.0.
  */
 
-import { SavedObjectsClientContract } from 'kibana/server';
-import { IndexPatternAttributes } from 'src/plugins/data/server';
+import { DataViewsService } from '../../../../../../src/plugins/data_views/common';
 
 export class IndexPatternHandler {
-  constructor(private savedObjectsClient: SavedObjectsClientContract) {}
+  constructor(private dataViewService: DataViewsService) {}
   // returns a id based on an index pattern name
   async getIndexPatternId(indexName: string) {
-    const response = await this.savedObjectsClient.find<IndexPatternAttributes>({
-      type: 'index-pattern',
-      perPage: 10,
-      search: `"${indexName}"`,
-      searchFields: ['title'],
-      fields: ['title'],
-    });
-
-    const ip = response.saved_objects.find(
-      (obj) => obj.attributes.title.toLowerCase() === indexName.toLowerCase()
+    const dv = (await this.dataViewService.find(indexName)).find(
+      ({ title }) => title === indexName
     );
-
-    return ip?.id;
+    return dv?.id;
   }
 
   async deleteIndexPatternById(indexId: string) {
-    return await this.savedObjectsClient.delete('index-pattern', indexId);
+    return await this.dataViewService.delete(indexId);
   }
 }
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.test.ts b/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.test.ts
index 8ddb805af20338..e853d5de5899d1 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.test.ts
+++ b/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.test.ts
@@ -5,11 +5,16 @@
  * 2.0.
  */
 
-import { SavedObjectsClientContract, KibanaRequest, IScopedClusterClient } from 'kibana/server';
-import { Module } from '../../../common/types/modules';
+import type {
+  SavedObjectsClientContract,
+  KibanaRequest,
+  IScopedClusterClient,
+} from 'kibana/server';
+import type { DataViewsService } from '../../../../../../src/plugins/data_views/common';
+import type { Module } from '../../../common/types/modules';
 import { DataRecognizer } from '../data_recognizer';
 import type { MlClient } from '../../lib/ml_client';
-import { JobSavedObjectService } from '../../saved_objects';
+import type { JobSavedObjectService } from '../../saved_objects';
 
 const callAs = () => Promise.resolve({ body: {} });
 
@@ -28,6 +33,7 @@ describe('ML - data recognizer', () => {
       find: jest.fn(),
       bulkCreate: jest.fn(),
     } as unknown as SavedObjectsClientContract,
+    { find: jest.fn() } as unknown as DataViewsService,
     {} as JobSavedObjectService,
     { headers: { authorization: '' } } as KibanaRequest
   );
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts b/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts
index f9c609803217e4..711ec0d458f277 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts
+++ b/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts
@@ -8,17 +8,21 @@
 import fs from 'fs';
 import Boom from '@hapi/boom';
 import numeral from '@elastic/numeral';
-import { KibanaRequest, IScopedClusterClient, SavedObjectsClientContract } from 'kibana/server';
+import type {
+  KibanaRequest,
+  IScopedClusterClient,
+  SavedObjectsClientContract,
+} from 'kibana/server';
 
 import moment from 'moment';
-import { IndexPatternAttributes } from 'src/plugins/data/server';
 import { merge } from 'lodash';
-import { AnalysisLimits } from '../../../common/types/anomaly_detection_jobs';
+import type { DataViewsService } from '../../../../../../src/plugins/data_views/common';
+import type { AnalysisLimits } from '../../../common/types/anomaly_detection_jobs';
 import { getAuthorizationHeader } from '../../lib/request_authorization';
-import { MlInfoResponse } from '../../../common/types/ml_server_info';
+import type { MlInfoResponse } from '../../../common/types/ml_server_info';
 import type { MlClient } from '../../lib/ml_client';
 import { ML_MODULE_SAVED_OBJECT_TYPE } from '../../../common/types/saved_objects';
-import {
+import type {
   KibanaObjects,
   KibanaObjectConfig,
   ModuleDatafeed,
@@ -35,8 +39,8 @@ import {
   DataRecognizerConfigResponse,
   GeneralDatafeedsOverride,
   JobSpecificOverride,
-  isGeneralJobOverride,
 } from '../../../common/types/modules';
+import { isGeneralJobOverride } from '../../../common/types/modules';
 import {
   getLatestDataOrBucketTimestamp,
   prefixDatafeedId,
@@ -47,10 +51,10 @@ import { calculateModelMemoryLimitProvider } from '../calculate_model_memory_lim
 import { fieldsServiceProvider } from '../fields_service';
 import { jobServiceProvider } from '../job_service';
 import { resultsServiceProvider } from '../results_service';
-import { JobExistResult, JobStat } from '../../../common/types/data_recognizer';
-import { MlJobsStatsResponse } from '../../../common/types/job_service';
-import { Datafeed } from '../../../common/types/anomaly_detection_jobs';
-import { JobSavedObjectService } from '../../saved_objects';
+import type { JobExistResult, JobStat } from '../../../common/types/data_recognizer';
+import type { MlJobsStatsResponse } from '../../../common/types/job_service';
+import type { Datafeed } from '../../../common/types/anomaly_detection_jobs';
+import type { JobSavedObjectService } from '../../saved_objects';
 import { isDefined } from '../../../common/types/guards';
 import { isPopulatedObject } from '../../../common/util/object_utils';
 
@@ -110,6 +114,7 @@ export class DataRecognizer {
   private _mlClient: MlClient;
   private _savedObjectsClient: SavedObjectsClientContract;
   private _jobSavedObjectService: JobSavedObjectService;
+  private _dataViewsService: DataViewsService;
   private _request: KibanaRequest;
 
   private _authorizationHeader: object;
@@ -130,12 +135,14 @@ export class DataRecognizer {
     mlClusterClient: IScopedClusterClient,
     mlClient: MlClient,
     savedObjectsClient: SavedObjectsClientContract,
+    dataViewsService: DataViewsService,
     jobSavedObjectService: JobSavedObjectService,
     request: KibanaRequest
   ) {
     this._client = mlClusterClient;
     this._mlClient = mlClient;
     this._savedObjectsClient = savedObjectsClient;
+    this._dataViewsService = dataViewsService;
     this._jobSavedObjectService = jobSavedObjectService;
     this._request = request;
     this._authorizationHeader = getAuthorizationHeader(request);
@@ -615,22 +622,11 @@ export class DataRecognizer {
     return results;
   }
 
-  private async _loadIndexPatterns() {
-    return await this._savedObjectsClient.find<IndexPatternAttributes>({
-      type: 'index-pattern',
-      perPage: 1000,
-    });
-  }
-
   // returns a id based on an index pattern name
-  private async _getIndexPatternId(name: string) {
+  private async _getIndexPatternId(name: string): Promise<string | undefined> {
     try {
-      const indexPatterns = await this._loadIndexPatterns();
-      if (indexPatterns === undefined || indexPatterns.saved_objects === undefined) {
-        return;
-      }
-      const ip = indexPatterns.saved_objects.find((i) => i.attributes.title === name);
-      return ip !== undefined ? ip.id : undefined;
+      const dataViews = await this._dataViewsService.find(name);
+      return dataViews.find((d) => d.title === name)?.id;
     } catch (error) {
       mlLog.warn(`Error loading index patterns, ${error}`);
       return;
@@ -1387,3 +1383,21 @@ export class DataRecognizer {
     }
   }
 }
+
+export function dataRecognizerFactory(
+  client: IScopedClusterClient,
+  mlClient: MlClient,
+  savedObjectsClient: SavedObjectsClientContract,
+  dataViewsService: DataViewsService,
+  jobSavedObjectService: JobSavedObjectService,
+  request: KibanaRequest
+) {
+  return new DataRecognizer(
+    client,
+    mlClient,
+    savedObjectsClient,
+    dataViewsService,
+    jobSavedObjectService,
+    request
+  );
+}
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/index.ts b/x-pack/plugins/ml/server/models/data_recognizer/index.ts
index 27c45726ae2493..fbddf17a50ede0 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/index.ts
+++ b/x-pack/plugins/ml/server/models/data_recognizer/index.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export { DataRecognizer, RecognizeResult } from './data_recognizer';
+export { DataRecognizer, RecognizeResult, dataRecognizerFactory } from './data_recognizer';
diff --git a/x-pack/plugins/ml/server/models/job_service/new_job_caps/__mocks__/responses/data_view_rollup_cloudwatch.json b/x-pack/plugins/ml/server/models/job_service/new_job_caps/__mocks__/responses/data_view_rollup_cloudwatch.json
new file mode 100644
index 00000000000000..a6aeb814315327
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/job_service/new_job_caps/__mocks__/responses/data_view_rollup_cloudwatch.json
@@ -0,0 +1,151 @@
+[
+  {
+    "id": "d6ac99b0-2777-11ec-8e1c-aba6d0767aaa",
+    "title": "cloud_roll_index",
+    "fieldFormatMap": {},
+    "typeMeta": {
+      "params": {
+        "rollup_index": "cloud_roll_index"
+      },
+      "aggs": {
+        "date_histogram": {
+          "@timestamp": {
+            "agg": "date_histogram",
+            "fixed_interval": "5m",
+            "time_zone": "UTC"
+          }
+        }
+      }
+    },
+    "fields": [
+      {
+        "count": 0,
+        "name": "_source",
+        "type": "_source",
+        "esTypes": [
+          "_source"
+        ],
+        "scripted": false,
+        "searchable": false,
+        "aggregatable": false,
+        "readFromDocValues": false
+      },
+      {
+        "count": 0,
+        "name": "_id",
+        "type": "string",
+        "esTypes": [
+          "_id"
+        ],
+        "scripted": false,
+        "searchable": true,
+        "aggregatable": false,
+        "readFromDocValues": false
+      },
+      {
+        "count": 0,
+        "name": "_type",
+        "type": "string",
+        "scripted": false,
+        "searchable": false,
+        "aggregatable": false,
+        "readFromDocValues": false
+      },
+      {
+        "count": 0,
+        "name": "_index",
+        "type": "string",
+        "esTypes": [
+          "_index"
+        ],
+        "scripted": false,
+        "searchable": true,
+        "aggregatable": true,
+        "readFromDocValues": false
+      },
+      {
+        "count": 0,
+        "name": "_score",
+        "type": "number",
+        "scripted": false,
+        "searchable": false,
+        "aggregatable": false,
+        "readFromDocValues": false
+      },
+      {
+        "count": 0,
+        "name": "@timestamp",
+        "type": "date",
+        "esTypes": [
+          "date"
+        ],
+        "scripted": false,
+        "searchable": true,
+        "aggregatable": true,
+        "readFromDocValues": true
+      }
+    ],
+    "timeFieldName": "@timestamp",
+    "type": "rollup",
+    "metaFields": [
+      "_source",
+      "_id",
+      "_type",
+      "_index",
+      "_score"
+    ],
+    "version": "WzY5NjEsNF0=",
+    "originalSavedObjectBody": {
+      "fieldAttrs": "{}",
+      "title": "cloud_roll_index",
+      "timeFieldName": "@timestamp",
+      "fields": "[]",
+      "type": "rollup",
+      "typeMeta": "{\"params\":{\"rollup_index\":\"cloud_roll_index\"},\"aggs\":{\"date_histogram\":{\"@timestamp\":{\"agg\":\"date_histogram\",\"fixed_interval\":\"5m\",\"time_zone\":\"UTC\"}}}}",
+      "runtimeFieldMap": "{}"
+    },
+    "shortDotsEnable": false,
+    "fieldFormats": {
+      "fieldFormats": {},
+      "defaultMap": {
+        "ip": {
+          "id": "ip",
+          "params": {}
+        },
+        "date": {
+          "id": "date",
+          "params": {}
+        },
+        "date_nanos": {
+          "id": "date_nanos",
+          "params": {},
+          "es": true
+        },
+        "number": {
+          "id": "number",
+          "params": {}
+        },
+        "boolean": {
+          "id": "boolean",
+          "params": {}
+        },
+        "histogram": {
+          "id": "histogram",
+          "params": {}
+        },
+        "_source": {
+          "id": "_source",
+          "params": {}
+        },
+        "_default_": {
+          "id": "string",
+          "params": {}
+        }
+      },
+      "metaParamsOptions": {}
+    },
+    "fieldAttrs": {},
+    "runtimeFieldMap": {},
+    "allowNoIndex": false
+  }
+]
diff --git a/x-pack/plugins/ml/server/models/job_service/new_job_caps/__mocks__/responses/kibana_saved_objects.json b/x-pack/plugins/ml/server/models/job_service/new_job_caps/__mocks__/responses/kibana_saved_objects.json
deleted file mode 100644
index 9e2af762642315..00000000000000
--- a/x-pack/plugins/ml/server/models/job_service/new_job_caps/__mocks__/responses/kibana_saved_objects.json
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  "page": 1,
-  "per_page": 1000,
-  "total": 4,
-  "saved_objects": [
-    {
-      "type": "index-pattern",
-      "id": "be0eebe0-65ac-11e9-aa86-0793be5f3670",
-      "attributes": {
-        "title": "farequote-*"
-      },
-      "references": [],
-      "migrationVersion": {
-        "index-pattern": "6.5.0"
-      },
-      "updated_at": "2019-04-23T09:47:02.203Z",
-      "version": "WzcsMV0="
-    },
-    {
-      "type": "index-pattern",
-      "id": "be14ceb0-66b1-11e9-91c9-ffa52374d341",
-      "attributes": {
-        "typeMeta": "{\"params\":{\"rollup_index\":\"cloud_roll_index\"},\"aggs\":{\"histogram\":{\"NetworkOut\":{\"agg\":\"histogram\",\"interval\":5},\"CPUUtilization\":{\"agg\":\"histogram\",\"interval\":5},\"NetworkIn\":{\"agg\":\"histogram\",\"interval\":5}},\"avg\":{\"NetworkOut\":{\"agg\":\"avg\"},\"CPUUtilization\":{\"agg\":\"avg\"},\"NetworkIn\":{\"agg\":\"avg\"},\"DiskReadBytes\":{\"agg\":\"avg\"}},\"min\":{\"NetworkOut\":{\"agg\":\"min\"},\"NetworkIn\":{\"agg\":\"min\"}},\"value_count\":{\"NetworkOut\":{\"agg\":\"value_count\"},\"DiskReadBytes\":{\"agg\":\"value_count\"},\"CPUUtilization\":{\"agg\":\"value_count\"},\"NetworkIn\":{\"agg\":\"value_count\"}},\"max\":{\"CPUUtilization\":{\"agg\":\"max\"},\"DiskReadBytes\":{\"agg\":\"max\"}},\"date_histogram\":{\"@timestamp\":{\"agg\":\"date_histogram\",\"delay\":\"1d\",\"fixed_interval\":\"5m\",\"time_zone\":\"UTC\"}},\"terms\":{\"instance\":{\"agg\":\"terms\"},\"sourcetype.keyword\":{\"agg\":\"terms\"},\"region\":{\"agg\":\"terms\"}},\"sum\":{\"DiskReadBytes\":{\"agg\":\"sum\"},\"NetworkOut\":{\"agg\":\"sum\"}}}}",
-        "title": "cloud_roll_index",
-        "type": "rollup"
-      },
-      "references": [],
-      "migrationVersion": {
-        "index-pattern": "6.5.0"
-      },
-      "updated_at": "2019-04-24T16:55:20.550Z",
-      "version": "Wzc0LDJd"
-    }
-  ]
-}
diff --git a/x-pack/plugins/ml/server/models/job_service/new_job_caps/field_service.ts b/x-pack/plugins/ml/server/models/job_service/new_job_caps/field_service.ts
index b838165826da15..a25b3183362b36 100644
--- a/x-pack/plugins/ml/server/models/job_service/new_job_caps/field_service.ts
+++ b/x-pack/plugins/ml/server/models/job_service/new_job_caps/field_service.ts
@@ -5,12 +5,12 @@
  * 2.0.
  */
 
-import { estypes } from '@elastic/elasticsearch';
-import { IScopedClusterClient } from 'kibana/server';
 import { cloneDeep } from 'lodash';
-import { SavedObjectsClientContract } from 'kibana/server';
-import { Field, FieldId, NewJobCaps, RollupFields } from '../../../../common/types/fields';
+import { estypes } from '@elastic/elasticsearch';
+import type { IScopedClusterClient } from 'kibana/server';
+import type { Field, FieldId, NewJobCaps, RollupFields } from '../../../../common/types/fields';
 import { ES_FIELD_TYPES } from '../../../../../../../src/plugins/data/common';
+import type { DataViewsService } from '../../../../../../../src/plugins/data_views/common';
 import { combineFieldsAndAggs } from '../../../../common/util/fields_utils';
 import { rollupServiceProvider } from './rollup';
 import { aggregations, mlOnlyAggregations } from '../../../../common/constants/aggregation_types';
@@ -38,27 +38,27 @@ export function fieldServiceProvider(
   indexPattern: string,
   isRollup: boolean,
   client: IScopedClusterClient,
-  savedObjectsClient: SavedObjectsClientContract
+  dataViewsService: DataViewsService
 ) {
-  return new FieldsService(indexPattern, isRollup, client, savedObjectsClient);
+  return new FieldsService(indexPattern, isRollup, client, dataViewsService);
 }
 
 class FieldsService {
   private _indexPattern: string;
   private _isRollup: boolean;
   private _mlClusterClient: IScopedClusterClient;
-  private _savedObjectsClient: SavedObjectsClientContract;
+  private _dataViewsService: DataViewsService;
 
   constructor(
     indexPattern: string,
     isRollup: boolean,
     client: IScopedClusterClient,
-    savedObjectsClient: SavedObjectsClientContract
+    dataViewsService: DataViewsService
   ) {
     this._indexPattern = indexPattern;
     this._isRollup = isRollup;
     this._mlClusterClient = client;
-    this._savedObjectsClient = savedObjectsClient;
+    this._dataViewsService = dataViewsService;
   }
 
   private async loadFieldCaps(): Promise<any> {
@@ -111,7 +111,7 @@ class FieldsService {
       const rollupService = await rollupServiceProvider(
         this._indexPattern,
         this._mlClusterClient,
-        this._savedObjectsClient
+        this._dataViewsService
       );
       const rollupConfigs: estypes.RollupGetRollupCapabilitiesRollupCapabilitySummary[] | null =
         await rollupService.getRollupJobs();
diff --git a/x-pack/plugins/ml/server/models/job_service/new_job_caps/new_job_caps.test.ts b/x-pack/plugins/ml/server/models/job_service/new_job_caps/new_job_caps.test.ts
index 3eb2ba5bbaced3..c0f270f1df96c2 100644
--- a/x-pack/plugins/ml/server/models/job_service/new_job_caps/new_job_caps.test.ts
+++ b/x-pack/plugins/ml/server/models/job_service/new_job_caps/new_job_caps.test.ts
@@ -10,7 +10,7 @@ import { newJobCapsProvider } from './index';
 import farequoteFieldCaps from './__mocks__/responses/farequote_field_caps.json';
 import cloudwatchFieldCaps from './__mocks__/responses/cloudwatch_field_caps.json';
 import rollupCaps from './__mocks__/responses/rollup_caps.json';
-import kibanaSavedObjects from './__mocks__/responses/kibana_saved_objects.json';
+import dataView from './__mocks__/responses/data_view_rollup_cloudwatch.json';
 
 import farequoteJobCaps from './__mocks__/results/farequote_job_caps.json';
 import farequoteJobCapsEmpty from './__mocks__/results/farequote_job_caps_empty.json';
@@ -19,7 +19,7 @@ import cloudwatchJobCaps from './__mocks__/results/cloudwatch_rollup_job_caps.js
 describe('job_service - job_caps', () => {
   let mlClusterClientNonRollupMock: any;
   let mlClusterClientRollupMock: any;
-  let savedObjectsClientMock: any;
+  let dataViews: any;
 
   beforeEach(() => {
     const asNonRollupMock = {
@@ -41,9 +41,9 @@ describe('job_service - job_caps', () => {
       asInternalUser: callAsRollupMock,
     };
 
-    savedObjectsClientMock = {
+    dataViews = {
       async find() {
-        return Promise.resolve(kibanaSavedObjects);
+        return Promise.resolve(dataView);
       },
     };
   });
@@ -53,7 +53,7 @@ describe('job_service - job_caps', () => {
       const indexPattern = 'farequote-*';
       const isRollup = false;
       const { newJobCaps } = newJobCapsProvider(mlClusterClientNonRollupMock);
-      const response = await newJobCaps(indexPattern, isRollup, savedObjectsClientMock);
+      const response = await newJobCaps(indexPattern, isRollup, dataViews);
       expect(response).toEqual(farequoteJobCaps);
     });
 
@@ -61,7 +61,7 @@ describe('job_service - job_caps', () => {
       const indexPattern = 'farequote-*';
       const isRollup = true;
       const { newJobCaps } = newJobCapsProvider(mlClusterClientNonRollupMock);
-      const response = await newJobCaps(indexPattern, isRollup, savedObjectsClientMock);
+      const response = await newJobCaps(indexPattern, isRollup, dataViews);
       expect(response).toEqual(farequoteJobCapsEmpty);
     });
   });
@@ -71,7 +71,7 @@ describe('job_service - job_caps', () => {
       const indexPattern = 'cloud_roll_index';
       const isRollup = true;
       const { newJobCaps } = newJobCapsProvider(mlClusterClientRollupMock);
-      const response = await newJobCaps(indexPattern, isRollup, savedObjectsClientMock);
+      const response = await newJobCaps(indexPattern, isRollup, dataViews);
       expect(response).toEqual(cloudwatchJobCaps);
     });
 
@@ -79,7 +79,7 @@ describe('job_service - job_caps', () => {
       const indexPattern = 'cloud_roll_index';
       const isRollup = false;
       const { newJobCaps } = newJobCapsProvider(mlClusterClientRollupMock);
-      const response = await newJobCaps(indexPattern, isRollup, savedObjectsClientMock);
+      const response = await newJobCaps(indexPattern, isRollup, dataViews);
       expect(response).not.toEqual(cloudwatchJobCaps);
     });
   });
diff --git a/x-pack/plugins/ml/server/models/job_service/new_job_caps/new_job_caps.ts b/x-pack/plugins/ml/server/models/job_service/new_job_caps/new_job_caps.ts
index 6444f9ae3f61a2..bab4fb31aa1a98 100644
--- a/x-pack/plugins/ml/server/models/job_service/new_job_caps/new_job_caps.ts
+++ b/x-pack/plugins/ml/server/models/job_service/new_job_caps/new_job_caps.ts
@@ -5,18 +5,19 @@
  * 2.0.
  */
 
-import { IScopedClusterClient, SavedObjectsClientContract } from 'kibana/server';
+import type { IScopedClusterClient } from 'kibana/server';
+import type { DataViewsService } from '../../../../../../../src/plugins/data_views/common';
+import type { Aggregation, Field, NewJobCapsResponse } from '../../../../common/types/fields';
 import { _DOC_COUNT } from '../../../../common/constants/field_types';
-import { Aggregation, Field, NewJobCapsResponse } from '../../../../common/types/fields';
 import { fieldServiceProvider } from './field_service';
 
 export function newJobCapsProvider(client: IScopedClusterClient) {
   async function newJobCaps(
     indexPattern: string,
     isRollup: boolean = false,
-    savedObjectsClient: SavedObjectsClientContract
+    dataViewsService: DataViewsService
   ): Promise<NewJobCapsResponse> {
-    const fieldService = fieldServiceProvider(indexPattern, isRollup, client, savedObjectsClient);
+    const fieldService = fieldServiceProvider(indexPattern, isRollup, client, dataViewsService);
     const { aggs, fields } = await fieldService.getData();
     convertForStringify(aggs, fields);
 
diff --git a/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts b/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts
index 72408b7f9c5346..87504a1bc0e10a 100644
--- a/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts
+++ b/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts
@@ -6,11 +6,12 @@
  */
 
 import { estypes } from '@elastic/elasticsearch';
-import { IScopedClusterClient } from 'kibana/server';
-import { SavedObject } from 'kibana/server';
-import { IndexPatternAttributes } from 'src/plugins/data/server';
-import { SavedObjectsClientContract } from 'kibana/server';
-import { RollupFields } from '../../../../common/types/fields';
+import type { IScopedClusterClient } from 'kibana/server';
+import type {
+  DataViewsService,
+  DataView,
+} from '../../../../../../../src/plugins/data_views/common';
+import type { RollupFields } from '../../../../common/types/fields';
 
 export interface RollupJob {
   job_id: string;
@@ -22,17 +23,19 @@ export interface RollupJob {
 export async function rollupServiceProvider(
   indexPattern: string,
   { asCurrentUser }: IScopedClusterClient,
-  savedObjectsClient: SavedObjectsClientContract
+  dataViewsService: DataViewsService
 ) {
-  const rollupIndexPatternObject = await loadRollupIndexPattern(indexPattern, savedObjectsClient);
+  const rollupIndexPatternObject = await loadRollupIndexPattern(indexPattern, dataViewsService);
   let jobIndexPatterns: string[] = [indexPattern];
 
   async function getRollupJobs(): Promise<
     estypes.RollupGetRollupCapabilitiesRollupCapabilitySummary[] | null
   > {
-    if (rollupIndexPatternObject !== null) {
-      const parsedTypeMetaData = JSON.parse(rollupIndexPatternObject.attributes.typeMeta!);
-      const rollUpIndex: string = parsedTypeMetaData.params.rollup_index;
+    if (
+      rollupIndexPatternObject !== null &&
+      rollupIndexPatternObject.typeMeta?.params !== undefined
+    ) {
+      const rollUpIndex: string = rollupIndexPatternObject.typeMeta.params.rollup_index;
       const { body: rollupCaps } = await asCurrentUser.rollup.getRollupIndexCaps({
         index: rollUpIndex,
       });
@@ -60,21 +63,12 @@ export async function rollupServiceProvider(
 
 async function loadRollupIndexPattern(
   indexPattern: string,
-  savedObjectsClient: SavedObjectsClientContract
-): Promise<SavedObject<IndexPatternAttributes> | null> {
-  const resp = await savedObjectsClient.find<IndexPatternAttributes>({
-    type: 'index-pattern',
-    fields: ['title', 'type', 'typeMeta'],
-    perPage: 1000,
-  });
-
-  const obj = resp.saved_objects.find(
-    (r) =>
-      r.attributes &&
-      r.attributes.type === 'rollup' &&
-      r.attributes.title === indexPattern &&
-      r.attributes.typeMeta !== undefined
+  dataViewsService: DataViewsService
+): Promise<DataView | null> {
+  const resp = await dataViewsService.find('*', 10000);
+  const obj = resp.find(
+    (dv) => dv.type === 'rollup' && dv.title === indexPattern && dv.typeMeta !== undefined
   );
 
-  return obj || null;
+  return obj ?? null;
 }
diff --git a/x-pack/plugins/ml/server/plugin.ts b/x-pack/plugins/ml/server/plugin.ts
index 3876193cfbe392..efa61593655ac7 100644
--- a/x-pack/plugins/ml/server/plugin.ts
+++ b/x-pack/plugins/ml/server/plugin.ts
@@ -6,7 +6,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import {
+import type {
   CoreSetup,
   CoreStart,
   Plugin,
@@ -21,10 +21,11 @@ import {
 } from 'kibana/server';
 import type { SecurityPluginSetup } from '../../security/server';
 import { DEFAULT_APP_CATEGORIES } from '../../../../src/core/server';
-import { PluginsSetup, PluginsStart, RouteInitialization } from './types';
-import { SpacesPluginSetup } from '../../spaces/server';
+import type { PluginStart as DataViewsPluginStart } from '../../../../src/plugins/data_views/server';
+import type { PluginsSetup, PluginsStart, RouteInitialization } from './types';
+import type { SpacesPluginSetup } from '../../spaces/server';
 import { PLUGIN_ID } from '../common/constants/app';
-import { MlCapabilities } from '../common/types/capabilities';
+import type { MlCapabilities } from '../common/types/capabilities';
 
 import { initMlServerLog } from './lib/log';
 import { initSampleDataSets } from './lib/sample_data_sets';
@@ -78,6 +79,7 @@ export class MlServerPlugin
   private savedObjectsStart: SavedObjectsServiceStart | null = null;
   private spacesPlugin: SpacesPluginSetup | undefined;
   private security: SecurityPluginSetup | undefined;
+  private dataViews: DataViewsPluginStart | null = null;
   private isMlReady: Promise<void>;
   private setMlReady: () => void = () => {};
   private readonly kibanaIndexConfig: SharedGlobalConfig;
@@ -156,7 +158,8 @@ export class MlServerPlugin
         getInternalSavedObjectsClient,
         plugins.spaces,
         plugins.security?.authz,
-        () => this.isMlReady
+        () => this.isMlReady,
+        () => this.dataViews
       ),
       mlLicense: this.mlLicense,
     };
@@ -173,6 +176,13 @@ export class MlServerPlugin
       ? () => coreSetup.getStartServices().then(([, { spaces }]) => spaces!)
       : undefined;
 
+    const getDataViews = () => {
+      if (this.dataViews === null) {
+        throw Error('Data views plugin not initialized');
+      }
+      return this.dataViews;
+    };
+
     annotationRoutes(routeInit, plugins.security);
     calendars(routeInit);
     dataFeedRoutes(routeInit);
@@ -211,6 +221,7 @@ export class MlServerPlugin
       () => getInternalSavedObjectsClient(),
       () => this.uiSettings,
       () => this.fieldsFormat,
+      getDataViews,
       () => this.isMlReady
     );
 
@@ -236,6 +247,7 @@ export class MlServerPlugin
     this.capabilities = coreStart.capabilities;
     this.clusterClient = coreStart.elasticsearch.client;
     this.savedObjectsStart = coreStart.savedObjects;
+    this.dataViews = plugins.dataViews;
 
     // check whether the job saved objects exist
     // and create them if needed.
diff --git a/x-pack/plugins/ml/server/routes/data_frame_analytics.ts b/x-pack/plugins/ml/server/routes/data_frame_analytics.ts
index bedc70566a62f0..bbfcc0fd5e500a 100644
--- a/x-pack/plugins/ml/server/routes/data_frame_analytics.ts
+++ b/x-pack/plugins/ml/server/routes/data_frame_analytics.ts
@@ -5,12 +5,12 @@
  * 2.0.
  */
 
-import { RequestHandlerContext, IScopedClusterClient } from 'kibana/server';
+import type { IScopedClusterClient } from 'kibana/server';
 import { wrapError } from '../client/error_wrapper';
 import { analyticsAuditMessagesProvider } from '../models/data_frame_analytics/analytics_audit_messages';
-import { RouteInitialization } from '../types';
+import type { RouteInitialization } from '../types';
 import { JOB_MAP_NODE_TYPES } from '../../common/constants/data_frame_analytics';
-import { Field, Aggregation } from '../../common/types/fields';
+import type { Field, Aggregation } from '../../common/types/fields';
 import {
   dataAnalyticsJobConfigSchema,
   dataAnalyticsJobUpdateSchema,
@@ -25,22 +25,26 @@ import {
   analyticsNewJobCapsParamsSchema,
   analyticsNewJobCapsQuerySchema,
 } from './schemas/data_analytics_schema';
-import { GetAnalyticsMapArgs, ExtendAnalyticsMapArgs } from '../models/data_frame_analytics/types';
+import type {
+  GetAnalyticsMapArgs,
+  ExtendAnalyticsMapArgs,
+} from '../models/data_frame_analytics/types';
 import { IndexPatternHandler } from '../models/data_frame_analytics/index_patterns';
 import { AnalyticsManager } from '../models/data_frame_analytics/analytics_manager';
 import { validateAnalyticsJob } from '../models/data_frame_analytics/validation';
 import { fieldServiceProvider } from '../models/job_service/new_job_caps/field_service';
-import { DeleteDataFrameAnalyticsWithIndexStatus } from '../../common/types/data_frame_analytics';
+import type { DeleteDataFrameAnalyticsWithIndexStatus } from '../../common/types/data_frame_analytics';
 import { getAuthorizationHeader } from '../lib/request_authorization';
 import type { MlClient } from '../lib/ml_client';
+import type { DataViewsService } from '../../../../../src/plugins/data_views/common';
 
-function getIndexPatternId(context: RequestHandlerContext, patternName: string) {
-  const iph = new IndexPatternHandler(context.core.savedObjects.client);
+function getIndexPatternId(dataViewsService: DataViewsService, patternName: string) {
+  const iph = new IndexPatternHandler(dataViewsService);
   return iph.getIndexPatternId(patternName);
 }
 
-function deleteDestIndexPatternById(context: RequestHandlerContext, indexPatternId: string) {
-  const iph = new IndexPatternHandler(context.core.savedObjects.client);
+function deleteDestIndexPatternById(dataViewsService: DataViewsService, indexPatternId: string) {
+  const iph = new IndexPatternHandler(dataViewsService);
   return iph.deleteIndexPatternById(indexPatternId);
 }
 
@@ -374,86 +378,89 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense, routeGuard }: Rout
         tags: ['access:ml:canDeleteDataFrameAnalytics'],
       },
     },
-    routeGuard.fullLicenseAPIGuard(async ({ mlClient, client, request, response, context }) => {
-      try {
-        const { analyticsId } = request.params;
-        const { deleteDestIndex, deleteDestIndexPattern } = request.query;
-        let destinationIndex: string | undefined;
-        const analyticsJobDeleted: DeleteDataFrameAnalyticsWithIndexStatus = { success: false };
-        const destIndexDeleted: DeleteDataFrameAnalyticsWithIndexStatus = { success: false };
-        const destIndexPatternDeleted: DeleteDataFrameAnalyticsWithIndexStatus = {
-          success: false,
-        };
-
+    routeGuard.fullLicenseAPIGuard(
+      async ({ mlClient, client, request, response, getDataViewsService }) => {
         try {
-          // Check if analyticsId is valid and get destination index
-          const { body } = await mlClient.getDataFrameAnalytics({
-            id: analyticsId,
-          });
-          if (Array.isArray(body.data_frame_analytics) && body.data_frame_analytics.length > 0) {
-            destinationIndex = body.data_frame_analytics[0].dest.index;
+          const { analyticsId } = request.params;
+          const { deleteDestIndex, deleteDestIndexPattern } = request.query;
+          let destinationIndex: string | undefined;
+          const analyticsJobDeleted: DeleteDataFrameAnalyticsWithIndexStatus = { success: false };
+          const destIndexDeleted: DeleteDataFrameAnalyticsWithIndexStatus = { success: false };
+          const destIndexPatternDeleted: DeleteDataFrameAnalyticsWithIndexStatus = {
+            success: false,
+          };
+
+          try {
+            // Check if analyticsId is valid and get destination index
+            const { body } = await mlClient.getDataFrameAnalytics({
+              id: analyticsId,
+            });
+            if (Array.isArray(body.data_frame_analytics) && body.data_frame_analytics.length > 0) {
+              destinationIndex = body.data_frame_analytics[0].dest.index;
+            }
+          } catch (e) {
+            // exist early if the job doesn't exist
+            return response.customError(wrapError(e));
           }
-        } catch (e) {
-          // exist early if the job doesn't exist
-          return response.customError(wrapError(e));
-        }
 
-        if (deleteDestIndex || deleteDestIndexPattern) {
-          // If user checks box to delete the destinationIndex associated with the job
-          if (destinationIndex && deleteDestIndex) {
-            // Verify if user has privilege to delete the destination index
-            const userCanDeleteDestIndex = await userCanDeleteIndex(client, destinationIndex);
-            // If user does have privilege to delete the index, then delete the index
-            if (userCanDeleteDestIndex) {
-              try {
-                await client.asCurrentUser.indices.delete({
-                  index: destinationIndex,
-                });
-                destIndexDeleted.success = true;
-              } catch ({ body }) {
-                destIndexDeleted.error = body;
+          if (deleteDestIndex || deleteDestIndexPattern) {
+            // If user checks box to delete the destinationIndex associated with the job
+            if (destinationIndex && deleteDestIndex) {
+              // Verify if user has privilege to delete the destination index
+              const userCanDeleteDestIndex = await userCanDeleteIndex(client, destinationIndex);
+              // If user does have privilege to delete the index, then delete the index
+              if (userCanDeleteDestIndex) {
+                try {
+                  await client.asCurrentUser.indices.delete({
+                    index: destinationIndex,
+                  });
+                  destIndexDeleted.success = true;
+                } catch ({ body }) {
+                  destIndexDeleted.error = body;
+                }
+              } else {
+                return response.forbidden();
               }
-            } else {
-              return response.forbidden();
             }
-          }
 
-          // Delete the index pattern if there's an index pattern that matches the name of dest index
-          if (destinationIndex && deleteDestIndexPattern) {
-            try {
-              const indexPatternId = await getIndexPatternId(context, destinationIndex);
-              if (indexPatternId) {
-                await deleteDestIndexPatternById(context, indexPatternId);
+            // Delete the index pattern if there's an index pattern that matches the name of dest index
+            if (destinationIndex && deleteDestIndexPattern) {
+              try {
+                const dataViewsService = await getDataViewsService();
+                const indexPatternId = await getIndexPatternId(dataViewsService, destinationIndex);
+                if (indexPatternId) {
+                  await deleteDestIndexPatternById(dataViewsService, indexPatternId);
+                }
+                destIndexPatternDeleted.success = true;
+              } catch (deleteDestIndexPatternError) {
+                destIndexPatternDeleted.error = deleteDestIndexPatternError;
               }
-              destIndexPatternDeleted.success = true;
-            } catch (deleteDestIndexPatternError) {
-              destIndexPatternDeleted.error = deleteDestIndexPatternError;
             }
           }
-        }
-        // Grab the target index from the data frame analytics job id
-        // Delete the data frame analytics
+          // Grab the target index from the data frame analytics job id
+          // Delete the data frame analytics
 
-        try {
-          await mlClient.deleteDataFrameAnalytics({
-            id: analyticsId,
+          try {
+            await mlClient.deleteDataFrameAnalytics({
+              id: analyticsId,
+            });
+            analyticsJobDeleted.success = true;
+          } catch ({ body }) {
+            analyticsJobDeleted.error = body;
+          }
+          const results = {
+            analyticsJobDeleted,
+            destIndexDeleted,
+            destIndexPatternDeleted,
+          };
+          return response.ok({
+            body: results,
           });
-          analyticsJobDeleted.success = true;
-        } catch ({ body }) {
-          analyticsJobDeleted.error = body;
+        } catch (e) {
+          return response.customError(wrapError(e));
         }
-        const results = {
-          analyticsJobDeleted,
-          destIndexDeleted,
-          destIndexPatternDeleted,
-        };
-        return response.ok({
-          body: results,
-        });
-      } catch (e) {
-        return response.customError(wrapError(e));
       }
-    })
+    )
   );
 
   /**
@@ -716,17 +723,12 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense, routeGuard }: Rout
         tags: ['access:ml:canGetJobs'],
       },
     },
-    routeGuard.fullLicenseAPIGuard(async ({ client, request, response, context }) => {
+    routeGuard.fullLicenseAPIGuard(async ({ client, request, response, getDataViewsService }) => {
       try {
         const { indexPattern } = request.params;
         const isRollup = request.query?.rollup === 'true';
-        const savedObjectsClient = context.core.savedObjects.client;
-        const fieldService = fieldServiceProvider(
-          indexPattern,
-          isRollup,
-          client,
-          savedObjectsClient
-        );
+        const dataViewsService = await getDataViewsService();
+        const fieldService = fieldServiceProvider(indexPattern, isRollup, client, dataViewsService);
         const { fields, aggs } = await fieldService.getData(true);
         convertForStringify(aggs, fields);
 
diff --git a/x-pack/plugins/ml/server/routes/job_service.ts b/x-pack/plugins/ml/server/routes/job_service.ts
index da115a224d19ec..15b0b4449590cb 100644
--- a/x-pack/plugins/ml/server/routes/job_service.ts
+++ b/x-pack/plugins/ml/server/routes/job_service.ts
@@ -8,7 +8,7 @@
 import { estypes } from '@elastic/elasticsearch';
 import { schema } from '@kbn/config-schema';
 import { wrapError } from '../client/error_wrapper';
-import { RouteInitialization } from '../types';
+import type { RouteInitialization } from '../types';
 import {
   categorizationFieldExamplesSchema,
   basicChartSchema,
@@ -32,7 +32,7 @@ import { jobIdSchema } from './schemas/anomaly_detectors_schema';
 import { jobServiceProvider } from '../models/job_service';
 import { categorizationExamplesProvider } from '../models/job_service/new_job';
 import { getAuthorizationHeader } from '../lib/request_authorization';
-import { Datafeed, Job } from '../../common/types/anomaly_detection_jobs';
+import type { Datafeed, Job } from '../../common/types/anomaly_detection_jobs';
 
 /**
  * Routes for job service
@@ -535,21 +535,24 @@ export function jobServiceRoutes({ router, routeGuard }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    routeGuard.fullLicenseAPIGuard(async ({ client, mlClient, request, response, context }) => {
-      try {
-        const { indexPattern } = request.params;
-        const isRollup = request.query?.rollup === 'true';
-        const savedObjectsClient = context.core.savedObjects.client;
-        const { newJobCaps } = jobServiceProvider(client, mlClient);
-        const resp = await newJobCaps(indexPattern, isRollup, savedObjectsClient);
-
-        return response.ok({
-          body: resp,
-        });
-      } catch (e) {
-        return response.customError(wrapError(e));
+    routeGuard.fullLicenseAPIGuard(
+      async ({ client, mlClient, request, response, getDataViewsService }) => {
+        try {
+          const { indexPattern } = request.params;
+          const isRollup = request.query?.rollup === 'true';
+          const { newJobCaps } = jobServiceProvider(client, mlClient);
+
+          const dataViewsService = await getDataViewsService();
+          const resp = await newJobCaps(indexPattern, isRollup, dataViewsService);
+
+          return response.ok({
+            body: resp,
+          });
+        } catch (e) {
+          return response.customError(wrapError(e));
+        }
       }
-    })
+    )
   );
 
   /**
diff --git a/x-pack/plugins/ml/server/routes/modules.ts b/x-pack/plugins/ml/server/routes/modules.ts
index 097f3f8d676527..d814e91f70ca01 100644
--- a/x-pack/plugins/ml/server/routes/modules.ts
+++ b/x-pack/plugins/ml/server/routes/modules.ts
@@ -5,19 +5,24 @@
  * 2.0.
  */
 
-import { TypeOf } from '@kbn/config-schema';
+import type { TypeOf } from '@kbn/config-schema';
 
-import { IScopedClusterClient, KibanaRequest, SavedObjectsClientContract } from 'kibana/server';
-import { DatafeedOverride, JobOverride } from '../../common/types/modules';
+import type {
+  IScopedClusterClient,
+  KibanaRequest,
+  SavedObjectsClientContract,
+} from 'kibana/server';
+import type { DataViewsService } from '../../../../../src/plugins/data_views/common';
+import type { DatafeedOverride, JobOverride } from '../../common/types/modules';
 import { wrapError } from '../client/error_wrapper';
-import { DataRecognizer } from '../models/data_recognizer';
+import { dataRecognizerFactory } from '../models/data_recognizer';
 import {
   moduleIdParamSchema,
   optionalModuleIdParamSchema,
   modulesIndexPatternTitleSchema,
   setupModuleBodySchema,
 } from './schemas/modules';
-import { RouteInitialization } from '../types';
+import type { RouteInitialization } from '../types';
 import type { MlClient } from '../lib/ml_client';
 import type { JobSavedObjectService } from '../saved_objects';
 
@@ -25,14 +30,16 @@ function recognize(
   client: IScopedClusterClient,
   mlClient: MlClient,
   savedObjectsClient: SavedObjectsClientContract,
+  dataViewsService: DataViewsService,
   jobSavedObjectService: JobSavedObjectService,
   request: KibanaRequest,
   indexPatternTitle: string
 ) {
-  const dr = new DataRecognizer(
+  const dr = dataRecognizerFactory(
     client,
     mlClient,
     savedObjectsClient,
+    dataViewsService,
     jobSavedObjectService,
     request
   );
@@ -43,14 +50,16 @@ function getModule(
   client: IScopedClusterClient,
   mlClient: MlClient,
   savedObjectsClient: SavedObjectsClientContract,
+  dataViewsService: DataViewsService,
   jobSavedObjectService: JobSavedObjectService,
   request: KibanaRequest,
   moduleId?: string
 ) {
-  const dr = new DataRecognizer(
+  const dr = dataRecognizerFactory(
     client,
     mlClient,
     savedObjectsClient,
+    dataViewsService,
     jobSavedObjectService,
     request
   );
@@ -65,6 +74,7 @@ function setup(
   client: IScopedClusterClient,
   mlClient: MlClient,
   savedObjectsClient: SavedObjectsClientContract,
+  dataViewsService: DataViewsService,
   jobSavedObjectService: JobSavedObjectService,
   request: KibanaRequest,
   moduleId: string,
@@ -81,10 +91,11 @@ function setup(
   estimateModelMemory?: boolean,
   applyToAllSpaces?: boolean
 ) {
-  const dr = new DataRecognizer(
+  const dr = dataRecognizerFactory(
     client,
     mlClient,
     savedObjectsClient,
+    dataViewsService,
     jobSavedObjectService,
     request
   );
@@ -109,14 +120,16 @@ function dataRecognizerJobsExist(
   client: IScopedClusterClient,
   mlClient: MlClient,
   savedObjectsClient: SavedObjectsClientContract,
+  dataViewsService: DataViewsService,
   jobSavedObjectService: JobSavedObjectService,
   request: KibanaRequest,
   moduleId: string
 ) {
-  const dr = new DataRecognizer(
+  const dr = dataRecognizerFactory(
     client,
     mlClient,
     savedObjectsClient,
+    dataViewsService,
     jobSavedObjectService,
     request
   );
@@ -166,13 +179,23 @@ export function dataRecognizer({ router, routeGuard }: RouteInitialization) {
       },
     },
     routeGuard.fullLicenseAPIGuard(
-      async ({ client, mlClient, request, response, context, jobSavedObjectService }) => {
+      async ({
+        client,
+        mlClient,
+        request,
+        response,
+        context,
+        jobSavedObjectService,
+        getDataViewsService,
+      }) => {
         try {
           const { indexPatternTitle } = request.params;
+          const dataViewService = await getDataViewsService();
           const results = await recognize(
             client,
             mlClient,
             context.core.savedObjects.client,
+            dataViewService,
             jobSavedObjectService,
             request,
             indexPatternTitle
@@ -305,7 +328,15 @@ export function dataRecognizer({ router, routeGuard }: RouteInitialization) {
       },
     },
     routeGuard.fullLicenseAPIGuard(
-      async ({ client, mlClient, request, response, context, jobSavedObjectService }) => {
+      async ({
+        client,
+        mlClient,
+        request,
+        response,
+        context,
+        jobSavedObjectService,
+        getDataViewsService,
+      }) => {
         try {
           let { moduleId } = request.params;
           if (moduleId === '') {
@@ -313,10 +344,12 @@ export function dataRecognizer({ router, routeGuard }: RouteInitialization) {
             // the moduleId will be an empty string.
             moduleId = undefined;
           }
+          const dataViewService = await getDataViewsService();
           const results = await getModule(
             client,
             mlClient,
             context.core.savedObjects.client,
+            dataViewService,
             jobSavedObjectService,
             request,
             moduleId
@@ -482,7 +515,15 @@ export function dataRecognizer({ router, routeGuard }: RouteInitialization) {
       },
     },
     routeGuard.fullLicenseAPIGuard(
-      async ({ client, mlClient, request, response, context, jobSavedObjectService }) => {
+      async ({
+        client,
+        mlClient,
+        request,
+        response,
+        context,
+        jobSavedObjectService,
+        getDataViewsService,
+      }) => {
         try {
           const { moduleId } = request.params;
 
@@ -501,10 +542,13 @@ export function dataRecognizer({ router, routeGuard }: RouteInitialization) {
             applyToAllSpaces,
           } = request.body as TypeOf<typeof setupModuleBodySchema>;
 
+          const dataViewService = await getDataViewsService();
+
           const result = await setup(
             client,
             mlClient,
             context.core.savedObjects.client,
+            dataViewService,
             jobSavedObjectService,
             request,
             moduleId,
@@ -593,13 +637,23 @@ export function dataRecognizer({ router, routeGuard }: RouteInitialization) {
       },
     },
     routeGuard.fullLicenseAPIGuard(
-      async ({ client, mlClient, request, response, context, jobSavedObjectService }) => {
+      async ({
+        client,
+        mlClient,
+        request,
+        response,
+        context,
+        jobSavedObjectService,
+        getDataViewsService,
+      }) => {
         try {
           const { moduleId } = request.params;
+          const dataViewService = await getDataViewsService();
           const result = await dataRecognizerJobsExist(
             client,
             mlClient,
             context.core.savedObjects.client,
+            dataViewService,
             jobSavedObjectService,
             request,
             moduleId
diff --git a/x-pack/plugins/ml/server/shared_services/providers/modules.ts b/x-pack/plugins/ml/server/shared_services/providers/modules.ts
index c86a40e4224ce5..f6a6c58fadb4ef 100644
--- a/x-pack/plugins/ml/server/shared_services/providers/modules.ts
+++ b/x-pack/plugins/ml/server/shared_services/providers/modules.ts
@@ -5,13 +5,12 @@
  * 2.0.
  */
 
-import { IScopedClusterClient, KibanaRequest, SavedObjectsClientContract } from 'kibana/server';
-import { TypeOf } from '@kbn/config-schema';
-import { DataRecognizer } from '../../models/data_recognizer';
-import { GetGuards } from '../shared_services';
+import type { KibanaRequest, SavedObjectsClientContract } from 'kibana/server';
+import type { TypeOf } from '@kbn/config-schema';
+import type { PluginStart as DataViewsPluginStart } from '../../../../../../src/plugins/data_views/server';
+import type { GetGuards } from '../shared_services';
+import { DataRecognizer, dataRecognizerFactory } from '../../models/data_recognizer';
 import { moduleIdParamSchema, setupModuleBodySchema } from '../../routes/schemas/modules';
-import { MlClient } from '../../lib/ml_client';
-import { JobSavedObjectService } from '../../saved_objects';
 
 export type ModuleSetupPayload = TypeOf<typeof moduleIdParamSchema> &
   TypeOf<typeof setupModuleBodySchema>;
@@ -28,7 +27,10 @@ export interface ModulesProvider {
   };
 }
 
-export function getModulesProvider(getGuards: GetGuards): ModulesProvider {
+export function getModulesProvider(
+  getGuards: GetGuards,
+  getDataViews: () => DataViewsPluginStart
+): ModulesProvider {
   return {
     modulesProvider(request: KibanaRequest, savedObjectsClient: SavedObjectsClientContract) {
       return {
@@ -36,11 +38,13 @@ export function getModulesProvider(getGuards: GetGuards): ModulesProvider {
           return await getGuards(request, savedObjectsClient)
             .isFullLicense()
             .hasMlCapabilities(['canGetJobs'])
-            .ok(async ({ scopedClient, mlClient, jobSavedObjectService }) => {
+            .ok(async ({ scopedClient, mlClient, jobSavedObjectService, getDataViewsService }) => {
+              const dataViewsService = await getDataViewsService();
               const dr = dataRecognizerFactory(
                 scopedClient,
                 mlClient,
                 savedObjectsClient,
+                dataViewsService,
                 jobSavedObjectService,
                 request
               );
@@ -51,11 +55,13 @@ export function getModulesProvider(getGuards: GetGuards): ModulesProvider {
           return await getGuards(request, savedObjectsClient)
             .isFullLicense()
             .hasMlCapabilities(['canGetJobs'])
-            .ok(async ({ scopedClient, mlClient, jobSavedObjectService }) => {
+            .ok(async ({ scopedClient, mlClient, jobSavedObjectService, getDataViewsService }) => {
+              const dataViewsService = await getDataViewsService();
               const dr = dataRecognizerFactory(
                 scopedClient,
                 mlClient,
                 savedObjectsClient,
+                dataViewsService,
                 jobSavedObjectService,
                 request
               );
@@ -66,11 +72,13 @@ export function getModulesProvider(getGuards: GetGuards): ModulesProvider {
           return await getGuards(request, savedObjectsClient)
             .isFullLicense()
             .hasMlCapabilities(['canGetJobs'])
-            .ok(async ({ scopedClient, mlClient, jobSavedObjectService }) => {
+            .ok(async ({ scopedClient, mlClient, jobSavedObjectService, getDataViewsService }) => {
+              const dataViewsService = await getDataViewsService();
               const dr = dataRecognizerFactory(
                 scopedClient,
                 mlClient,
                 savedObjectsClient,
+                dataViewsService,
                 jobSavedObjectService,
                 request
               );
@@ -81,11 +89,13 @@ export function getModulesProvider(getGuards: GetGuards): ModulesProvider {
           return await getGuards(request, savedObjectsClient)
             .isFullLicense()
             .hasMlCapabilities(['canCreateJob'])
-            .ok(async ({ scopedClient, mlClient, jobSavedObjectService }) => {
+            .ok(async ({ scopedClient, mlClient, jobSavedObjectService, getDataViewsService }) => {
+              const dataViewsService = await getDataViewsService();
               const dr = dataRecognizerFactory(
                 scopedClient,
                 mlClient,
                 savedObjectsClient,
+                dataViewsService,
                 jobSavedObjectService,
                 request
               );
@@ -109,13 +119,3 @@ export function getModulesProvider(getGuards: GetGuards): ModulesProvider {
     },
   };
 }
-
-function dataRecognizerFactory(
-  client: IScopedClusterClient,
-  mlClient: MlClient,
-  savedObjectsClient: SavedObjectsClientContract,
-  jobSavedObjectService: JobSavedObjectService,
-  request: KibanaRequest
-) {
-  return new DataRecognizer(client, mlClient, savedObjectsClient, jobSavedObjectService, request);
-}
diff --git a/x-pack/plugins/ml/server/shared_services/shared_services.ts b/x-pack/plugins/ml/server/shared_services/shared_services.ts
index 5c8bbffe10aedd..9c8ab1e069258c 100644
--- a/x-pack/plugins/ml/server/shared_services/shared_services.ts
+++ b/x-pack/plugins/ml/server/shared_services/shared_services.ts
@@ -5,17 +5,18 @@
  * 2.0.
  */
 
-import {
+import type {
   IClusterClient,
   IScopedClusterClient,
   SavedObjectsClientContract,
   UiSettingsServiceStart,
 } from 'kibana/server';
-import { SpacesPluginStart } from '../../../spaces/server';
+import type { SpacesPluginStart } from '../../../spaces/server';
 import { KibanaRequest } from '../../.././../../src/core/server';
 import { MlLicense } from '../../common/license';
 
 import type { CloudSetup } from '../../../cloud/server';
+import type { PluginStart as DataViewsPluginStart } from '../../../../../src/plugins/data_views/server';
 import type { SecurityPluginSetup } from '../../../security/server';
 import { licenseChecks } from './license_checks';
 import { MlSystemProvider, getMlSystemProvider } from './providers/system';
@@ -26,7 +27,7 @@ import {
   AnomalyDetectorsProvider,
   getAnomalyDetectorsProvider,
 } from './providers/anomaly_detectors';
-import { ResolveMlCapabilities, MlCapabilitiesKey } from '../../common/types/capabilities';
+import type { ResolveMlCapabilities, MlCapabilitiesKey } from '../../common/types/capabilities';
 import { hasMlCapabilitiesProvider, HasMlCapabilities } from '../lib/capabilities';
 import {
   MLClusterClientUninitialized,
@@ -45,6 +46,7 @@ import {
 } from '../lib/alerts/jobs_health_service';
 import type { FieldFormatsStart } from '../../../../../src/plugins/field_formats/server';
 import type { FieldFormatsRegistryProvider } from '../../common/types/kibana';
+import { getDataViewsServiceFactory, GetDataViewsService } from '../lib/data_views_utils';
 
 export type SharedServices = JobServiceProvider &
   AnomalyDetectorsProvider &
@@ -76,6 +78,7 @@ interface OkParams {
   mlClient: MlClient;
   jobSavedObjectService: JobSavedObjectService;
   getFieldsFormatRegistry: FieldFormatsRegistryProvider;
+  getDataViewsService: GetDataViewsService;
 }
 
 type OkCallback = (okParams: OkParams) => any;
@@ -90,6 +93,7 @@ export function createSharedServices(
   getInternalSavedObjectsClient: () => SavedObjectsClientContract | null,
   getUiSettings: () => UiSettingsServiceStart | null,
   getFieldsFormat: () => FieldFormatsStart | null,
+  getDataViews: () => DataViewsPluginStart,
   isMlReady: () => Promise<void>
 ): {
   sharedServicesProviders: SharedServices;
@@ -101,6 +105,7 @@ export function createSharedServices(
     savedObjectsClient: SavedObjectsClientContract
   ): Guards {
     const internalSavedObjectsClient = getInternalSavedObjectsClient();
+
     if (internalSavedObjectsClient === null) {
       throw new Error('Internal saved object client not initialized');
     }
@@ -113,7 +118,8 @@ export function createSharedServices(
       getSpaces !== undefined,
       isMlReady,
       getUiSettings,
-      getFieldsFormat
+      getFieldsFormat,
+      getDataViews
     );
 
     const {
@@ -122,6 +128,7 @@ export function createSharedServices(
       mlClient,
       jobSavedObjectService,
       getFieldsFormatRegistry,
+      getDataViewsService,
     } = getRequestItems(request);
     const asyncGuards: Array<Promise<void>> = [];
 
@@ -140,7 +147,13 @@ export function createSharedServices(
       },
       async ok(callback: OkCallback) {
         await Promise.all(asyncGuards);
-        return callback({ scopedClient, mlClient, jobSavedObjectService, getFieldsFormatRegistry });
+        return callback({
+          scopedClient,
+          mlClient,
+          jobSavedObjectService,
+          getFieldsFormatRegistry,
+          getDataViewsService,
+        });
       },
     };
     return guards;
@@ -153,7 +166,7 @@ export function createSharedServices(
     sharedServicesProviders: {
       ...getJobServiceProvider(getGuards),
       ...getAnomalyDetectorsProvider(getGuards),
-      ...getModulesProvider(getGuards),
+      ...getModulesProvider(getGuards, getDataViews),
       ...getResultsServiceProvider(getGuards),
       ...getMlSystemProvider(getGuards, mlLicense, getSpaces, cloud, resolveMlCapabilities),
       ...getAlertingServiceProvider(getGuards),
@@ -176,7 +189,8 @@ function getRequestItemsProvider(
   spaceEnabled: boolean,
   isMlReady: () => Promise<void>,
   getUiSettings: () => UiSettingsServiceStart | null,
-  getFieldsFormat: () => FieldFormatsStart | null
+  getFieldsFormat: () => FieldFormatsStart | null,
+  getDataViews: () => DataViewsPluginStart
 ) {
   return (request: KibanaRequest) => {
     const getHasMlCapabilities = hasMlCapabilitiesProvider(resolveMlCapabilities);
@@ -234,12 +248,20 @@ function getRequestItemsProvider(
       };
       mlClient = getMlClient(scopedClient, jobSavedObjectService);
     }
+
+    const getDataViewsService = getDataViewsServiceFactory(
+      getDataViews,
+      savedObjectsClient,
+      scopedClient
+    );
+
     return {
       hasMlCapabilities,
       scopedClient,
       mlClient,
       jobSavedObjectService,
       getFieldsFormatRegistry,
+      getDataViewsService,
     };
   };
 }
diff --git a/x-pack/plugins/ml/server/types.ts b/x-pack/plugins/ml/server/types.ts
index da83b03766af4a..d5c67bf99a7a0d 100644
--- a/x-pack/plugins/ml/server/types.ts
+++ b/x-pack/plugins/ml/server/types.ts
@@ -23,6 +23,7 @@ import type {
   PluginSetup as DataPluginSetup,
   PluginStart as DataPluginStart,
 } from '../../../../src/plugins/data/server';
+import type { PluginStart as DataViewsPluginStart } from '../../../../src/plugins/data_views/server';
 import type {
   FieldFormatsSetup,
   FieldFormatsStart,
@@ -64,6 +65,7 @@ export interface PluginsSetup {
 
 export interface PluginsStart {
   data: DataPluginStart;
+  dataViews: DataViewsPluginStart;
   fieldFormats: FieldFormatsStart;
   spaces?: SpacesPluginStart;
 }
diff --git a/x-pack/plugins/ml/tsconfig.json b/x-pack/plugins/ml/tsconfig.json
index db8fc463b05508..0c108f8b3b8a50 100644
--- a/x-pack/plugins/ml/tsconfig.json
+++ b/x-pack/plugins/ml/tsconfig.json
@@ -21,6 +21,7 @@
     { "path": "../../../src/core/tsconfig.json" },
     { "path": "../../../src/plugins/embeddable/tsconfig.json" },
     { "path": "../../../src/plugins/index_pattern_management/tsconfig.json" },
+    { "path": "../../../src/plugins/data_views/tsconfig.json" },
     { "path": "../cloud/tsconfig.json" },
     { "path": "../features/tsconfig.json" },
     { "path": "../data_visualizer/tsconfig.json"},

From 877e00786d5458db746371db7442aec0bd5617cd Mon Sep 17 00:00:00 2001
From: Kaarina Tungseth <kaarina.tungseth@elastic.co>
Date: Wed, 13 Oct 2021 13:37:21 -0500
Subject: [PATCH 21/71] [DOCS] Removes capitalized attributes (#114849)

---
 docs/index.asciidoc | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/docs/index.asciidoc b/docs/index.asciidoc
index e286e42f2c4210..f9ed2abc4b8cfa 100644
--- a/docs/index.asciidoc
+++ b/docs/index.asciidoc
@@ -13,12 +13,8 @@ include::{docs-root}/shared/versions/stack/{source_branch}.asciidoc[]
 :es-docker-image: {es-docker-repo}:{version}
 :blob:            {kib-repo}blob/{branch}/
 :security-ref:    https://www.elastic.co/community/security/
-:Data-Sources:    Data Views
-:Data-source:     Data view
 :data-source:     data view
-:Data-sources:    Data views
 :data-sources:    data views
-:A-data-source:   A data view
 :a-data-source:   a data view
 
 include::{docs-root}/shared/attributes.asciidoc[]

From b96f5443d60fe802b0a0f0e6cc680a9288724ed8 Mon Sep 17 00:00:00 2001
From: Kerry Gallagher <471693+Kerry350@users.noreply.github.com>
Date: Wed, 13 Oct 2021 19:39:52 +0100
Subject: [PATCH 22/71] [RAC] Change index bootstrapping strategy (#113389)

* Change index bootstrapping to cater for non-additive changes only
---
 x-pack/plugins/rule_registry/server/config.ts |   5 +-
 x-pack/plugins/rule_registry/server/plugin.ts |   1 -
 .../rule_data_client/rule_data_client.ts      | 147 ++++++++++++------
 .../server/rule_data_client/types.ts          |   2 +-
 .../server/rule_data_plugin_service/errors.ts |  14 ++
 .../resource_installer.ts                     |  71 +++------
 .../rule_data_plugin_service.ts               |   3 +-
 7 files changed, 138 insertions(+), 105 deletions(-)

diff --git a/x-pack/plugins/rule_registry/server/config.ts b/x-pack/plugins/rule_registry/server/config.ts
index 62f29a9e06294f..f112a99e59eaa2 100644
--- a/x-pack/plugins/rule_registry/server/config.ts
+++ b/x-pack/plugins/rule_registry/server/config.ts
@@ -9,7 +9,10 @@ import { schema, TypeOf } from '@kbn/config-schema';
 import { PluginConfigDescriptor } from 'src/core/server';
 
 export const config: PluginConfigDescriptor = {
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
+  deprecations: ({ deprecate, unused }) => [
+    deprecate('enabled', '8.0.0'),
+    unused('unsafe.indexUpgrade.enabled'),
+  ],
   schema: schema.object({
     enabled: schema.boolean({ defaultValue: true }),
     write: schema.object({
diff --git a/x-pack/plugins/rule_registry/server/plugin.ts b/x-pack/plugins/rule_registry/server/plugin.ts
index 5d1994cfd3e6db..b68f3eeb10669e 100644
--- a/x-pack/plugins/rule_registry/server/plugin.ts
+++ b/x-pack/plugins/rule_registry/server/plugin.ts
@@ -104,7 +104,6 @@ export class RuleRegistryPlugin
       logger,
       kibanaVersion,
       isWriteEnabled: isWriteEnabled(this.config, this.legacyConfig),
-      isIndexUpgradeEnabled: this.config.unsafe.indexUpgrade.enabled,
       getClusterClient: async () => {
         const deps = await startDependencies;
         return deps.core.elasticsearch.client.asInternalUser;
diff --git a/x-pack/plugins/rule_registry/server/rule_data_client/rule_data_client.ts b/x-pack/plugins/rule_registry/server/rule_data_client/rule_data_client.ts
index 89ae479132de5b..2755021e235a87 100644
--- a/x-pack/plugins/rule_registry/server/rule_data_client/rule_data_client.ts
+++ b/x-pack/plugins/rule_registry/server/rule_data_client/rule_data_client.ts
@@ -5,13 +5,18 @@
  * 2.0.
  */
 
+import { BulkRequest } from '@elastic/elasticsearch/api/types';
 import { ResponseError } from '@elastic/elasticsearch/lib/errors';
 import { Either, isLeft } from 'fp-ts/lib/Either';
 
 import { ElasticsearchClient } from 'kibana/server';
+import { Logger } from 'kibana/server';
 import { IndexPatternsFetcher } from '../../../../../src/plugins/data/server';
 
-import { RuleDataWriteDisabledError } from '../rule_data_plugin_service/errors';
+import {
+  RuleDataWriteDisabledError,
+  RuleDataWriterInitializationError,
+} from '../rule_data_plugin_service/errors';
 import { IndexInfo } from '../rule_data_plugin_service/index_info';
 import { ResourceInstaller } from '../rule_data_plugin_service/resource_installer';
 import { IRuleDataClient, IRuleDataReader, IRuleDataWriter } from './types';
@@ -22,12 +27,21 @@ interface ConstructorOptions {
   isWriteEnabled: boolean;
   waitUntilReadyForReading: Promise<WaitResult>;
   waitUntilReadyForWriting: Promise<WaitResult>;
+  logger: Logger;
 }
 
 export type WaitResult = Either<Error, ElasticsearchClient>;
 
 export class RuleDataClient implements IRuleDataClient {
-  constructor(private readonly options: ConstructorOptions) {}
+  private _isWriteEnabled: boolean = false;
+
+  // Writers cached by namespace
+  private writerCache: Map<string, IRuleDataWriter>;
+
+  constructor(private readonly options: ConstructorOptions) {
+    this.writeEnabled = this.options.isWriteEnabled;
+    this.writerCache = new Map();
+  }
 
   public get indexName(): string {
     return this.options.indexInfo.baseName;
@@ -37,8 +51,16 @@ export class RuleDataClient implements IRuleDataClient {
     return this.options.indexInfo.kibanaVersion;
   }
 
+  private get writeEnabled(): boolean {
+    return this._isWriteEnabled;
+  }
+
+  private set writeEnabled(isEnabled: boolean) {
+    this._isWriteEnabled = isEnabled;
+  }
+
   public isWriteEnabled(): boolean {
-    return this.options.isWriteEnabled;
+    return this.writeEnabled;
   }
 
   public getReader(options: { namespace?: string } = {}): IRuleDataReader {
@@ -95,62 +117,89 @@ export class RuleDataClient implements IRuleDataClient {
   }
 
   public getWriter(options: { namespace?: string } = {}): IRuleDataWriter {
-    const { indexInfo, resourceInstaller } = this.options;
-
     const namespace = options.namespace || 'default';
+    const cachedWriter = this.writerCache.get(namespace);
+
+    // There is no cached writer, so we'll install / update the namespace specific resources now.
+    if (!cachedWriter) {
+      const writerForNamespace = this.initializeWriter(namespace);
+      this.writerCache.set(namespace, writerForNamespace);
+      return writerForNamespace;
+    } else {
+      return cachedWriter;
+    }
+  }
+
+  private initializeWriter(namespace: string): IRuleDataWriter {
+    const isWriteEnabled = () => this.writeEnabled;
+    const turnOffWrite = () => (this.writeEnabled = false);
+
+    const { indexInfo, resourceInstaller } = this.options;
     const alias = indexInfo.getPrimaryAlias(namespace);
-    const isWriteEnabled = this.isWriteEnabled();
 
-    const waitUntilReady = async () => {
-      const result = await this.options.waitUntilReadyForWriting;
-      if (isLeft(result)) {
-        throw result.left;
+    // Wait until both index and namespace level resources have been installed / updated.
+    const prepareForWriting = async () => {
+      if (!isWriteEnabled()) {
+        throw new RuleDataWriteDisabledError();
+      }
+
+      const indexLevelResourcesResult = await this.options.waitUntilReadyForWriting;
+
+      if (isLeft(indexLevelResourcesResult)) {
+        throw new RuleDataWriterInitializationError(
+          'index',
+          indexInfo.indexOptions.registrationContext,
+          indexLevelResourcesResult.left
+        );
       } else {
-        return result.right;
+        try {
+          await resourceInstaller.installAndUpdateNamespaceLevelResources(indexInfo, namespace);
+          return indexLevelResourcesResult.right;
+        } catch (e) {
+          throw new RuleDataWriterInitializationError(
+            'namespace',
+            indexInfo.indexOptions.registrationContext,
+            e
+          );
+        }
       }
     };
 
-    return {
-      bulk: async (request) => {
-        if (!isWriteEnabled) {
-          throw new RuleDataWriteDisabledError();
-        }
+    const prepareForWritingResult = prepareForWriting();
 
-        const clusterClient = await waitUntilReady();
+    return {
+      bulk: async (request: BulkRequest) => {
+        return prepareForWritingResult
+          .then((clusterClient) => {
+            const requestWithDefaultParameters = {
+              ...request,
+              require_alias: true,
+              index: alias,
+            };
 
-        const requestWithDefaultParameters = {
-          ...request,
-          require_alias: true,
-          index: alias,
-        };
-
-        return clusterClient.bulk(requestWithDefaultParameters).then((response) => {
-          if (response.body.errors) {
-            if (
-              response.body.items.length > 0 &&
-              (response.body.items.every(
-                (item) => item.index?.error?.type === 'index_not_found_exception'
-              ) ||
-                response.body.items.every(
-                  (item) => item.index?.error?.type === 'illegal_argument_exception'
-                ))
-            ) {
-              return resourceInstaller
-                .installNamespaceLevelResources(indexInfo, namespace)
-                .then(() => {
-                  return clusterClient.bulk(requestWithDefaultParameters).then((retryResponse) => {
-                    if (retryResponse.body.errors) {
-                      throw new ResponseError(retryResponse);
-                    }
-                    return retryResponse;
-                  });
-                });
+            return clusterClient.bulk(requestWithDefaultParameters).then((response) => {
+              if (response.body.errors) {
+                const error = new ResponseError(response);
+                throw error;
+              }
+              return response;
+            });
+          })
+          .catch((error) => {
+            if (error instanceof RuleDataWriterInitializationError) {
+              this.options.logger.error(error);
+              this.options.logger.error(
+                `The writer for the Rule Data Client for the ${indexInfo.indexOptions.registrationContext} registration context was not initialized properly, bulk() cannot continue, and writing will be disabled.`
+              );
+              turnOffWrite();
+            } else if (error instanceof RuleDataWriteDisabledError) {
+              this.options.logger.debug(`Writing is disabled, bulk() will not write any data.`);
+            } else {
+              this.options.logger.error(error);
             }
-            const error = new ResponseError(response);
-            throw error;
-          }
-          return response;
-        });
+
+            return undefined;
+          });
       },
     };
   }
diff --git a/x-pack/plugins/rule_registry/server/rule_data_client/types.ts b/x-pack/plugins/rule_registry/server/rule_data_client/types.ts
index 0595dbeea6dc61..7c05945a98b10e 100644
--- a/x-pack/plugins/rule_registry/server/rule_data_client/types.ts
+++ b/x-pack/plugins/rule_registry/server/rule_data_client/types.ts
@@ -35,5 +35,5 @@ export interface IRuleDataReader {
 }
 
 export interface IRuleDataWriter {
-  bulk(request: BulkRequest): Promise<ApiResponse<BulkResponse>>;
+  bulk(request: BulkRequest): Promise<ApiResponse<BulkResponse> | undefined>;
 }
diff --git a/x-pack/plugins/rule_registry/server/rule_data_plugin_service/errors.ts b/x-pack/plugins/rule_registry/server/rule_data_plugin_service/errors.ts
index cb5dcf8e8ae763..fe8d3b3b18d9dd 100644
--- a/x-pack/plugins/rule_registry/server/rule_data_plugin_service/errors.ts
+++ b/x-pack/plugins/rule_registry/server/rule_data_plugin_service/errors.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+/* eslint-disable max-classes-per-file */
 export class RuleDataWriteDisabledError extends Error {
   constructor(message?: string) {
     super(message);
@@ -12,3 +13,16 @@ export class RuleDataWriteDisabledError extends Error {
     this.name = 'RuleDataWriteDisabledError';
   }
 }
+
+export class RuleDataWriterInitializationError extends Error {
+  constructor(
+    resourceType: 'index' | 'namespace',
+    registrationContext: string,
+    error: string | Error
+  ) {
+    super(`There has been a catastrophic error trying to install ${resourceType} level resources for the following registration context: ${registrationContext}. 
+    This may have been due to a non-additive change to the mappings, removal and type changes are not permitted. Full error: ${error.toString()}`);
+    Object.setPrototypeOf(this, new.target.prototype);
+    this.name = 'RuleDataWriterInitializationError';
+  }
+}
diff --git a/x-pack/plugins/rule_registry/server/rule_data_plugin_service/resource_installer.ts b/x-pack/plugins/rule_registry/server/rule_data_plugin_service/resource_installer.ts
index e10bb6382ab247..160261642ff25c 100644
--- a/x-pack/plugins/rule_registry/server/rule_data_plugin_service/resource_installer.ts
+++ b/x-pack/plugins/rule_registry/server/rule_data_plugin_service/resource_installer.ts
@@ -20,7 +20,6 @@ import { ecsComponentTemplate } from '../../common/assets/component_templates/ec
 import { defaultLifecyclePolicy } from '../../common/assets/lifecycle_policies/default_lifecycle_policy';
 
 import { IndexInfo } from './index_info';
-import { incrementIndexName } from './utils';
 
 const INSTALLATION_TIMEOUT = 20 * 60 * 1000; // 20 minutes
 
@@ -29,7 +28,6 @@ interface ConstructorOptions {
   getClusterClient: () => Promise<ElasticsearchClient>;
   logger: Logger;
   isWriteEnabled: boolean;
-  isIndexUpgradeEnabled: boolean;
 }
 
 export class ResourceInstaller {
@@ -111,12 +109,10 @@ export class ResourceInstaller {
    * Installs index-level resources shared between all namespaces of this index:
    *   - custom ILM policy if it was provided
    *   - component templates
-   *   - attempts to update mappings of existing concrete indices
    */
   public async installIndexLevelResources(indexInfo: IndexInfo): Promise<void> {
     await this.installWithTimeout(`resources for index ${indexInfo.baseName}`, async () => {
       const { componentTemplates, ilmPolicy } = indexInfo.indexOptions;
-      const { isIndexUpgradeEnabled } = this.options;
 
       if (ilmPolicy != null) {
         await this.createOrUpdateLifecyclePolicy({
@@ -139,35 +135,30 @@ export class ResourceInstaller {
           });
         })
       );
-
-      if (isIndexUpgradeEnabled) {
-        // TODO: Update all existing namespaced index templates matching this index' base name
-
-        await this.updateIndexMappings(indexInfo);
-      }
     });
   }
 
-  private async updateIndexMappings(indexInfo: IndexInfo) {
+  private async updateIndexMappings(indexInfo: IndexInfo, namespace: string) {
     const { logger } = this.options;
 
     const aliases = indexInfo.basePattern;
-    const backingIndices = indexInfo.getPatternForBackingIndices();
+    const backingIndices = indexInfo.getPatternForBackingIndices(namespace);
 
     logger.debug(`Updating mappings of existing concrete indices for ${indexInfo.baseName}`);
 
     // Find all concrete indices for all namespaces of the index.
     const concreteIndices = await this.fetchConcreteIndices(aliases, backingIndices);
-    const concreteWriteIndices = concreteIndices.filter((item) => item.isWriteIndex);
-
-    // Update mappings of the found write indices.
-    await Promise.all(concreteWriteIndices.map((item) => this.updateAliasWriteIndexMapping(item)));
+    // Update mappings of the found indices.
+    await Promise.all(concreteIndices.map((item) => this.updateAliasWriteIndexMapping(item)));
   }
 
+  // NOTE / IMPORTANT: Please note this will update the mappings of backing indices but
+  // *not* the settings. This is due to the fact settings can be classed as dynamic and static,
+  // and static updates will fail on an index that isn't closed. New settings *will* be applied as part
+  // of the ILM policy rollovers. More info: https://github.com/elastic/kibana/pull/113389#issuecomment-940152654
   private async updateAliasWriteIndexMapping({ index, alias }: ConcreteIndexInfo) {
     const { logger, getClusterClient } = this.options;
     const clusterClient = await getClusterClient();
-
     const simulatedIndexMapping = await clusterClient.indices.simulateIndexTemplate({
       name: index,
     });
@@ -180,35 +171,8 @@ export class ResourceInstaller {
       });
       return;
     } catch (err) {
-      if (err.meta?.body?.error?.type !== 'illegal_argument_exception') {
-        /**
-         * We skip the rollover if we catch anything except for illegal_argument_exception - that's the error
-         * returned by ES when the mapping update contains a conflicting field definition (e.g., a field changes types).
-         * We expect to get that error for some mapping changes we might make, and in those cases,
-         * we want to continue to rollover the index. Other errors are unexpected.
-         */
-        logger.error(`Failed to PUT mapping for alias ${alias}: ${err.message}`);
-        return;
-      }
-      const newIndexName = incrementIndexName(index);
-      if (newIndexName == null) {
-        logger.error(`Failed to increment write index name for alias: ${alias}`);
-        return;
-      }
-      try {
-        await clusterClient.indices.rollover({
-          alias,
-          new_index: newIndexName,
-        });
-      } catch (e) {
-        /**
-         * If we catch resource_already_exists_exception, that means that the index has been
-         * rolled over already — nothing to do for us in this case.
-         */
-        if (e?.meta?.body?.error?.type !== 'resource_already_exists_exception') {
-          logger.error(`Failed to rollover index for alias ${alias}: ${e.message}`);
-        }
-      }
+      logger.error(`Failed to PUT mapping for alias ${alias}: ${err.message}`);
+      throw err;
     }
   }
 
@@ -216,11 +180,12 @@ export class ResourceInstaller {
   // Namespace-level resources
 
   /**
-   * Installs resources tied to concrete namespace of an index:
+   * Installs and updates resources tied to concrete namespace of an index:
    *   - namespaced index template
+   *   - Index mappings for existing concrete indices
    *   - concrete index (write target) if it doesn't exist
    */
-  public async installNamespaceLevelResources(
+  public async installAndUpdateNamespaceLevelResources(
     indexInfo: IndexInfo,
     namespace: string
   ): Promise<void> {
@@ -230,15 +195,19 @@ export class ResourceInstaller {
 
     logger.info(`Installing namespace-level resources and creating concrete index for ${alias}`);
 
+    // Install / update the index template
+    await this.installNamespacedIndexTemplate(indexInfo, namespace);
+    // Update index mappings for indices matching this namespace.
+    await this.updateIndexMappings(indexInfo, namespace);
+
     // If we find a concrete backing index which is the write index for the alias here, we shouldn't
     // be making a new concrete index. We return early because we don't need a new write target.
     const indexExists = await this.checkIfConcreteWriteIndexExists(indexInfo, namespace);
     if (indexExists) {
       return;
+    } else {
+      await this.createConcreteWriteIndex(indexInfo, namespace);
     }
-
-    await this.installNamespacedIndexTemplate(indexInfo, namespace);
-    await this.createConcreteWriteIndex(indexInfo, namespace);
   }
 
   private async checkIfConcreteWriteIndexExists(
diff --git a/x-pack/plugins/rule_registry/server/rule_data_plugin_service/rule_data_plugin_service.ts b/x-pack/plugins/rule_registry/server/rule_data_plugin_service/rule_data_plugin_service.ts
index c69677b091c9cf..0617bc0a820ac8 100644
--- a/x-pack/plugins/rule_registry/server/rule_data_plugin_service/rule_data_plugin_service.ts
+++ b/x-pack/plugins/rule_registry/server/rule_data_plugin_service/rule_data_plugin_service.ts
@@ -22,7 +22,6 @@ interface ConstructorOptions {
   logger: Logger;
   kibanaVersion: string;
   isWriteEnabled: boolean;
-  isIndexUpgradeEnabled: boolean;
 }
 
 /**
@@ -44,7 +43,6 @@ export class RuleDataPluginService {
       getClusterClient: options.getClusterClient,
       logger: options.logger,
       isWriteEnabled: options.isWriteEnabled,
-      isIndexUpgradeEnabled: options.isIndexUpgradeEnabled,
     });
 
     this.installCommonResources = Promise.resolve(right('ok'));
@@ -154,6 +152,7 @@ export class RuleDataPluginService {
       isWriteEnabled: this.isWriteEnabled(),
       waitUntilReadyForReading,
       waitUntilReadyForWriting,
+      logger: this.options.logger,
     });
   }
 

From 8d1c96cd7efcdfa732413b88c65e8132b6e7682e Mon Sep 17 00:00:00 2001
From: Scotty Bollinger <scotty.bollinger@elastic.co>
Date: Wed, 13 Oct 2021 13:44:50 -0500
Subject: [PATCH 23/71] [Workplace Search] Add Synchronize button to Source
 Overview page (#114842)

* Add sync route

* Add logic for triggering sync on server

* Add button with confirm modal and description w/links
---
 .../applications/shared/constants/actions.ts  |  5 ++
 .../components/overview.test.tsx              | 16 +++-
 .../content_sources/components/overview.tsx   | 80 ++++++++++++++++++-
 .../views/content_sources/constants.ts        | 43 ++++++++++
 .../content_sources/source_logic.test.ts      | 28 +++++++
 .../views/content_sources/source_logic.ts     | 11 +++
 .../routes/workplace_search/sources.test.ts   | 24 ++++++
 .../server/routes/workplace_search/sources.ts | 20 +++++
 8 files changed, 222 insertions(+), 5 deletions(-)

diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/constants/actions.ts b/x-pack/plugins/enterprise_search/public/applications/shared/constants/actions.ts
index cb05311e119987..d43217fba1443e 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/constants/actions.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/constants/actions.ts
@@ -35,6 +35,11 @@ export const CANCEL_BUTTON_LABEL = i18n.translate(
   { defaultMessage: 'Cancel' }
 );
 
+export const START_BUTTON_LABEL = i18n.translate(
+  'xpack.enterpriseSearch.actions.startButtonLabel',
+  { defaultMessage: 'Start' }
+);
+
 export const CONTINUE_BUTTON_LABEL = i18n.translate(
   'xpack.enterpriseSearch.actions.continueButtonLabel',
   { defaultMessage: 'Continue' }
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/overview.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/overview.test.tsx
index d99eac5de74e5a..c9eb2e0afdf5eb 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/overview.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/overview.test.tsx
@@ -5,20 +5,21 @@
  * 2.0.
  */
 
-import { setMockValues } from '../../../../__mocks__/kea_logic';
+import { setMockValues, setMockActions } from '../../../../__mocks__/kea_logic';
 import { fullContentSources } from '../../../__mocks__/content_sources.mock';
 
 import React from 'react';
 
 import { shallow } from 'enzyme';
 
-import { EuiEmptyPrompt, EuiPanel, EuiTable } from '@elastic/eui';
+import { EuiConfirmModal, EuiEmptyPrompt, EuiPanel, EuiTable } from '@elastic/eui';
 
 import { ComponentLoader } from '../../../components/shared/component_loader';
 
 import { Overview } from './overview';
 
 describe('Overview', () => {
+  const initializeSourceSynchronization = jest.fn();
   const contentSource = fullContentSources[0];
   const dataLoading = false;
   const isOrganization = true;
@@ -31,6 +32,7 @@ describe('Overview', () => {
 
   beforeEach(() => {
     setMockValues({ ...mockValues });
+    setMockActions({ initializeSourceSynchronization });
   });
 
   it('renders', () => {
@@ -118,4 +120,14 @@ describe('Overview', () => {
 
     expect(wrapper.find('[data-test-subj="DocumentPermissionsDisabled"]')).toHaveLength(1);
   });
+
+  it('handles confirmModal submission', () => {
+    const wrapper = shallow(<Overview />);
+    const button = wrapper.find('[data-test-subj="SyncButton"]');
+    button.prop('onClick')!({} as any);
+    const modal = wrapper.find(EuiConfirmModal);
+    modal.prop('onConfirm')!({} as any);
+
+    expect(initializeSourceSynchronization).toHaveBeenCalled();
+  });
 });
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/overview.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/overview.tsx
index a4fe0329e6c420..899d9dceebe3ec 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/overview.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/overview.tsx
@@ -5,11 +5,13 @@
  * 2.0.
  */
 
-import React from 'react';
+import React, { useState } from 'react';
 
-import { useValues } from 'kea';
+import { useValues, useActions } from 'kea';
 
 import {
+  EuiButton,
+  EuiConfirmModal,
   EuiEmptyPrompt,
   EuiFlexGroup,
   EuiFlexItem,
@@ -30,7 +32,8 @@ import {
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 
-import { EuiListGroupItemTo } from '../../../../shared/react_router_helpers';
+import { CANCEL_BUTTON_LABEL, START_BUTTON_LABEL } from '../../../../shared/constants';
+import { EuiListGroupItemTo, EuiLinkTo } from '../../../../shared/react_router_helpers';
 import { AppLogic } from '../../../app_logic';
 import aclImage from '../../../assets/supports_acl.svg';
 import { ComponentLoader } from '../../../components/shared/component_loader';
@@ -48,7 +51,10 @@ import {
   DOCUMENT_PERMISSIONS_DOCS_URL,
   ENT_SEARCH_LICENSE_MANAGEMENT,
   EXTERNAL_IDENTITIES_DOCS_URL,
+  SYNC_FREQUENCY_PATH,
+  BLOCKED_TIME_WINDOWS_PATH,
   getGroupPath,
+  getContentSourcePath,
 } from '../../../routes';
 import {
   SOURCES_NO_CONTENT_TITLE,
@@ -77,6 +83,12 @@ import {
   LEARN_CUSTOM_FEATURES_BUTTON,
   DOC_PERMISSIONS_DESCRIPTION,
   CUSTOM_CALLOUT_TITLE,
+  SOURCE_SYNCHRONIZATION_TITLE,
+  SOURCE_SYNC_FREQUENCY_LINK_LABEL,
+  SOURCE_BLOCKED_TIME_WINDOWS_LINK_LABEL,
+  SOURCE_SYNCHRONIZATION_BUTTON_LABEL,
+  SOURCE_SYNC_CONFIRM_TITLE,
+  SOURCE_SYNC_CONFIRM_MESSAGE,
 } from '../constants';
 import { SourceLogic } from '../source_logic';
 
@@ -84,6 +96,7 @@ import { SourceLayout } from './source_layout';
 
 export const Overview: React.FC = () => {
   const { contentSource } = useValues(SourceLogic);
+  const { initializeSourceSynchronization } = useActions(SourceLogic);
   const { isOrganization } = useValues(AppLogic);
 
   const {
@@ -99,8 +112,20 @@ export const Overview: React.FC = () => {
     indexPermissions,
     hasPermissions,
     isFederatedSource,
+    isIndexedSource,
   } = contentSource;
 
+  const [isSyncing, setIsSyncing] = useState(false);
+  const [isModalVisible, setIsModalVisible] = useState(false);
+  const closeModal = () => setIsModalVisible(false);
+  const handleSyncClick = () => setIsModalVisible(true);
+
+  const onSyncConfirm = () => {
+    initializeSourceSynchronization(id);
+    setIsSyncing(true);
+    closeModal();
+  };
+
   const DocumentSummary = () => {
     let totalDocuments = 0;
     const tableContent = summary?.map((item, index) => {
@@ -451,9 +476,57 @@ export const Overview: React.FC = () => {
     </EuiPanel>
   );
 
+  const syncTriggerCallout = (
+    <EuiFlexItem>
+      <EuiSpacer />
+      <EuiTitle size="xs">
+        <h5>{SOURCE_SYNCHRONIZATION_TITLE}</h5>
+      </EuiTitle>
+      <EuiSpacer size="s" />
+      <EuiPanel color="subdued">
+        <EuiButton fill isLoading={isSyncing} onClick={handleSyncClick} data-test-subj="SyncButton">
+          {SOURCE_SYNCHRONIZATION_BUTTON_LABEL}
+        </EuiButton>
+        <EuiSpacer size="m" />
+        <EuiText size="s">
+          <FormattedMessage
+            id="xpack.enterpriseSearch.workplaceSearch.sources.synchronizationCallout"
+            defaultMessage="Configure {syncFrequencyLink} or permissions {blockTimeWindowsLink}."
+            values={{
+              syncFrequencyLink: (
+                <EuiLinkTo to={getContentSourcePath(SYNC_FREQUENCY_PATH, id, isOrganization)}>
+                  {SOURCE_SYNC_FREQUENCY_LINK_LABEL}
+                </EuiLinkTo>
+              ),
+              blockTimeWindowsLink: (
+                <EuiLinkTo to={getContentSourcePath(BLOCKED_TIME_WINDOWS_PATH, id, isOrganization)}>
+                  {SOURCE_BLOCKED_TIME_WINDOWS_LINK_LABEL}
+                </EuiLinkTo>
+              ),
+            }}
+          />
+        </EuiText>
+      </EuiPanel>
+    </EuiFlexItem>
+  );
+
+  const syncConfirmModal = (
+    <EuiConfirmModal
+      title={SOURCE_SYNC_CONFIRM_TITLE}
+      onCancel={closeModal}
+      onConfirm={onSyncConfirm}
+      cancelButtonText={CANCEL_BUTTON_LABEL}
+      confirmButtonText={START_BUTTON_LABEL}
+      defaultFocusedButton="confirm"
+    >
+      <p>{SOURCE_SYNC_CONFIRM_MESSAGE}</p>
+    </EuiConfirmModal>
+  );
+
   return (
     <SourceLayout pageViewTelemetry="source_overview">
       <ViewContentHeader title={SOURCE_OVERVIEW_TITLE} />
+      {isModalVisible && syncConfirmModal}
 
       <EuiFlexGroup gutterSize="xl" alignItems="flexStart">
         <EuiFlexItem grow={8}>
@@ -513,6 +586,7 @@ export const Overview: React.FC = () => {
                 )}
               </>
             )}
+            {isIndexedSource && isOrganization && syncTriggerCallout}
           </EuiFlexGroup>
         </EuiFlexItem>
       </EuiFlexGroup>
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/constants.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/constants.ts
index 14d0a7f196ae86..f44dbae0608ea7 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/constants.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/constants.ts
@@ -579,6 +579,49 @@ export const SOURCE_SYNCHRONIZATION_FREQUENCY_TITLE = i18n.translate(
   }
 );
 
+export const SOURCE_SYNCHRONIZATION_TITLE = i18n.translate(
+  'xpack.enterpriseSearch.workplaceSearch.sources.sourceSynchronizationTitle',
+  {
+    defaultMessage: 'Synchronization',
+  }
+);
+
+export const SOURCE_SYNCHRONIZATION_BUTTON_LABEL = i18n.translate(
+  'xpack.enterpriseSearch.workplaceSearch.sources.sourceSynchronizationButtonLabel',
+  {
+    defaultMessage: 'Synchronize content',
+  }
+);
+
+export const SOURCE_SYNC_FREQUENCY_LINK_LABEL = i18n.translate(
+  'xpack.enterpriseSearch.workplaceSearch.sources.sourceSyncFrequencyLinkLabel',
+  {
+    defaultMessage: 'sync frequency',
+  }
+);
+
+export const SOURCE_BLOCKED_TIME_WINDOWS_LINK_LABEL = i18n.translate(
+  'xpack.enterpriseSearch.workplaceSearch.sources.sourceBlockedTimeWindowsLinkLabel',
+  {
+    defaultMessage: 'blocked time windows',
+  }
+);
+
+export const SOURCE_SYNC_CONFIRM_TITLE = i18n.translate(
+  'xpack.enterpriseSearch.workplaceSearch.sources.sourceSyncConfirmTitle',
+  {
+    defaultMessage: 'Start new content sync?',
+  }
+);
+
+export const SOURCE_SYNC_CONFIRM_MESSAGE = i18n.translate(
+  'xpack.enterpriseSearch.workplaceSearch.sources.sourceSyncConfirmMessage',
+  {
+    defaultMessage:
+      'Are you sure you would like to continue with this request and stop all other syncs?',
+  }
+);
+
 export const SOURCE_SYNC_FREQUENCY_TITLE = i18n.translate(
   'xpack.enterpriseSearch.workplaceSearch.sources.sourceSyncFrequencyTitle',
   {
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_logic.test.ts
index 1fb4477cea5c02..fb88360de5df02 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_logic.test.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_logic.test.ts
@@ -429,6 +429,34 @@ describe('SourceLogic', () => {
       });
     });
 
+    describe('initializeSourceSynchronization', () => {
+      it('calls API and fetches fresh source state', async () => {
+        const initializeSourceSpy = jest.spyOn(SourceLogic.actions, 'initializeSource');
+        const promise = Promise.resolve(contentSource);
+        http.post.mockReturnValue(promise);
+        SourceLogic.actions.initializeSourceSynchronization(contentSource.id);
+
+        expect(http.post).toHaveBeenCalledWith('/internal/workplace_search/org/sources/123/sync');
+        await promise;
+        expect(initializeSourceSpy).toHaveBeenCalledWith(contentSource.id);
+      });
+
+      it('handles error', async () => {
+        const error = {
+          response: {
+            error: 'this is an error',
+            status: 400,
+          },
+        };
+        const promise = Promise.reject(error);
+        http.post.mockReturnValue(promise);
+        SourceLogic.actions.initializeSourceSynchronization(contentSource.id);
+        await expectedAsyncError(promise);
+
+        expect(flashAPIErrors).toHaveBeenCalledWith(error);
+      });
+    });
+
     it('resetSourceState', () => {
       SourceLogic.actions.resetSourceState();
 
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_logic.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_logic.ts
index d10400bc5ba2d2..9dcd0824cad112 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_logic.ts
@@ -27,6 +27,7 @@ export interface SourceActions {
   onUpdateSourceName(name: string): string;
   setSearchResults(searchResultsResponse: SearchResultsResponse): SearchResultsResponse;
   initializeFederatedSummary(sourceId: string): { sourceId: string };
+  initializeSourceSynchronization(sourceId: string): { sourceId: string };
   onUpdateSummary(summary: DocumentSummaryItem[]): DocumentSummaryItem[];
   setContentFilterValue(contentFilterValue: string): string;
   setActivePage(activePage: number): number;
@@ -81,6 +82,7 @@ export const SourceLogic = kea<MakeLogicType<SourceValues, SourceActions>>({
     setActivePage: (activePage: number) => activePage,
     initializeSource: (sourceId: string) => ({ sourceId }),
     initializeFederatedSummary: (sourceId: string) => ({ sourceId }),
+    initializeSourceSynchronization: (sourceId: string) => ({ sourceId }),
     searchContentSourceDocuments: (sourceId: string) => ({ sourceId }),
     updateContentSource: (sourceId: string, source: SourceUpdatePayload) => ({ sourceId, source }),
     removeContentSource: (sourceId: string) => ({
@@ -254,6 +256,15 @@ export const SourceLogic = kea<MakeLogicType<SourceValues, SourceActions>>({
         actions.setButtonNotLoading();
       }
     },
+    initializeSourceSynchronization: async ({ sourceId }) => {
+      const route = `/internal/workplace_search/org/sources/${sourceId}/sync`;
+      try {
+        await HttpLogic.values.http.post(route);
+        actions.initializeSource(sourceId);
+      } catch (e) {
+        flashAPIErrors(e);
+      }
+    },
     onUpdateSourceName: (name: string) => {
       flashSuccessToast(
         i18n.translate(
diff --git a/x-pack/plugins/enterprise_search/server/routes/workplace_search/sources.test.ts b/x-pack/plugins/enterprise_search/server/routes/workplace_search/sources.test.ts
index 706bc8a4853a72..961635c3f90017 100644
--- a/x-pack/plugins/enterprise_search/server/routes/workplace_search/sources.test.ts
+++ b/x-pack/plugins/enterprise_search/server/routes/workplace_search/sources.test.ts
@@ -42,6 +42,7 @@ import {
   registerOrgSourceDownloadDiagnosticsRoute,
   registerOrgSourceOauthConfigurationsRoute,
   registerOrgSourceOauthConfigurationRoute,
+  registerOrgSourceSynchronizeRoute,
   registerOauthConnectorParamsRoute,
 } from './sources';
 
@@ -1252,6 +1253,29 @@ describe('sources routes', () => {
     });
   });
 
+  describe('POST /internal/workplace_search/org/sources/{id}/sync', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+      mockRouter = new MockRouter({
+        method: 'post',
+        path: '/internal/workplace_search/org/sources/{id}/sync',
+      });
+
+      registerOrgSourceSynchronizeRoute({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+    });
+
+    it('creates a request handler', () => {
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/ws/org/sources/:id/sync',
+      });
+    });
+  });
+
   describe('GET /internal/workplace_search/sources/create', () => {
     const tokenPackage = 'some_encrypted_secrets';
 
diff --git a/x-pack/plugins/enterprise_search/server/routes/workplace_search/sources.ts b/x-pack/plugins/enterprise_search/server/routes/workplace_search/sources.ts
index 660294a5e1ddd8..011fe341d6edf8 100644
--- a/x-pack/plugins/enterprise_search/server/routes/workplace_search/sources.ts
+++ b/x-pack/plugins/enterprise_search/server/routes/workplace_search/sources.ts
@@ -891,6 +891,25 @@ export function registerOrgSourceOauthConfigurationRoute({
   );
 }
 
+export function registerOrgSourceSynchronizeRoute({
+  router,
+  enterpriseSearchRequestHandler,
+}: RouteDependencies) {
+  router.post(
+    {
+      path: '/internal/workplace_search/org/sources/{id}/sync',
+      validate: {
+        params: schema.object({
+          id: schema.string(),
+        }),
+      },
+    },
+    enterpriseSearchRequestHandler.createRequest({
+      path: '/ws/org/sources/:id/sync',
+    })
+  );
+}
+
 // Same route is used for org and account. `state` passes the context.
 export function registerOauthConnectorParamsRoute({
   router,
@@ -956,5 +975,6 @@ export const registerSourcesRoutes = (dependencies: RouteDependencies) => {
   registerOrgSourceDownloadDiagnosticsRoute(dependencies);
   registerOrgSourceOauthConfigurationsRoute(dependencies);
   registerOrgSourceOauthConfigurationRoute(dependencies);
+  registerOrgSourceSynchronizeRoute(dependencies);
   registerOauthConnectorParamsRoute(dependencies);
 };

From a532ea5c05d41e2d0fd3a8dee66316e594c8d698 Mon Sep 17 00:00:00 2001
From: Davey Holler <daveyholler@gmail.com>
Date: Wed, 13 Oct 2021 12:21:46 -0700
Subject: [PATCH 24/71] [App Search] Static Curations History Tab (#113481)

---
 .../components/curations/curations_logic.ts   |  2 +-
 .../curations/views/curations.test.tsx        | 18 ++++++-
 .../components/curations/views/curations.tsx  | 12 +++++
 .../curation_changes_panel.test.tsx           | 22 ++++++++
 .../components/curation_changes_panel.tsx     | 23 ++++++++
 .../ignored_suggestions_panel.test.tsx        | 25 +++++++++
 .../components/ignored_suggestions_panel.tsx  | 53 +++++++++++++++++++
 .../curations_history/components/index.ts     | 10 ++++
 .../rejected_curations_panel.test.tsx         | 22 ++++++++
 .../components/rejected_curations_panel.tsx   | 23 ++++++++
 .../curations_history.test.tsx                | 27 ++++++++++
 .../curations_history/curations_history.tsx   | 36 +++++++++++++
 .../views/curations_history/index.ts          |  8 +++
 13 files changed, 278 insertions(+), 3 deletions(-)
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/curation_changes_panel.test.tsx
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/curation_changes_panel.tsx
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/ignored_suggestions_panel.test.tsx
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/ignored_suggestions_panel.tsx
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/index.ts
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/rejected_curations_panel.test.tsx
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/rejected_curations_panel.tsx
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/curations_history.test.tsx
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/curations_history.tsx
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/index.ts

diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curations_logic.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curations_logic.ts
index e623379e58d3f8..04d04b297050ad 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curations_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curations_logic.ts
@@ -23,7 +23,7 @@ import { EngineLogic, generateEnginePath } from '../engine';
 import { DELETE_CONFIRMATION_MESSAGE, DELETE_SUCCESS_MESSAGE } from './constants';
 import { Curation, CurationsAPIResponse } from './types';
 
-type CurationsPageTabs = 'overview' | 'settings';
+type CurationsPageTabs = 'overview' | 'settings' | 'history';
 
 interface CurationsValues {
   dataLoading: boolean;
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations.test.tsx
index 7e357cae4343c0..f7e9f5437fc3f1 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations.test.tsx
@@ -19,6 +19,7 @@ import { EuiTab } from '@elastic/eui';
 import { getPageHeaderTabs, getPageTitle } from '../../../../test_helpers';
 
 import { Curations } from './curations';
+import { CurationsHistory } from './curations_history/curations_history';
 import { CurationsOverview } from './curations_overview';
 import { CurationsSettings } from './curations_settings';
 
@@ -70,7 +71,10 @@ describe('Curations', () => {
     expect(actions.onSelectPageTab).toHaveBeenNthCalledWith(1, 'overview');
 
     tabs.at(1).simulate('click');
-    expect(actions.onSelectPageTab).toHaveBeenNthCalledWith(2, 'settings');
+    expect(actions.onSelectPageTab).toHaveBeenNthCalledWith(2, 'history');
+
+    tabs.at(2).simulate('click');
+    expect(actions.onSelectPageTab).toHaveBeenNthCalledWith(3, 'settings');
   });
 
   it('renders an overview view', () => {
@@ -83,12 +87,22 @@ describe('Curations', () => {
     expect(wrapper.find(CurationsOverview)).toHaveLength(1);
   });
 
+  it('renders a history view', () => {
+    setMockValues({ ...values, selectedPageTab: 'history' });
+    const wrapper = shallow(<Curations />);
+    const tabs = getPageHeaderTabs(wrapper).find(EuiTab);
+
+    expect(tabs.at(1).prop('isSelected')).toEqual(true);
+
+    expect(wrapper.find(CurationsHistory)).toHaveLength(1);
+  });
+
   it('renders a settings view', () => {
     setMockValues({ ...values, selectedPageTab: 'settings' });
     const wrapper = shallow(<Curations />);
     const tabs = getPageHeaderTabs(wrapper).find(EuiTab);
 
-    expect(tabs.at(1).prop('isSelected')).toEqual(true);
+    expect(tabs.at(2).prop('isSelected')).toEqual(true);
 
     expect(wrapper.find(CurationsSettings)).toHaveLength(1);
   });
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations.tsx
index 9584b21424fe36..c55fde7626488c 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations.tsx
@@ -21,6 +21,7 @@ import { CURATIONS_OVERVIEW_TITLE, CREATE_NEW_CURATION_TITLE } from '../constant
 import { CurationsLogic } from '../curations_logic';
 import { getCurationsBreadcrumbs } from '../utils';
 
+import { CurationsHistory } from './curations_history/curations_history';
 import { CurationsOverview } from './curations_overview';
 import { CurationsSettings } from './curations_settings';
 
@@ -39,6 +40,16 @@ export const Curations: React.FC = () => {
       isSelected: selectedPageTab === 'overview',
       onClick: () => onSelectPageTab('overview'),
     },
+    {
+      label: i18n.translate(
+        'xpack.enterpriseSearch.appSearch.engine.curations.historyPageTabLabel',
+        {
+          defaultMessage: 'History',
+        }
+      ),
+      isSelected: selectedPageTab === 'history',
+      onClick: () => onSelectPageTab('history'),
+    },
     {
       label: i18n.translate(
         'xpack.enterpriseSearch.appSearch.engine.curations.settingsPageTabLabel',
@@ -74,6 +85,7 @@ export const Curations: React.FC = () => {
       isLoading={dataLoading && !curations.length}
     >
       {selectedPageTab === 'overview' && <CurationsOverview />}
+      {selectedPageTab === 'history' && <CurationsHistory />}
       {selectedPageTab === 'settings' && <CurationsSettings />}
     </AppSearchPageTemplate>
   );
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/curation_changes_panel.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/curation_changes_panel.test.tsx
new file mode 100644
index 00000000000000..7fc06beaa86a93
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/curation_changes_panel.test.tsx
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { shallow } from 'enzyme';
+
+import { DataPanel } from '../../../../data_panel';
+
+import { CurationChangesPanel } from './curation_changes_panel';
+
+describe('CurationChangesPanel', () => {
+  it('renders', () => {
+    const wrapper = shallow(<CurationChangesPanel />);
+
+    expect(wrapper.is(DataPanel)).toBe(true);
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/curation_changes_panel.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/curation_changes_panel.tsx
new file mode 100644
index 00000000000000..0aaf20485966ec
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/curation_changes_panel.tsx
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { DataPanel } from '../../../../data_panel';
+
+export const CurationChangesPanel: React.FC = () => {
+  return (
+    <DataPanel
+      title={<h2>Automated curation changes</h2>}
+      subtitle={<span>A detailed log of recent changes to your automated curations</span>}
+      iconType="visTable"
+      hasBorder
+    >
+      Embedded logs view goes here...
+    </DataPanel>
+  );
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/ignored_suggestions_panel.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/ignored_suggestions_panel.test.tsx
new file mode 100644
index 00000000000000..b09981748f19cb
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/ignored_suggestions_panel.test.tsx
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { shallow } from 'enzyme';
+
+import { EuiBasicTable } from '@elastic/eui';
+
+import { DataPanel } from '../../../../data_panel';
+
+import { IgnoredSuggestionsPanel } from './ignored_suggestions_panel';
+
+describe('IgnoredSuggestionsPanel', () => {
+  it('renders', () => {
+    const wrapper = shallow(<IgnoredSuggestionsPanel />);
+
+    expect(wrapper.is(DataPanel)).toBe(true);
+    expect(wrapper.find(EuiBasicTable)).toHaveLength(1);
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/ignored_suggestions_panel.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/ignored_suggestions_panel.tsx
new file mode 100644
index 00000000000000..f2fdfd55a7e5a1
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/ignored_suggestions_panel.tsx
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { CustomItemAction, EuiBasicTable, EuiBasicTableColumn, EuiLink } from '@elastic/eui';
+
+import { DataPanel } from '../../../../data_panel';
+import { CurationSuggestion } from '../../../types';
+
+export const IgnoredSuggestionsPanel: React.FC = () => {
+  const ignoredSuggestions: CurationSuggestion[] = [];
+
+  const allowSuggestion = (query: string) => alert(query);
+
+  const actions: Array<CustomItemAction<CurationSuggestion>> = [
+    {
+      render: (item: CurationSuggestion) => {
+        return (
+          <EuiLink onClick={() => allowSuggestion(item.query)} color="primary">
+            Allow
+          </EuiLink>
+        );
+      },
+    },
+  ];
+
+  const columns: Array<EuiBasicTableColumn<CurationSuggestion>> = [
+    {
+      field: 'query',
+      name: 'Query',
+      sortable: true,
+    },
+    {
+      actions,
+    },
+  ];
+
+  return (
+    <DataPanel
+      title={<h2>Ignored queries</h2>}
+      subtitle={<span>You won’t be notified about suggestions for these queries</span>}
+      iconType="eyeClosed"
+      hasBorder
+    >
+      <EuiBasicTable items={ignoredSuggestions} itemId="query" columns={columns} />
+    </DataPanel>
+  );
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/index.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/index.ts
new file mode 100644
index 00000000000000..2e16d9bde8550b
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/index.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { CurationChangesPanel } from './curation_changes_panel';
+export { IgnoredSuggestionsPanel } from './ignored_suggestions_panel';
+export { RejectedCurationsPanel } from './rejected_curations_panel';
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/rejected_curations_panel.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/rejected_curations_panel.test.tsx
new file mode 100644
index 00000000000000..a40eb8895ad695
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/rejected_curations_panel.test.tsx
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { shallow } from 'enzyme';
+
+import { DataPanel } from '../../../../data_panel';
+
+import { RejectedCurationsPanel } from './rejected_curations_panel';
+
+describe('RejectedCurationsPanel', () => {
+  it('renders', () => {
+    const wrapper = shallow(<RejectedCurationsPanel />);
+
+    expect(wrapper.is(DataPanel)).toBe(true);
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/rejected_curations_panel.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/rejected_curations_panel.tsx
new file mode 100644
index 00000000000000..51719b4eebbd77
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/rejected_curations_panel.tsx
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { DataPanel } from '../../../../data_panel';
+
+export const RejectedCurationsPanel: React.FC = () => {
+  return (
+    <DataPanel
+      title={<h2>Rececntly rejected sugggestions</h2>}
+      subtitle={<span>Recent suggestions that are still valid can be re-enabled from here</span>}
+      iconType="crossInACircleFilled"
+      hasBorder
+    >
+      Embedded logs view goes here...
+    </DataPanel>
+  );
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/curations_history.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/curations_history.test.tsx
new file mode 100644
index 00000000000000..1ebd4da694d54d
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/curations_history.test.tsx
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { shallow } from 'enzyme';
+
+import {
+  CurationChangesPanel,
+  IgnoredSuggestionsPanel,
+  RejectedCurationsPanel,
+} from './components';
+import { CurationsHistory } from './curations_history';
+
+describe('CurationsHistory', () => {
+  it('renders', () => {
+    const wrapper = shallow(<CurationsHistory />);
+
+    expect(wrapper.find(CurationChangesPanel)).toHaveLength(1);
+    expect(wrapper.find(RejectedCurationsPanel)).toHaveLength(1);
+    expect(wrapper.find(IgnoredSuggestionsPanel)).toHaveLength(1);
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/curations_history.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/curations_history.tsx
new file mode 100644
index 00000000000000..6db62820b1cdb5
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/curations_history.tsx
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+
+import {
+  CurationChangesPanel,
+  IgnoredSuggestionsPanel,
+  RejectedCurationsPanel,
+} from './components';
+
+export const CurationsHistory: React.FC = () => {
+  return (
+    <EuiFlexGroup>
+      <EuiFlexItem grow={2}>
+        <EuiFlexGroup direction="column">
+          <EuiFlexItem>
+            <CurationChangesPanel />
+          </EuiFlexItem>
+          <EuiFlexItem>
+            <RejectedCurationsPanel />
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiFlexItem>
+      <EuiFlexItem grow={1}>
+        <IgnoredSuggestionsPanel />
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/index.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/index.ts
new file mode 100644
index 00000000000000..bddc156f7920ef
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { CurationsHistory } from './curations_history';

From fdd72a9e80621d31f562ddae4413967ca375031f Mon Sep 17 00:00:00 2001
From: Orhan Toy <toyorhan@gmail.com>
Date: Wed, 13 Oct 2021 21:36:03 +0200
Subject: [PATCH 25/71] [App Search] [Crawler] Add tooltip to explain path
 pattern (#114779)

7.13.0 adds a wildcard character to (non-regex) path patterns. This change updates the UI help text to explain this.
---
 .../crawler/components/crawl_rules_table.tsx  | 37 +++++++++++++++----
 .../components/crawler/utils.test.ts          | 26 +++++++++++++
 .../app_search/components/crawler/utils.ts    | 22 +++++++++++
 3 files changed, 77 insertions(+), 8 deletions(-)

diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawl_rules_table.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawl_rules_table.tsx
index d8d5d9d10b3b72..df7ea80779acf7 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawl_rules_table.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawl_rules_table.tsx
@@ -9,7 +9,16 @@ import React from 'react';
 
 import { useActions } from 'kea';
 
-import { EuiCode, EuiFieldText, EuiLink, EuiSelect, EuiText } from '@elastic/eui';
+import {
+  EuiCode,
+  EuiFieldText,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiIconTip,
+  EuiLink,
+  EuiSelect,
+  EuiText,
+} from '@elastic/eui';
 
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
@@ -27,6 +36,7 @@ import {
   getReadableCrawlerPolicy,
   getReadableCrawlerRule,
 } from '../types';
+import { getCrawlRulePathPatternTooltip } from '../utils';
 
 interface CrawlRulesTableProps {
   description?: React.ReactNode;
@@ -130,13 +140,24 @@ export const CrawlRulesTable: React.FC<CrawlRulesTableProps> = ({
     },
     {
       editingRender: (crawlRule, onChange, { isInvalid, isLoading }) => (
-        <EuiFieldText
-          fullWidth
-          value={(crawlRule as CrawlRule).pattern}
-          onChange={(e) => onChange(e.target.value)}
-          disabled={isLoading}
-          isInvalid={isInvalid}
-        />
+        <EuiFlexGroup alignItems="center" gutterSize="s" responsive={false}>
+          <EuiFlexItem>
+            <EuiFieldText
+              fullWidth
+              value={(crawlRule as CrawlRule).pattern}
+              onChange={(e) => onChange(e.target.value)}
+              disabled={isLoading}
+              isInvalid={isInvalid}
+            />
+          </EuiFlexItem>
+          <EuiFlexItem grow={false}>
+            <EuiIconTip
+              content={getCrawlRulePathPatternTooltip(crawlRule as CrawlRule)}
+              type="iInCircle"
+              position="top"
+            />
+          </EuiFlexItem>
+        </EuiFlexGroup>
       ),
       render: (crawlRule) => <EuiCode>{(crawlRule as CrawlRule).pattern}</EuiCode>,
       name: i18n.translate(
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/utils.test.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/utils.test.ts
index fc810ba8fd7cb7..0fc608ac6f5e48 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/utils.test.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/utils.test.ts
@@ -26,6 +26,7 @@ import {
   crawlRequestServerToClient,
   getDeleteDomainConfirmationMessage,
   getDeleteDomainSuccessMessage,
+  getCrawlRulePathPatternTooltip,
 } from './utils';
 
 const DEFAULT_CRAWL_RULE: CrawlRule = {
@@ -292,3 +293,28 @@ describe('getDeleteDomainSuccessMessage', () => {
     expect(getDeleteDomainSuccessMessage('https://elastic.co/')).toContain('https://elastic.co');
   });
 });
+
+describe('getCrawlRulePathPatternTooltip', () => {
+  it('includes regular expression', () => {
+    const crawlRule: CrawlRule = {
+      id: '-',
+      policy: CrawlerPolicies.allow,
+      rule: CrawlerRules.regex,
+      pattern: '.*',
+    };
+
+    expect(getCrawlRulePathPatternTooltip(crawlRule)).toContain('regular expression');
+  });
+
+  it('includes meta', () => {
+    const crawlRule: CrawlRule = {
+      id: '-',
+      policy: CrawlerPolicies.allow,
+      rule: CrawlerRules.beginsWith,
+      pattern: '/elastic',
+    };
+
+    expect(getCrawlRulePathPatternTooltip(crawlRule)).not.toContain('regular expression');
+    expect(getCrawlRulePathPatternTooltip(crawlRule)).toContain('meta');
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/utils.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/utils.ts
index 9c94040355d477..817f10b70dca56 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/utils.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/utils.ts
@@ -16,6 +16,8 @@ import {
   CrawlerDomainValidationStep,
   CrawlRequestFromServer,
   CrawlRequest,
+  CrawlRule,
+  CrawlerRules,
   CrawlEventFromServer,
   CrawlEvent,
 } from './types';
@@ -159,3 +161,23 @@ export const getDeleteDomainSuccessMessage = (domainUrl: string) => {
     }
   );
 };
+
+export const getCrawlRulePathPatternTooltip = (crawlRule: CrawlRule) => {
+  if (crawlRule.rule === CrawlerRules.regex) {
+    return i18n.translate(
+      'xpack.enterpriseSearch.appSearch.crawler.crawlRulesTable.regexPathPatternTooltip',
+      {
+        defaultMessage:
+          'The path pattern is a regular expression compatible with the Ruby language regular expression engine.',
+      }
+    );
+  }
+
+  return i18n.translate(
+    'xpack.enterpriseSearch.appSearch.crawler.crawlRulesTable.pathPatternTooltip',
+    {
+      defaultMessage:
+        'The path pattern is a literal string except for the asterisk (*) character, which is a meta character that will match anything.',
+    }
+  );
+};

From 491fcd5c36af3304cc4023e889dc150137acb1a9 Mon Sep 17 00:00:00 2001
From: Kevin Lacabane <kevin.lacabane@elastic.co>
Date: Wed, 13 Oct 2021 21:45:49 +0200
Subject: [PATCH 26/71] [Stack Monitoring] fix beats pages test-subj attributes
 (#114835)

* fix beats pages test-subj attributes

* fix eslint errors
---
 .../public/application/pages/beats/beats_template.tsx    | 2 ++
 .../public/application/pages/beats/instances.tsx         | 7 +------
 .../public/application/pages/beats/overview.tsx          | 9 ++-------
 3 files changed, 5 insertions(+), 13 deletions(-)

diff --git a/x-pack/plugins/monitoring/public/application/pages/beats/beats_template.tsx b/x-pack/plugins/monitoring/public/application/pages/beats/beats_template.tsx
index 3bab01af8ceb71..7a070c735bbea4 100644
--- a/x-pack/plugins/monitoring/public/application/pages/beats/beats_template.tsx
+++ b/x-pack/plugins/monitoring/public/application/pages/beats/beats_template.tsx
@@ -23,6 +23,7 @@ export const BeatsTemplate: React.FC<BeatsTemplateProps> = ({ instance, ...props
         defaultMessage: 'Overview',
       }),
       route: '/beats',
+      testSubj: 'beatsOverviewPage',
     });
     tabs.push({
       id: 'instances',
@@ -30,6 +31,7 @@ export const BeatsTemplate: React.FC<BeatsTemplateProps> = ({ instance, ...props
         defaultMessage: 'Instances',
       }),
       route: '/beats/beats',
+      testSubj: 'beatsListingPage',
     });
   } else {
     tabs.push({
diff --git a/x-pack/plugins/monitoring/public/application/pages/beats/instances.tsx b/x-pack/plugins/monitoring/public/application/pages/beats/instances.tsx
index 489ad110c40fde..4611f17159621d 100644
--- a/x-pack/plugins/monitoring/public/application/pages/beats/instances.tsx
+++ b/x-pack/plugins/monitoring/public/application/pages/beats/instances.tsx
@@ -71,12 +71,7 @@ export const BeatsInstancesPage: React.FC<ComponentProps> = ({ clusters }) => {
   ]);
 
   return (
-    <BeatsTemplate
-      title={title}
-      pageTitle={pageTitle}
-      getPageData={getPageData}
-      data-test-subj="beatsListingPage"
-    >
+    <BeatsTemplate title={title} pageTitle={pageTitle} getPageData={getPageData}>
       <div data-test-subj="monitoringBeatsInstancesApp">
         <SetupModeRenderer
           productName={BEATS_SYSTEM_ID}
diff --git a/x-pack/plugins/monitoring/public/application/pages/beats/overview.tsx b/x-pack/plugins/monitoring/public/application/pages/beats/overview.tsx
index 1fa37a2c7b3e69..aec89c92055c45 100644
--- a/x-pack/plugins/monitoring/public/application/pages/beats/overview.tsx
+++ b/x-pack/plugins/monitoring/public/application/pages/beats/overview.tsx
@@ -72,13 +72,8 @@ export const BeatsOverviewPage: React.FC<ComponentProps> = ({ clusters }) => {
   };
 
   return (
-    <BeatsTemplate
-      title={title}
-      pageTitle={pageTitle}
-      getPageData={getPageData}
-      data-test-subj="beatsOverviewPage"
-    >
-      <div data-test-subj="beatsOverviewPage">{renderOverview(data)}</div>
+    <BeatsTemplate title={title} pageTitle={pageTitle} getPageData={getPageData}>
+      <div>{renderOverview(data)}</div>
     </BeatsTemplate>
   );
 };

From e1e1830f15f96ced2deacd614663c17ab4327890 Mon Sep 17 00:00:00 2001
From: Luke Elmers <luke.elmers@elastic.co>
Date: Wed, 13 Oct 2021 14:20:56 -0600
Subject: [PATCH 27/71] [Breaking] Remove `/api/settings` & the `xpack_legacy`
 plugin. (#114730)

---
 .github/CODEOWNERS                            |   1 -
 api_docs/plugin_directory.mdx                 |   1 -
 docs/developer/plugin-list.asciidoc           |   4 -
 x-pack/plugins/xpack_legacy/README.md         |   3 -
 x-pack/plugins/xpack_legacy/jest.config.js    |  15 ---
 x-pack/plugins/xpack_legacy/kibana.json       |  12 --
 x-pack/plugins/xpack_legacy/server/index.ts   |  12 --
 x-pack/plugins/xpack_legacy/server/plugin.ts  |  45 -------
 .../server/routes/settings.test.ts            | 115 ------------------
 .../xpack_legacy/server/routes/settings.ts    |  96 ---------------
 x-pack/plugins/xpack_legacy/tsconfig.json     |  17 ---
 x-pack/test/api_integration/apis/index.ts     |   1 -
 .../apis/xpack_legacy/index.js                |  12 --
 .../apis/xpack_legacy/settings/index.js       |  12 --
 .../apis/xpack_legacy/settings/settings.js    |  40 ------
 x-pack/test/tsconfig.json                     |   3 +-
 16 files changed, 1 insertion(+), 388 deletions(-)
 delete mode 100644 x-pack/plugins/xpack_legacy/README.md
 delete mode 100644 x-pack/plugins/xpack_legacy/jest.config.js
 delete mode 100644 x-pack/plugins/xpack_legacy/kibana.json
 delete mode 100644 x-pack/plugins/xpack_legacy/server/index.ts
 delete mode 100644 x-pack/plugins/xpack_legacy/server/plugin.ts
 delete mode 100644 x-pack/plugins/xpack_legacy/server/routes/settings.test.ts
 delete mode 100644 x-pack/plugins/xpack_legacy/server/routes/settings.ts
 delete mode 100644 x-pack/plugins/xpack_legacy/tsconfig.json
 delete mode 100644 x-pack/test/api_integration/apis/xpack_legacy/index.js
 delete mode 100644 x-pack/test/api_integration/apis/xpack_legacy/settings/index.js
 delete mode 100644 x-pack/test/api_integration/apis/xpack_legacy/settings/settings.js

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 91a8f8c2d59985..1e0a8b187c7787 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -254,7 +254,6 @@
 /src/plugins/kibana_overview/ @elastic/kibana-core
 /x-pack/plugins/global_search_bar/ @elastic/kibana-core
 #CC# /src/core/server/csp/ @elastic/kibana-core
-#CC# /src/plugins/xpack_legacy/ @elastic/kibana-core
 #CC# /src/plugins/saved_objects/ @elastic/kibana-core
 #CC# /x-pack/plugins/cloud/ @elastic/kibana-core
 #CC# /x-pack/plugins/features/ @elastic/kibana-core
diff --git a/api_docs/plugin_directory.mdx b/api_docs/plugin_directory.mdx
index 533a86b9e806f9..6380831a8c6c37 100644
--- a/api_docs/plugin_directory.mdx
+++ b/api_docs/plugin_directory.mdx
@@ -153,7 +153,6 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 | <DocLink id="kibVisualizationsPluginApi" text="visualizations"/> | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-vis-editors) | Contains the shared architecture among all the legacy visualizations, e.g. the visualization type registry or the visualization embeddable. | 304 | 13 | 286 | 16 |
 | <DocLink id="kibVisualizePluginApi" text="visualize"/> | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-vis-editors) | Contains the visualize application which includes the listing page and the app frame, which will load the visualization's editor. | 24 | 0 | 23 | 1 |
 | watcher | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 0 | 0 | 0 | 0 |
-| xpackLegacy | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 0 | 0 | 0 | 0 |
 
 ## Package Directory
 
diff --git a/docs/developer/plugin-list.asciidoc b/docs/developer/plugin-list.asciidoc
index 9581848be9e539..3d1fcd51837a37 100644
--- a/docs/developer/plugin-list.asciidoc
+++ b/docs/developer/plugin-list.asciidoc
@@ -617,10 +617,6 @@ in their infrastructure.
 |This plugins adopts some conventions in addition to or in place of conventions in Kibana (at the time of the plugin's creation):
 
 
-|{kib-repo}blob/{branch}/x-pack/plugins/xpack_legacy/README.md[xpackLegacy]
-|Contains HTTP endpoints and UiSettings that are slated for removal.
-
-
 |===
 
 include::{kibana-root}/src/plugins/dashboard/README.asciidoc[leveloffset=+1]
diff --git a/x-pack/plugins/xpack_legacy/README.md b/x-pack/plugins/xpack_legacy/README.md
deleted file mode 100644
index be438253479595..00000000000000
--- a/x-pack/plugins/xpack_legacy/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# Xpack Leagcy
-
-Contains HTTP endpoints and UiSettings that are slated for removal.
diff --git a/x-pack/plugins/xpack_legacy/jest.config.js b/x-pack/plugins/xpack_legacy/jest.config.js
deleted file mode 100644
index 5ad0fa36264d1c..00000000000000
--- a/x-pack/plugins/xpack_legacy/jest.config.js
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-module.exports = {
-  preset: '@kbn/test',
-  rootDir: '../../..',
-  roots: ['<rootDir>/x-pack/plugins/xpack_legacy'],
-  coverageDirectory: '<rootDir>/target/kibana-coverage/jest/x-pack/plugins/xpack_legacy',
-  coverageReporters: ['text', 'html'],
-  collectCoverageFrom: ['<rootDir>/x-pack/plugins/xpack_legacy/server/**/*.{ts,tsx}'],
-};
diff --git a/x-pack/plugins/xpack_legacy/kibana.json b/x-pack/plugins/xpack_legacy/kibana.json
deleted file mode 100644
index 9dd0ac83401837..00000000000000
--- a/x-pack/plugins/xpack_legacy/kibana.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "id": "xpackLegacy",
-  "owner": {
-    "name": "Kibana Core",
-    "githubTeam": "kibana-core"
-  },
-  "version": "8.0.0",
-  "kibanaVersion": "kibana",
-  "server": true,
-  "ui": false,
-  "requiredPlugins": ["usageCollection"]
-}
diff --git a/x-pack/plugins/xpack_legacy/server/index.ts b/x-pack/plugins/xpack_legacy/server/index.ts
deleted file mode 100644
index ee51afcca429fb..00000000000000
--- a/x-pack/plugins/xpack_legacy/server/index.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { PluginInitializerContext } from '../../../../src/core/server';
-import { XpackLegacyPlugin } from './plugin';
-
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new XpackLegacyPlugin(initializerContext);
diff --git a/x-pack/plugins/xpack_legacy/server/plugin.ts b/x-pack/plugins/xpack_legacy/server/plugin.ts
deleted file mode 100644
index ffef7117bbbd8a..00000000000000
--- a/x-pack/plugins/xpack_legacy/server/plugin.ts
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import {
-  CoreStart,
-  CoreSetup,
-  Plugin,
-  PluginInitializerContext,
-} from '../../../../src/core/server';
-import { UsageCollectionSetup } from '../../../../src/plugins/usage_collection/server';
-import { registerSettingsRoute } from './routes/settings';
-
-interface SetupPluginDeps {
-  usageCollection: UsageCollectionSetup;
-}
-
-export class XpackLegacyPlugin implements Plugin {
-  constructor(private readonly initContext: PluginInitializerContext) {}
-
-  public setup(core: CoreSetup, { usageCollection }: SetupPluginDeps) {
-    const router = core.http.createRouter();
-    const globalConfig = this.initContext.config.legacy.get();
-    const serverInfo = core.http.getServerInfo();
-
-    registerSettingsRoute({
-      router,
-      usageCollection,
-      overallStatus$: core.status.overall$,
-      config: {
-        kibanaIndex: globalConfig.kibana.index,
-        kibanaVersion: this.initContext.env.packageInfo.version,
-        uuid: this.initContext.env.instanceUuid,
-        server: serverInfo,
-      },
-    });
-  }
-
-  public start(core: CoreStart) {}
-
-  public stop() {}
-}
diff --git a/x-pack/plugins/xpack_legacy/server/routes/settings.test.ts b/x-pack/plugins/xpack_legacy/server/routes/settings.test.ts
deleted file mode 100644
index f265ea6ab125a8..00000000000000
--- a/x-pack/plugins/xpack_legacy/server/routes/settings.test.ts
+++ /dev/null
@@ -1,115 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { BehaviorSubject } from 'rxjs';
-import { UnwrapPromise } from '@kbn/utility-types';
-import supertest from 'supertest';
-
-import { ServiceStatus, ServiceStatusLevels } from '../../../../../src/core/server';
-import {
-  contextServiceMock,
-  elasticsearchServiceMock,
-  savedObjectsServiceMock,
-  executionContextServiceMock,
-} from '../../../../../src/core/server/mocks';
-import { createHttpServer } from '../../../../../src/core/server/test_utils';
-import { registerSettingsRoute } from './settings';
-
-type HttpService = ReturnType<typeof createHttpServer>;
-type HttpSetup = UnwrapPromise<ReturnType<HttpService['setup']>>;
-
-export function mockGetClusterInfo(clusterInfo: any) {
-  const esClient = elasticsearchServiceMock.createScopedClusterClient().asCurrentUser;
-  // @ts-ignore we only care about the response body
-  esClient.info.mockResolvedValue({ body: { ...clusterInfo } });
-  return esClient;
-}
-
-describe('/api/settings', () => {
-  let server: HttpService;
-  let httpSetup: HttpSetup;
-  let overallStatus$: BehaviorSubject<ServiceStatus>;
-
-  beforeEach(async () => {
-    server = createHttpServer();
-    await server.preboot({ context: contextServiceMock.createPrebootContract() });
-    httpSetup = await server.setup({
-      context: contextServiceMock.createSetupContract({
-        core: {
-          elasticsearch: {
-            client: {
-              asCurrentUser: mockGetClusterInfo({ cluster_uuid: 'yyy-yyyyy' }),
-            },
-          },
-          savedObjects: {
-            client: savedObjectsServiceMock.create(),
-          },
-        },
-      }),
-      executionContext: executionContextServiceMock.createInternalSetupContract(),
-    });
-
-    overallStatus$ = new BehaviorSubject<ServiceStatus>({
-      level: ServiceStatusLevels.available,
-      summary: 'everything is working',
-    });
-
-    const usageCollection = {
-      getCollectorByType: jest.fn().mockReturnValue({
-        fetch: jest
-          .fn()
-          .mockReturnValue({ xpack: { default_admin_email: 'kibana-machine@elastic.co' } }),
-      }),
-    } as any;
-
-    const router = httpSetup.createRouter('');
-    registerSettingsRoute({
-      router,
-      overallStatus$,
-      usageCollection,
-      config: {
-        kibanaIndex: '.kibana-test',
-        kibanaVersion: '8.8.8-SNAPSHOT',
-        server: {
-          name: 'mykibana',
-          hostname: 'mykibana.com',
-          port: 1234,
-        },
-        uuid: 'xxx-xxxxx',
-      },
-    });
-
-    await server.start();
-  });
-
-  afterEach(async () => {
-    await server.stop();
-  });
-
-  it('successfully returns data', async () => {
-    const response = await supertest(httpSetup.server.listener).get('/api/settings').expect(200);
-    expect(response.body).toMatchObject({
-      cluster_uuid: 'yyy-yyyyy',
-      settings: {
-        xpack: {
-          default_admin_email: 'kibana-machine@elastic.co',
-        },
-        kibana: {
-          uuid: 'xxx-xxxxx',
-          name: 'mykibana',
-          index: '.kibana-test',
-          host: 'mykibana.com',
-          locale: 'en',
-          transport_address: `mykibana.com:1234`,
-          version: '8.8.8',
-          snapshot: true,
-          status: 'green',
-        },
-      },
-    });
-  });
-});
diff --git a/x-pack/plugins/xpack_legacy/server/routes/settings.ts b/x-pack/plugins/xpack_legacy/server/routes/settings.ts
deleted file mode 100644
index b9052ca0c84e3d..00000000000000
--- a/x-pack/plugins/xpack_legacy/server/routes/settings.ts
+++ /dev/null
@@ -1,96 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { i18n } from '@kbn/i18n';
-import { Observable } from 'rxjs';
-import { first } from 'rxjs/operators';
-
-import { IRouter, ServiceStatus, ServiceStatusLevels } from '../../../../../src/core/server';
-import { UsageCollectionSetup } from '../../../../../src/plugins/usage_collection/server';
-import { KIBANA_SETTINGS_TYPE } from '../../../monitoring/common/constants';
-import { KibanaSettingsCollector } from '../../../monitoring/server';
-
-const SNAPSHOT_REGEX = /-snapshot/i;
-
-export function registerSettingsRoute({
-  router,
-  usageCollection,
-  overallStatus$,
-  config,
-}: {
-  router: IRouter;
-  usageCollection: UsageCollectionSetup;
-  overallStatus$: Observable<ServiceStatus>;
-  config: {
-    kibanaIndex: string;
-    kibanaVersion: string;
-    uuid: string;
-    server: {
-      name: string;
-      hostname: string;
-      port: number;
-    };
-  };
-}) {
-  router.get(
-    {
-      path: '/api/settings',
-      validate: false,
-    },
-    async (context, req, res) => {
-      const collectorFetchContext = {
-        esClient: context.core.elasticsearch.client.asCurrentUser,
-        soClient: context.core.savedObjects.client,
-      };
-
-      const settingsCollector = usageCollection.getCollectorByType(KIBANA_SETTINGS_TYPE) as
-        | KibanaSettingsCollector
-        | undefined;
-      if (!settingsCollector) {
-        throw new Error('The settings collector is not registered');
-      }
-
-      const settings =
-        (await settingsCollector.fetch(collectorFetchContext)) ??
-        settingsCollector.getEmailValueStructure(null);
-
-      const { body } = await collectorFetchContext.esClient.info({ filter_path: 'cluster_uuid' });
-      const uuid: string = body.cluster_uuid;
-
-      const overallStatus = await overallStatus$.pipe(first()).toPromise();
-
-      const kibana = {
-        uuid: config.uuid,
-        name: config.server.name,
-        index: config.kibanaIndex,
-        host: config.server.hostname,
-        port: config.server.port,
-        locale: i18n.getLocale(),
-        transport_address: `${config.server.hostname}:${config.server.port}`,
-        version: config.kibanaVersion.replace(SNAPSHOT_REGEX, ''),
-        snapshot: SNAPSHOT_REGEX.test(config.kibanaVersion),
-        status: ServiceStatusToLegacyState[overallStatus.level.toString()],
-      };
-      return res.ok({
-        body: {
-          cluster_uuid: uuid,
-          settings: {
-            ...settings,
-            kibana,
-          },
-        },
-      });
-    }
-  );
-}
-
-const ServiceStatusToLegacyState: Record<string, string> = {
-  [ServiceStatusLevels.critical.toString()]: 'red',
-  [ServiceStatusLevels.unavailable.toString()]: 'red',
-  [ServiceStatusLevels.degraded.toString()]: 'yellow',
-  [ServiceStatusLevels.available.toString()]: 'green',
-};
diff --git a/x-pack/plugins/xpack_legacy/tsconfig.json b/x-pack/plugins/xpack_legacy/tsconfig.json
deleted file mode 100644
index 57fccc031a0cf2..00000000000000
--- a/x-pack/plugins/xpack_legacy/tsconfig.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "extends": "../../../tsconfig.base.json",
-  "compilerOptions": {
-    "outDir": "./target/types",
-    "emitDeclarationOnly": true,
-    "declaration": true,
-    "declarationMap": true
-  },
-  "include": [
-    "server/**/*",
-  ],
-  "references": [
-    { "path": "../../../src/core/tsconfig.json" },
-    { "path": "../../../src/plugins/usage_collection/tsconfig.json" },
-    { "path": "../monitoring/tsconfig.json" },
-  ]
-}
diff --git a/x-pack/test/api_integration/apis/index.ts b/x-pack/test/api_integration/apis/index.ts
index eed39fd6dc6dce..c3d08ba3066927 100644
--- a/x-pack/test/api_integration/apis/index.ts
+++ b/x-pack/test/api_integration/apis/index.ts
@@ -16,7 +16,6 @@ export default function ({ loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./security'));
     loadTestFile(require.resolve('./spaces'));
     loadTestFile(require.resolve('./monitoring'));
-    loadTestFile(require.resolve('./xpack_legacy'));
     loadTestFile(require.resolve('./features'));
     loadTestFile(require.resolve('./telemetry'));
     loadTestFile(require.resolve('./logstash'));
diff --git a/x-pack/test/api_integration/apis/xpack_legacy/index.js b/x-pack/test/api_integration/apis/xpack_legacy/index.js
deleted file mode 100644
index 4d3046286fb9de..00000000000000
--- a/x-pack/test/api_integration/apis/xpack_legacy/index.js
+++ /dev/null
@@ -1,12 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export default function ({ loadTestFile }) {
-  describe('xpack_legacy', () => {
-    loadTestFile(require.resolve('./settings'));
-  });
-}
diff --git a/x-pack/test/api_integration/apis/xpack_legacy/settings/index.js b/x-pack/test/api_integration/apis/xpack_legacy/settings/index.js
deleted file mode 100644
index 3d8ce8d33b3d4d..00000000000000
--- a/x-pack/test/api_integration/apis/xpack_legacy/settings/index.js
+++ /dev/null
@@ -1,12 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export default function ({ loadTestFile }) {
-  describe('Settings', () => {
-    loadTestFile(require.resolve('./settings'));
-  });
-}
diff --git a/x-pack/test/api_integration/apis/xpack_legacy/settings/settings.js b/x-pack/test/api_integration/apis/xpack_legacy/settings/settings.js
deleted file mode 100644
index 6a82c5468a2c40..00000000000000
--- a/x-pack/test/api_integration/apis/xpack_legacy/settings/settings.js
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import expect from '@kbn/expect';
-
-export default function ({ getService }) {
-  const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
-
-  describe('/api/settings', () => {
-    describe('with trial license clusters', () => {
-      const archive = 'x-pack/test/functional/es_archives/monitoring/multicluster';
-
-      before('load clusters archive', () => {
-        return esArchiver.load(archive);
-      });
-
-      after('unload clusters archive', () => {
-        return esArchiver.unload(archive);
-      });
-
-      it('should load multiple clusters', async () => {
-        const { body } = await supertest.get('/api/settings').set('kbn-xsrf', 'xxx').expect(200);
-        expect(body.cluster_uuid.length > 1).to.eql(true);
-        expect(body.settings.kibana.uuid.length > 0).to.eql(true);
-        expect(body.settings.kibana.name.length > 0).to.eql(true);
-        expect(body.settings.kibana.index.length > 0).to.eql(true);
-        expect(body.settings.kibana.host.length > 0).to.eql(true);
-        expect(body.settings.kibana.transport_address.length > 0).to.eql(true);
-        expect(body.settings.kibana.version.length > 0).to.eql(true);
-        expect(body.settings.kibana.status.length > 0).to.eql(true);
-        expect(body.settings.xpack.default_admin_email).to.eql(null);
-      });
-    });
-  });
-}
diff --git a/x-pack/test/tsconfig.json b/x-pack/test/tsconfig.json
index 173403743235b3..1ffe3834d782da 100644
--- a/x-pack/test/tsconfig.json
+++ b/x-pack/test/tsconfig.json
@@ -102,7 +102,6 @@
     { "path": "../plugins/remote_clusters/tsconfig.json" },
     { "path": "../plugins/cross_cluster_replication/tsconfig.json" },
     { "path": "../plugins/index_lifecycle_management/tsconfig.json"},
-    { "path": "../plugins/uptime/tsconfig.json" },
-    { "path": "../plugins/xpack_legacy/tsconfig.json" }
+    { "path": "../plugins/uptime/tsconfig.json" }
   ]
 }

From fda421fab61bba5799ddcff1d70c8f4cc291a695 Mon Sep 17 00:00:00 2001
From: Chris Roberson <chrisronline@gmail.com>
Date: Wed, 13 Oct 2021 16:34:31 -0400
Subject: [PATCH 28/71] Always call resolve (#114670)

---
 .../components/alert_details_route.test.tsx   | 118 +++---------------
 .../components/alert_details_route.tsx        |  24 +---
 2 files changed, 26 insertions(+), 116 deletions(-)

diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details_route.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details_route.test.tsx
index c07138990f88d3..847c6c65464b26 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details_route.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details_route.test.tsx
@@ -19,20 +19,6 @@ import { spacesPluginMock } from '../../../../../../spaces/public/mocks';
 import { useKibana } from '../../../../common/lib/kibana';
 jest.mock('../../../../common/lib/kibana');
 
-class NotFoundError extends Error {
-  public readonly body: {
-    statusCode: number;
-    name: string;
-  } = {
-    statusCode: 404,
-    name: 'Not found',
-  };
-
-  constructor(message: string | undefined) {
-    super(message);
-  }
-}
-
 describe('alert_details_route', () => {
   beforeEach(() => {
     jest.clearAllMocks();
@@ -58,11 +44,8 @@ describe('alert_details_route', () => {
   it('redirects to another page if fetched rule is an aliasMatch', async () => {
     await setup();
     const rule = mockRule();
-    const { loadAlert, resolveRule } = mockApis();
+    const { resolveRule } = mockApis();
 
-    loadAlert.mockImplementationOnce(async () => {
-      throw new NotFoundError('OMG');
-    });
     resolveRule.mockImplementationOnce(async () => ({
       ...rule,
       id: 'new_id',
@@ -70,17 +53,13 @@ describe('alert_details_route', () => {
       alias_target_id: rule.id,
     }));
     const wrapper = mountWithIntl(
-      <AlertDetailsRoute
-        {...mockRouterProps(rule)}
-        {...{ ...mockApis(), loadAlert, resolveRule }}
-      />
+      <AlertDetailsRoute {...mockRouterProps(rule)} {...{ ...mockApis(), resolveRule }} />
     );
     await act(async () => {
       await nextTick();
       wrapper.update();
     });
 
-    expect(loadAlert).toHaveBeenCalledWith(rule.id);
     expect(resolveRule).toHaveBeenCalledWith(rule.id);
     expect((spacesMock as any).ui.redirectLegacyUrl).toHaveBeenCalledWith(
       `insightsAndAlerting/triggersActions/rule/new_id`,
@@ -96,11 +75,8 @@ describe('alert_details_route', () => {
       name: 'type name',
       authorizedConsumers: ['consumer'],
     };
-    const { loadAlert, loadAlertTypes, loadActionTypes, resolveRule } = mockApis();
+    const { loadAlertTypes, loadActionTypes, resolveRule } = mockApis();
 
-    loadAlert.mockImplementationOnce(async () => {
-      throw new NotFoundError('OMG');
-    });
     loadAlertTypes.mockImplementationOnce(async () => [ruleType]);
     loadActionTypes.mockImplementation(async () => []);
     resolveRule.mockImplementationOnce(async () => ({
@@ -112,7 +88,7 @@ describe('alert_details_route', () => {
     const wrapper = mountWithIntl(
       <AlertDetailsRoute
         {...mockRouterProps(rule)}
-        {...{ ...mockApis(), loadAlert, loadAlertTypes, loadActionTypes, resolveRule }}
+        {...{ ...mockApis(), loadAlertTypes, loadActionTypes, resolveRule }}
       />
     );
     await act(async () => {
@@ -120,7 +96,6 @@ describe('alert_details_route', () => {
       wrapper.update();
     });
 
-    expect(loadAlert).toHaveBeenCalledWith(rule.id);
     expect(resolveRule).toHaveBeenCalledWith(rule.id);
     expect((spacesMock as any).ui.components.getLegacyUrlConflict).toHaveBeenCalledWith({
       currentObjectId: 'new_id',
@@ -138,10 +113,10 @@ describe('getRuleData useEffect handler', () => {
 
   it('fetches rule', async () => {
     const rule = mockRule();
-    const { loadAlert, loadAlertTypes, loadActionTypes, resolveRule } = mockApis();
+    const { loadAlertTypes, loadActionTypes, resolveRule } = mockApis();
     const { setAlert, setAlertType, setActionTypes } = mockStateSetter();
 
-    loadAlert.mockImplementationOnce(async () => rule);
+    resolveRule.mockImplementationOnce(async () => rule);
 
     const toastNotifications = {
       addDanger: jest.fn(),
@@ -149,7 +124,6 @@ describe('getRuleData useEffect handler', () => {
 
     await getRuleData(
       rule.id,
-      loadAlert,
       loadAlertTypes,
       resolveRule,
       loadActionTypes,
@@ -159,8 +133,7 @@ describe('getRuleData useEffect handler', () => {
       toastNotifications
     );
 
-    expect(loadAlert).toHaveBeenCalledWith(rule.id);
-    expect(resolveRule).not.toHaveBeenCalled();
+    expect(resolveRule).toHaveBeenCalledWith(rule.id);
     expect(setAlert).toHaveBeenCalledWith(rule);
   });
 
@@ -184,10 +157,10 @@ describe('getRuleData useEffect handler', () => {
       id: rule.alertTypeId,
       name: 'type name',
     };
-    const { loadAlert, loadAlertTypes, loadActionTypes, resolveRule } = mockApis();
+    const { loadAlertTypes, loadActionTypes, resolveRule } = mockApis();
     const { setAlert, setAlertType, setActionTypes } = mockStateSetter();
 
-    loadAlert.mockImplementation(async () => rule);
+    resolveRule.mockImplementation(async () => rule);
     loadAlertTypes.mockImplementation(async () => [ruleType]);
     loadActionTypes.mockImplementation(async () => [connectorType]);
 
@@ -197,7 +170,6 @@ describe('getRuleData useEffect handler', () => {
 
     await getRuleData(
       rule.id,
-      loadAlert,
       loadAlertTypes,
       resolveRule,
       loadActionTypes,
@@ -209,58 +181,13 @@ describe('getRuleData useEffect handler', () => {
 
     expect(loadAlertTypes).toHaveBeenCalledTimes(1);
     expect(loadActionTypes).toHaveBeenCalledTimes(1);
-    expect(resolveRule).not.toHaveBeenCalled();
+    expect(resolveRule).toHaveBeenCalled();
 
     expect(setAlert).toHaveBeenCalledWith(rule);
     expect(setAlertType).toHaveBeenCalledWith(ruleType);
     expect(setActionTypes).toHaveBeenCalledWith([connectorType]);
   });
 
-  it('fetches rule using resolve if initial GET results in a 404 error', async () => {
-    const connectorType = {
-      id: '.server-log',
-      name: 'Server log',
-      enabled: true,
-    };
-    const rule = mockRule({
-      actions: [
-        {
-          group: '',
-          id: uuid.v4(),
-          actionTypeId: connectorType.id,
-          params: {},
-        },
-      ],
-    });
-
-    const { loadAlert, loadAlertTypes, loadActionTypes, resolveRule } = mockApis();
-    const { setAlert, setAlertType, setActionTypes } = mockStateSetter();
-
-    loadAlert.mockImplementationOnce(async () => {
-      throw new NotFoundError('OMG');
-    });
-    resolveRule.mockImplementationOnce(async () => rule);
-
-    const toastNotifications = {
-      addDanger: jest.fn(),
-    } as unknown as ToastsApi;
-    await getRuleData(
-      rule.id,
-      loadAlert,
-      loadAlertTypes,
-      resolveRule,
-      loadActionTypes,
-      setAlert,
-      setAlertType,
-      setActionTypes,
-      toastNotifications
-    );
-
-    expect(loadAlert).toHaveBeenCalledWith(rule.id);
-    expect(resolveRule).toHaveBeenCalledWith(rule.id);
-    expect(setAlert).toHaveBeenCalledWith(rule);
-  });
-
   it('displays an error if fetching the rule results in a non-404 error', async () => {
     const connectorType = {
       id: '.server-log',
@@ -278,10 +205,10 @@ describe('getRuleData useEffect handler', () => {
       ],
     });
 
-    const { loadAlert, loadAlertTypes, loadActionTypes, resolveRule } = mockApis();
+    const { loadAlertTypes, loadActionTypes, resolveRule } = mockApis();
     const { setAlert, setAlertType, setActionTypes } = mockStateSetter();
 
-    loadAlert.mockImplementation(async () => {
+    resolveRule.mockImplementation(async () => {
       throw new Error('OMG');
     });
 
@@ -290,7 +217,6 @@ describe('getRuleData useEffect handler', () => {
     } as unknown as ToastsApi;
     await getRuleData(
       rule.id,
-      loadAlert,
       loadAlertTypes,
       resolveRule,
       loadActionTypes,
@@ -322,10 +248,10 @@ describe('getRuleData useEffect handler', () => {
       ],
     });
 
-    const { loadAlert, loadAlertTypes, loadActionTypes, resolveRule } = mockApis();
+    const { loadAlertTypes, loadActionTypes, resolveRule } = mockApis();
     const { setAlert, setAlertType, setActionTypes } = mockStateSetter();
 
-    loadAlert.mockImplementation(async () => rule);
+    resolveRule.mockImplementation(async () => rule);
 
     loadAlertTypes.mockImplementation(async () => {
       throw new Error('OMG no rule type');
@@ -337,7 +263,6 @@ describe('getRuleData useEffect handler', () => {
     } as unknown as ToastsApi;
     await getRuleData(
       rule.id,
-      loadAlert,
       loadAlertTypes,
       resolveRule,
       loadActionTypes,
@@ -373,10 +298,10 @@ describe('getRuleData useEffect handler', () => {
       name: 'type name',
     };
 
-    const { loadAlert, loadAlertTypes, loadActionTypes, resolveRule } = mockApis();
+    const { loadAlertTypes, loadActionTypes, resolveRule } = mockApis();
     const { setAlert, setAlertType, setActionTypes } = mockStateSetter();
 
-    loadAlert.mockImplementation(async () => rule);
+    resolveRule.mockImplementation(async () => rule);
 
     loadAlertTypes.mockImplementation(async () => [ruleType]);
     loadActionTypes.mockImplementation(async () => {
@@ -388,7 +313,6 @@ describe('getRuleData useEffect handler', () => {
     } as unknown as ToastsApi;
     await getRuleData(
       rule.id,
-      loadAlert,
       loadAlertTypes,
       resolveRule,
       loadActionTypes,
@@ -425,10 +349,10 @@ describe('getRuleData useEffect handler', () => {
       name: 'type name',
     };
 
-    const { loadAlert, loadAlertTypes, loadActionTypes, resolveRule } = mockApis();
+    const { loadAlertTypes, loadActionTypes, resolveRule } = mockApis();
     const { setAlert, setAlertType, setActionTypes } = mockStateSetter();
 
-    loadAlert.mockImplementation(async () => rule);
+    resolveRule.mockImplementation(async () => rule);
     loadAlertTypes.mockImplementation(async () => [ruleType]);
     loadActionTypes.mockImplementation(async () => [connectorType]);
 
@@ -437,7 +361,6 @@ describe('getRuleData useEffect handler', () => {
     } as unknown as ToastsApi;
     await getRuleData(
       rule.id,
-      loadAlert,
       loadAlertTypes,
       resolveRule,
       loadActionTypes,
@@ -485,10 +408,10 @@ describe('getRuleData useEffect handler', () => {
       name: 'type name',
     };
 
-    const { loadAlert, loadAlertTypes, loadActionTypes, resolveRule } = mockApis();
+    const { loadAlertTypes, loadActionTypes, resolveRule } = mockApis();
     const { setAlert, setAlertType, setActionTypes } = mockStateSetter();
 
-    loadAlert.mockImplementation(async () => rule);
+    resolveRule.mockImplementation(async () => rule);
     loadAlertTypes.mockImplementation(async () => [ruleType]);
     loadActionTypes.mockImplementation(async () => [availableConnectorType]);
 
@@ -497,7 +420,6 @@ describe('getRuleData useEffect handler', () => {
     } as unknown as ToastsApi;
     await getRuleData(
       rule.id,
-      loadAlert,
       loadAlertTypes,
       resolveRule,
       loadActionTypes,
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details_route.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details_route.tsx
index 123d60bb9fea32..b530df986c277d 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details_route.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details_route.tsx
@@ -10,7 +10,7 @@ import React, { useState, useEffect } from 'react';
 import { RouteComponentProps } from 'react-router-dom';
 import { ToastsApi } from 'kibana/public';
 import { EuiSpacer } from '@elastic/eui';
-import { Alert, AlertType, ActionType, ResolvedRule } from '../../../../types';
+import { AlertType, ActionType, ResolvedRule } from '../../../../types';
 import { AlertDetailsWithApi as AlertDetails } from './alert_details';
 import { throwIfAbsent, throwIfIsntContained } from '../../../lib/value_validators';
 import {
@@ -28,13 +28,12 @@ type AlertDetailsRouteProps = RouteComponentProps<{
   ruleId: string;
 }> &
   Pick<ActionApis, 'loadActionTypes'> &
-  Pick<AlertApis, 'loadAlert' | 'loadAlertTypes' | 'resolveRule'>;
+  Pick<AlertApis, 'loadAlertTypes' | 'resolveRule'>;
 
 export const AlertDetailsRoute: React.FunctionComponent<AlertDetailsRouteProps> = ({
   match: {
     params: { ruleId },
   },
-  loadAlert,
   loadAlertTypes,
   loadActionTypes,
   resolveRule,
@@ -47,14 +46,13 @@ export const AlertDetailsRoute: React.FunctionComponent<AlertDetailsRouteProps>
 
   const { basePath } = http;
 
-  const [alert, setAlert] = useState<Alert | ResolvedRule | null>(null);
+  const [alert, setAlert] = useState<ResolvedRule | null>(null);
   const [alertType, setAlertType] = useState<AlertType | null>(null);
   const [actionTypes, setActionTypes] = useState<ActionType[] | null>(null);
   const [refreshToken, requestRefresh] = React.useState<number>();
   useEffect(() => {
     getRuleData(
       ruleId,
-      loadAlert,
       loadAlertTypes,
       resolveRule,
       loadActionTypes,
@@ -63,7 +61,7 @@ export const AlertDetailsRoute: React.FunctionComponent<AlertDetailsRouteProps>
       setActionTypes,
       toasts
     );
-  }, [ruleId, http, loadActionTypes, loadAlert, loadAlertTypes, resolveRule, toasts, refreshToken]);
+  }, [ruleId, http, loadActionTypes, loadAlertTypes, resolveRule, toasts, refreshToken]);
 
   useEffect(() => {
     if (alert) {
@@ -128,26 +126,16 @@ export const AlertDetailsRoute: React.FunctionComponent<AlertDetailsRouteProps>
 
 export async function getRuleData(
   ruleId: string,
-  loadAlert: AlertApis['loadAlert'],
   loadAlertTypes: AlertApis['loadAlertTypes'],
   resolveRule: AlertApis['resolveRule'],
   loadActionTypes: ActionApis['loadActionTypes'],
-  setAlert: React.Dispatch<React.SetStateAction<Alert | ResolvedRule | null>>,
+  setAlert: React.Dispatch<React.SetStateAction<ResolvedRule | null>>,
   setAlertType: React.Dispatch<React.SetStateAction<AlertType | null>>,
   setActionTypes: React.Dispatch<React.SetStateAction<ActionType[] | null>>,
   toasts: Pick<ToastsApi, 'addDanger'>
 ) {
   try {
-    let loadedRule: Alert | ResolvedRule;
-    try {
-      loadedRule = await loadAlert(ruleId);
-    } catch (err) {
-      // Try resolving this rule id if the error is a 404, otherwise re-throw
-      if (err?.body?.statusCode !== 404) {
-        throw err;
-      }
-      loadedRule = await resolveRule(ruleId);
-    }
+    const loadedRule: ResolvedRule = await resolveRule(ruleId);
     setAlert(loadedRule);
 
     const [loadedAlertType, loadedActionTypes] = await Promise.all<AlertType, ActionType[]>([

From d822d6dc3229c45195fc2eea588e475b24c89dd7 Mon Sep 17 00:00:00 2001
From: Nick Peihl <nick.peihl@elastic.co>
Date: Wed, 13 Oct 2021 13:45:53 -0700
Subject: [PATCH 29/71] Update kibana to EMS 7.16 (#114865)

* Update kibana to EMS 7.16

* Update license override
---
 package.json                         |  2 +-
 src/dev/license_checker/config.ts    |  2 +-
 src/plugins/maps_ems/common/index.ts |  2 +-
 yarn.lock                            | 20 ++++++++++----------
 4 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/package.json b/package.json
index e9aea2d2adda31..f526f357ff3476 100644
--- a/package.json
+++ b/package.json
@@ -101,7 +101,7 @@
     "@elastic/charts": "37.0.0",
     "@elastic/datemath": "link:bazel-bin/packages/elastic-datemath",
     "@elastic/elasticsearch": "npm:@elastic/elasticsearch-canary@^8.0.0-canary.21",
-    "@elastic/ems-client": "7.15.0",
+    "@elastic/ems-client": "7.16.0",
     "@elastic/eui": "39.0.0",
     "@elastic/filesaver": "1.1.2",
     "@elastic/maki": "6.3.0",
diff --git a/src/dev/license_checker/config.ts b/src/dev/license_checker/config.ts
index 818ea3675194ed..a4ae39848735e1 100644
--- a/src/dev/license_checker/config.ts
+++ b/src/dev/license_checker/config.ts
@@ -74,7 +74,7 @@ export const DEV_ONLY_LICENSE_ALLOWED = ['MPL-2.0'];
 export const LICENSE_OVERRIDES = {
   'jsts@1.6.2': ['Eclipse Distribution License - v 1.0'], // cf. https://github.com/bjornharrtell/jsts
   '@mapbox/jsonlint-lines-primitives@2.0.2': ['MIT'], // license in readme https://github.com/tmcw/jsonlint
-  '@elastic/ems-client@7.15.0': ['Elastic License 2.0'],
+  '@elastic/ems-client@7.16.0': ['Elastic License 2.0'],
   '@elastic/eui@39.0.0': ['SSPL-1.0 OR Elastic License 2.0'],
   'language-subtag-registry@0.3.21': ['CC-BY-4.0'], // retired ODC‑By license https://github.com/mattcg/language-subtag-registry
 };
diff --git a/src/plugins/maps_ems/common/index.ts b/src/plugins/maps_ems/common/index.ts
index f7d7ff1102e593..26fdb4fa795fe6 100644
--- a/src/plugins/maps_ems/common/index.ts
+++ b/src/plugins/maps_ems/common/index.ts
@@ -10,7 +10,7 @@ export const TMS_IN_YML_ID = 'TMS in config/kibana.yml';
 
 export const DEFAULT_EMS_FILE_API_URL = 'https://vector.maps.elastic.co';
 export const DEFAULT_EMS_TILE_API_URL = 'https://tiles.maps.elastic.co';
-export const DEFAULT_EMS_LANDING_PAGE_URL = 'https://maps.elastic.co/v7.15';
+export const DEFAULT_EMS_LANDING_PAGE_URL = 'https://maps.elastic.co/v7.16';
 export const DEFAULT_EMS_FONT_LIBRARY_URL =
   'https://tiles.maps.elastic.co/fonts/{fontstack}/{range}.pbf';
 
diff --git a/yarn.lock b/yarn.lock
index 05d03a637eaeed..70e2a452e87dcf 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2389,10 +2389,10 @@
     ms "^2.1.3"
     secure-json-parse "^2.4.0"
 
-"@elastic/ems-client@7.15.0":
-  version "7.15.0"
-  resolved "https://registry.yarnpkg.com/@elastic/ems-client/-/ems-client-7.15.0.tgz#c101d7f83aa56463bcc385fd4eb883c6ea3ae9fc"
-  integrity sha512-BAAAVPhoaH6SGrfuO6U0MVRg4lvblhJ9VqYlMf3dZN9uDBB+12CUtb6t6Kavn5Tr3nS6X3tU/KKsuomo5RrEeQ==
+"@elastic/ems-client@7.16.0":
+  version "7.16.0"
+  resolved "https://registry.yarnpkg.com/@elastic/ems-client/-/ems-client-7.16.0.tgz#92db94126bac0b95fbf156fe609f68979e7af4b6"
+  integrity sha512-NgMB5vqj6I7lxVsysrz6eB1EW6gsZj7SWWs79WSiiKQeNuRg82tJhvbHQnWezjIS4UKOtoGxZsg475EHVZB46g==
   dependencies:
     "@types/geojson" "^7946.0.7"
     "@types/lru-cache" "^5.1.0"
@@ -2400,7 +2400,7 @@
     "@types/topojson-specification" "^1.0.1"
     lodash "^4.17.15"
     lru-cache "^6.0.0"
-    semver "7.3.2"
+    semver "^7.3.2"
     topojson-client "^3.1.0"
 
 "@elastic/eslint-config-kibana@link:bazel-bin/packages/elastic-eslint-config-kibana":
@@ -25810,16 +25810,16 @@ semver@7.0.0:
   resolved "https://registry.yarnpkg.com/semver/-/semver-7.0.0.tgz#5f3ca35761e47e05b206c6daff2cf814f0316b8e"
   integrity sha512-+GB6zVA9LWh6zovYQLALHwv5rb2PHGlJi3lfiqIHxR0uuwCgefcOJc59v9fv1w8GbStwxuuqqAjI9NMAOOgq1A==
 
-semver@7.3.2, semver@^7.2.1, semver@^7.3.2, semver@~7.3.2:
-  version "7.3.2"
-  resolved "https://registry.yarnpkg.com/semver/-/semver-7.3.2.tgz#604962b052b81ed0786aae84389ffba70ffd3938"
-  integrity sha512-OrOb32TeeambH6UrhtShmF7CRDqhL6/5XpPNp2DuRH6+9QLw/orhp72j87v8Qa1ScDkvrrBNpZcDejAirJmfXQ==
-
 semver@^6.0.0, semver@^6.1.0, semver@^6.1.1, semver@^6.1.2, semver@^6.2.0, semver@^6.3.0:
   version "6.3.0"
   resolved "https://registry.yarnpkg.com/semver/-/semver-6.3.0.tgz#ee0a64c8af5e8ceea67687b133761e1becbd1d3d"
   integrity sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==
 
+semver@^7.2.1, semver@^7.3.2, semver@~7.3.2:
+  version "7.3.2"
+  resolved "https://registry.yarnpkg.com/semver/-/semver-7.3.2.tgz#604962b052b81ed0786aae84389ffba70ffd3938"
+  integrity sha512-OrOb32TeeambH6UrhtShmF7CRDqhL6/5XpPNp2DuRH6+9QLw/orhp72j87v8Qa1ScDkvrrBNpZcDejAirJmfXQ==
+
 semver@^7.3.4, semver@^7.3.5:
   version "7.3.5"
   resolved "https://registry.yarnpkg.com/semver/-/semver-7.3.5.tgz#0b621c879348d8998e4b0e4be94b3f12e6018ef7"

From 77ad8fe9912cd65fd6cd0ef1de23900fcccfe4e2 Mon Sep 17 00:00:00 2001
From: Brandon Morelli <brandon.morelli@elastic.co>
Date: Wed, 13 Oct 2021 14:21:50 -0700
Subject: [PATCH 30/71] docs: fix config names (#114903)

---
 docs/apm/api.asciidoc             | 3 +--
 docs/apm/troubleshooting.asciidoc | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/docs/apm/api.asciidoc b/docs/apm/api.asciidoc
index fe4c8a9280158b..5f81a41e93df89 100644
--- a/docs/apm/api.asciidoc
+++ b/docs/apm/api.asciidoc
@@ -484,8 +484,7 @@ An example is below.
 [[api-create-apm-index-pattern]]
 ==== Customize the APM index pattern
 
-As an alternative to updating <<apm-settings-in-kibana,`apm_oss.indexPattern`>> in your `kibana.yml` configuration file,
-you can use Kibana's <<saved-objects-api-update,update object API>> to update the default APM index pattern on the fly.
+Use Kibana's <<saved-objects-api-update,update object API>> to update the default APM index pattern on the fly.
 
 The following example sets the default APM app index pattern to `some-other-pattern-*`:
 
diff --git a/docs/apm/troubleshooting.asciidoc b/docs/apm/troubleshooting.asciidoc
index 3736d21f44a5bb..84cdb9876dc630 100644
--- a/docs/apm/troubleshooting.asciidoc
+++ b/docs/apm/troubleshooting.asciidoc
@@ -76,7 +76,7 @@ If you change the default, you must also configure the `setup.template.name` and
 See {apm-server-ref}/configuration-template.html[Load the Elasticsearch index template].
 If the Elasticsearch index template has already been successfully loaded to the index,
 you can customize the indices that the APM app uses to display data.
-Navigate to *APM* > *Settings* > *Indices*, and change all `xpack.apm.*Pattern` values to
+Navigate to *APM* > *Settings* > *Indices*, and change all `xpack.apm.indices.*` values to
 include the new index pattern. For example: `customIndexName-*`.
 
 [float]

From c737c393cf55518cc1bdda31b7a7da7e51403f36 Mon Sep 17 00:00:00 2001
From: Yuliia Naumenko <jo.naumenko@gmail.com>
Date: Wed, 13 Oct 2021 14:22:40 -0700
Subject: [PATCH 31/71] [Actions] Fixed actions telemetry for multiple
 namespaces usage (#114748)

* [Actions] Fixed actions telemetry for multiple namespaces usage

* fixed tests
---
 .../server/usage/actions_telemetry.test.ts    | 159 ++++++++++--------
 .../actions/server/usage/actions_telemetry.ts |  46 +++--
 x-pack/plugins/actions/server/usage/task.ts   |  21 +--
 3 files changed, 121 insertions(+), 105 deletions(-)

diff --git a/x-pack/plugins/actions/server/usage/actions_telemetry.test.ts b/x-pack/plugins/actions/server/usage/actions_telemetry.test.ts
index 4049d8fc3b5943..0e6b7fff04451b 100644
--- a/x-pack/plugins/actions/server/usage/actions_telemetry.test.ts
+++ b/x-pack/plugins/actions/server/usage/actions_telemetry.test.ts
@@ -116,7 +116,7 @@ Object {
 
   test('getInUseTotalCount', async () => {
     const mockEsClient = elasticsearchClientMock.createClusterClient().asScoped().asInternalUser;
-    mockEsClient.search.mockReturnValue(
+    mockEsClient.search.mockReturnValueOnce(
       // @ts-expect-error not full search response
       elasticsearchClientMock.createSuccessTransportRequestPromise({
         aggregations: {
@@ -134,28 +134,35 @@ Object {
         },
       })
     );
-    const actionsBulkGet = jest.fn();
-    actionsBulkGet.mockReturnValue({
-      saved_objects: [
-        {
-          id: '1',
-          attributes: {
-            actionTypeId: '.server-log',
-          },
-        },
-        {
-          id: '123',
-          attributes: {
-            actionTypeId: '.slack',
-          },
-        },
-      ],
-    });
-    const telemetry = await getInUseTotalCount(mockEsClient, actionsBulkGet, 'test');
 
-    expect(mockEsClient.search).toHaveBeenCalledTimes(1);
-    expect(actionsBulkGet).toHaveBeenCalledTimes(1);
+    mockEsClient.search.mockReturnValueOnce(
+      // @ts-expect-error not full search response
+      elasticsearchClientMock.createSuccessTransportRequestPromise({
+        hits: {
+          hits: [
+            {
+              _source: {
+                action: {
+                  id: '1',
+                  actionTypeId: '.server-log',
+                },
+              },
+            },
+            {
+              _source: {
+                action: {
+                  id: '2',
+                  actionTypeId: '.slack',
+                },
+              },
+            },
+          ],
+        },
+      })
+    );
+    const telemetry = await getInUseTotalCount(mockEsClient, 'test');
 
+    expect(mockEsClient.search).toHaveBeenCalledTimes(2);
     expect(telemetry).toMatchInlineSnapshot(`
 Object {
   "countByAlertHistoryConnectorType": 0,
@@ -170,7 +177,7 @@ Object {
 
   test('getInUseTotalCount should count preconfigured alert history connector usage', async () => {
     const mockEsClient = elasticsearchClientMock.createClusterClient().asScoped().asInternalUser;
-    mockEsClient.search.mockReturnValue(
+    mockEsClient.search.mockReturnValueOnce(
       // @ts-expect-error not full search response
       elasticsearchClientMock.createSuccessTransportRequestPromise({
         aggregations: {
@@ -202,28 +209,34 @@ Object {
         },
       })
     );
-    const actionsBulkGet = jest.fn();
-    actionsBulkGet.mockReturnValue({
-      saved_objects: [
-        {
-          id: '1',
-          attributes: {
-            actionTypeId: '.server-log',
-          },
-        },
-        {
-          id: '123',
-          attributes: {
-            actionTypeId: '.slack',
-          },
+    mockEsClient.search.mockReturnValueOnce(
+      // @ts-expect-error not full search response
+      elasticsearchClientMock.createSuccessTransportRequestPromise({
+        hits: {
+          hits: [
+            {
+              _source: {
+                action: {
+                  id: '1',
+                  actionTypeId: '.server-log',
+                },
+              },
+            },
+            {
+              _source: {
+                action: {
+                  id: '2',
+                  actionTypeId: '.slack',
+                },
+              },
+            },
+          ],
         },
-      ],
-    });
-    const telemetry = await getInUseTotalCount(mockEsClient, actionsBulkGet, 'test');
-
-    expect(mockEsClient.search).toHaveBeenCalledTimes(1);
-    expect(actionsBulkGet).toHaveBeenCalledTimes(1);
+      })
+    );
+    const telemetry = await getInUseTotalCount(mockEsClient, 'test');
 
+    expect(mockEsClient.search).toHaveBeenCalledTimes(2);
     expect(telemetry).toMatchInlineSnapshot(`
 Object {
   "countByAlertHistoryConnectorType": 1,
@@ -359,7 +372,7 @@ Object {
 
   test('getInUseTotalCount() accounts for preconfigured connectors', async () => {
     const mockEsClient = elasticsearchClientMock.createClusterClient().asScoped().asInternalUser;
-    mockEsClient.search.mockReturnValue(
+    mockEsClient.search.mockReturnValueOnce(
       // @ts-expect-error not full search response
       elasticsearchClientMock.createSuccessTransportRequestPromise({
         aggregations: {
@@ -399,34 +412,42 @@ Object {
         },
       })
     );
-    const actionsBulkGet = jest.fn();
-    actionsBulkGet.mockReturnValue({
-      saved_objects: [
-        {
-          id: '1',
-          attributes: {
-            actionTypeId: '.server-log',
-          },
-        },
-        {
-          id: '123',
-          attributes: {
-            actionTypeId: '.slack',
-          },
-        },
-        {
-          id: '456',
-          attributes: {
-            actionTypeId: '.email',
-          },
+    mockEsClient.search.mockReturnValueOnce(
+      // @ts-expect-error not full search response
+      elasticsearchClientMock.createSuccessTransportRequestPromise({
+        hits: {
+          hits: [
+            {
+              _source: {
+                action: {
+                  id: '1',
+                  actionTypeId: '.server-log',
+                },
+              },
+            },
+            {
+              _source: {
+                action: {
+                  id: '2',
+                  actionTypeId: '.slack',
+                },
+              },
+            },
+            {
+              _source: {
+                action: {
+                  id: '3',
+                  actionTypeId: '.email',
+                },
+              },
+            },
+          ],
         },
-      ],
-    });
-    const telemetry = await getInUseTotalCount(mockEsClient, actionsBulkGet, 'test');
-
-    expect(mockEsClient.search).toHaveBeenCalledTimes(1);
-    expect(actionsBulkGet).toHaveBeenCalledTimes(1);
+      })
+    );
+    const telemetry = await getInUseTotalCount(mockEsClient, 'test');
 
+    expect(mockEsClient.search).toHaveBeenCalledTimes(2);
     expect(telemetry).toMatchInlineSnapshot(`
 Object {
   "countByAlertHistoryConnectorType": 1,
diff --git a/x-pack/plugins/actions/server/usage/actions_telemetry.ts b/x-pack/plugins/actions/server/usage/actions_telemetry.ts
index 544d6a411ccdc7..4a3d0c70e535ae 100644
--- a/x-pack/plugins/actions/server/usage/actions_telemetry.ts
+++ b/x-pack/plugins/actions/server/usage/actions_telemetry.ts
@@ -5,12 +5,7 @@
  * 2.0.
  */
 
-import {
-  ElasticsearchClient,
-  SavedObjectsBaseOptions,
-  SavedObjectsBulkGetObject,
-  SavedObjectsBulkResponse,
-} from 'kibana/server';
+import { ElasticsearchClient } from 'kibana/server';
 import { AlertHistoryEsIndexConnectorId } from '../../common';
 import { ActionResult, PreConfiguredAction } from '../types';
 
@@ -86,10 +81,6 @@ export async function getTotalCount(
 
 export async function getInUseTotalCount(
   esClient: ElasticsearchClient,
-  actionsBulkGet: (
-    objects?: SavedObjectsBulkGetObject[] | undefined,
-    options?: SavedObjectsBaseOptions | undefined
-  ) => Promise<SavedObjectsBulkResponse<ActionResult<Record<string, unknown>>>>,
   kibanaIndex: string
 ): Promise<{
   countTotal: number;
@@ -259,15 +250,34 @@ export async function getInUseTotalCount(
   const preconfiguredActionsAggs =
     // @ts-expect-error aggegation type is not specified
     actionResults.aggregations.preconfigured_actions?.preconfiguredActionRefIds.value;
-  const bulkFilter = Object.entries(aggs.connectorIds).map(([key]) => ({
-    id: key,
-    type: 'action',
-    fields: ['id', 'actionTypeId'],
-  }));
-  const actions = await actionsBulkGet(bulkFilter);
-  const countByActionTypeId = actions.saved_objects.reduce(
+  const {
+    body: { hits: actions },
+  } = await esClient.search<{
+    action: ActionResult;
+  }>({
+    index: kibanaIndex,
+    _source_includes: ['action'],
+    body: {
+      query: {
+        bool: {
+          must: [
+            {
+              term: { type: 'action' },
+            },
+            {
+              terms: {
+                _id: Object.entries(aggs.connectorIds).map(([key]) => `action:${key}`),
+              },
+            },
+          ],
+        },
+      },
+    },
+  });
+  const countByActionTypeId = actions.hits.reduce(
     (actionTypeCount: Record<string, number>, action) => {
-      const alertTypeId = replaceFirstAndLastDotSymbols(action.attributes.actionTypeId);
+      const actionSource = action._source!;
+      const alertTypeId = replaceFirstAndLastDotSymbols(actionSource.action.actionTypeId);
       const currentCount =
         actionTypeCount[alertTypeId] !== undefined ? actionTypeCount[alertTypeId] : 0;
       actionTypeCount[alertTypeId] = currentCount + 1;
diff --git a/x-pack/plugins/actions/server/usage/task.ts b/x-pack/plugins/actions/server/usage/task.ts
index f37f830697eb58..7cbfb87dedda62 100644
--- a/x-pack/plugins/actions/server/usage/task.ts
+++ b/x-pack/plugins/actions/server/usage/task.ts
@@ -5,19 +5,14 @@
  * 2.0.
  */
 
-import {
-  Logger,
-  CoreSetup,
-  SavedObjectsBulkGetObject,
-  SavedObjectsBaseOptions,
-} from 'kibana/server';
+import { Logger, CoreSetup } from 'kibana/server';
 import moment from 'moment';
 import {
   RunContext,
   TaskManagerSetupContract,
   TaskManagerStartContract,
 } from '../../../task_manager/server';
-import { ActionResult, PreConfiguredAction } from '../types';
+import { PreConfiguredAction } from '../types';
 import { getTotalCount, getInUseTotalCount } from './actions_telemetry';
 
 export const TELEMETRY_TASK_TYPE = 'actions_telemetry';
@@ -83,22 +78,12 @@ export function telemetryTaskRunner(
           },
         ]) => client.asInternalUser
       );
-    const actionsBulkGet = (
-      objects?: SavedObjectsBulkGetObject[],
-      options?: SavedObjectsBaseOptions
-    ) => {
-      return core
-        .getStartServices()
-        .then(([{ savedObjects }]) =>
-          savedObjects.createInternalRepository(['action']).bulkGet<ActionResult>(objects, options)
-        );
-    };
     return {
       async run() {
         const esClient = await getEsClient();
         return Promise.all([
           getTotalCount(esClient, kibanaIndex, preconfiguredActions),
-          getInUseTotalCount(esClient, actionsBulkGet, kibanaIndex),
+          getInUseTotalCount(esClient, kibanaIndex),
         ])
           .then(([totalAggegations, totalInUse]) => {
             return {

From 493b408673f708f7c58eb676194ac0cc90024dda Mon Sep 17 00:00:00 2001
From: Scotty Bollinger <scotty.bollinger@elastic.co>
Date: Wed, 13 Oct 2021 17:14:14 -0500
Subject: [PATCH 32/71] [Workplace Search] Fix button order and remove extra
 source name label (#114899)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Remove extra source title from Personal dashboard

* Change button order to match other views

We typically have the right-most button the Save button and the reset button to the left

* Fix typo

* Fix failing test

EUI requires the name but we don’t want to dispaly it, so sending an empty string

* Remove Synchronization nav items from Custom Source

* Hide syncTriggerCallout for custom sources
---
 .../personal_dashboard_sidebar/private_sources_sidebar.tsx  | 4 ++--
 .../views/content_sources/components/overview.tsx           | 5 +++--
 .../views/content_sources/components/source_sub_nav.tsx     | 2 +-
 .../workplace_search/views/security/security.tsx            | 6 +++---
 4 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/layout/personal_dashboard_sidebar/private_sources_sidebar.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/layout/personal_dashboard_sidebar/private_sources_sidebar.tsx
index 6cd7a10fc7ade1..c8eaffbfbec106 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/layout/personal_dashboard_sidebar/private_sources_sidebar.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/layout/personal_dashboard_sidebar/private_sources_sidebar.tsx
@@ -35,10 +35,10 @@ export const PrivateSourcesSidebar = () => {
     : PRIVATE_VIEW_ONLY_PAGE_DESCRIPTION;
 
   const {
-    contentSource: { id = '', name = '' },
+    contentSource: { id = '' },
   } = useValues(SourceLogic);
 
-  const navItems = [{ id, name, items: useSourceSubNav() }];
+  const navItems = [{ id, name: '', items: useSourceSubNav() }];
 
   return (
     <>
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/overview.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/overview.tsx
index 899d9dceebe3ec..9441f43dc253f6 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/overview.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/overview.tsx
@@ -119,6 +119,7 @@ export const Overview: React.FC = () => {
   const [isModalVisible, setIsModalVisible] = useState(false);
   const closeModal = () => setIsModalVisible(false);
   const handleSyncClick = () => setIsModalVisible(true);
+  const showSyncTriggerCallout = !custom && isIndexedSource && isOrganization;
 
   const onSyncConfirm = () => {
     initializeSourceSynchronization(id);
@@ -491,7 +492,7 @@ export const Overview: React.FC = () => {
         <EuiText size="s">
           <FormattedMessage
             id="xpack.enterpriseSearch.workplaceSearch.sources.synchronizationCallout"
-            defaultMessage="Configure {syncFrequencyLink} or permissions {blockTimeWindowsLink}."
+            defaultMessage="Configure {syncFrequencyLink} or {blockTimeWindowsLink}."
             values={{
               syncFrequencyLink: (
                 <EuiLinkTo to={getContentSourcePath(SYNC_FREQUENCY_PATH, id, isOrganization)}>
@@ -586,7 +587,7 @@ export const Overview: React.FC = () => {
                 )}
               </>
             )}
-            {isIndexedSource && isOrganization && syncTriggerCallout}
+            {showSyncTriggerCallout && syncTriggerCallout}
           </EuiFlexGroup>
         </EuiFlexItem>
       </EuiFlexGroup>
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_sub_nav.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_sub_nav.tsx
index cae1e8834cdd23..99597023303ff5 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_sub_nav.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_sub_nav.tsx
@@ -37,7 +37,7 @@ export const useSourceSubNav = () => {
   if (!id) return undefined;
 
   const isCustom = serviceType === CUSTOM_SERVICE_TYPE;
-  const showSynchronization = isIndexedSource && isOrganization;
+  const showSynchronization = isIndexedSource && isOrganization && !isCustom;
 
   const navItems: Array<EuiSideNavItemType<unknown>> = [
     {
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/security/security.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/security/security.tsx
index a971df8f89914b..997d79f67cb137 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/security/security.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/security/security.tsx
@@ -75,9 +75,6 @@ export const Security: React.FC = () => {
   };
 
   const headerActions = [
-    <EuiButtonEmpty disabled={!unsavedChanges || dataLoading} onClick={resetState}>
-      {RESET_BUTTON}
-    </EuiButtonEmpty>,
     <EuiButton
       disabled={!hasPlatinumLicense || !unsavedChanges || dataLoading}
       onClick={showConfirmModal}
@@ -86,6 +83,9 @@ export const Security: React.FC = () => {
     >
       {SAVE_SETTINGS_BUTTON}
     </EuiButton>,
+    <EuiButtonEmpty disabled={!unsavedChanges || dataLoading} onClick={resetState}>
+      {RESET_BUTTON}
+    </EuiButtonEmpty>,
   ];
 
   const allSourcesToggle = (

From e5576d688d843e895201d6993bdebe6d131ba15d Mon Sep 17 00:00:00 2001
From: Oliver Gupte <ogupte@users.noreply.github.com>
Date: Wed, 13 Oct 2021 18:46:04 -0400
Subject: [PATCH 33/71] [APM] Fixes incorrect index config names (#114901)
 (#114904)

---
 .../resources/base/bin/kibana-docker          | 10 +++++-----
 .../integration/power_user/no_data_screen.ts  | 20 +++++++++----------
 .../plugins/apm/public/utils/testHelpers.tsx  | 20 +++++++++----------
 .../encrypted_saved_objects/mappings.json     | 10 +++++-----
 .../mappings.json                             | 10 +++++-----
 .../es_archiver/key_rotation/mappings.json    | 10 +++++-----
 .../action_task_params/mappings.json          | 10 +++++-----
 .../es_archives/actions/mappings.json         | 10 +++++-----
 .../es_archives/alerts_legacy/mappings.json   | 10 +++++-----
 .../es_archives/canvas/reports/mappings.json  | 10 +++++-----
 .../cases/migrations/7.10.0/mappings.json     | 10 +++++-----
 .../cases/migrations/7.11.1/mappings.json     | 10 +++++-----
 .../cases/migrations/7.13.2/mappings.json     | 10 +++++-----
 .../7.13_user_actions/mappings.json           | 10 +++++-----
 .../migrations/7.16.0_space/mappings.json     | 10 +++++-----
 .../data/search_sessions/mappings.json        | 10 +++++-----
 .../telemetry/agent_only/mappings.json        | 10 +++++-----
 .../mappings.json                             | 10 +++++-----
 .../cloned_endpoint_installed/mappings.json   | 10 +++++-----
 .../cloned_endpoint_uninstalled/mappings.json | 10 +++++-----
 .../endpoint_malware_disabled/mappings.json   | 10 +++++-----
 .../endpoint_malware_enabled/mappings.json    | 10 +++++-----
 .../endpoint_uninstalled/mappings.json        | 10 +++++-----
 .../es_archives/fleet/agents/mappings.json    | 10 +++++-----
 .../mappings.json                             | 10 +++++-----
 .../es_archives/lists/mappings.json           | 10 +++++-----
 .../canvas_disallowed_url/mappings.json       | 10 +++++-----
 .../ecommerce_kibana_spaces/mappings.json     | 10 +++++-----
 .../reporting/hugedata/mappings.json          | 10 +++++-----
 .../multi_index_kibana/mappings.json          | 10 +++++-----
 .../migrations/mappings.json                  | 10 +++++-----
 .../timelines/7.15.0/mappings.json            | 10 +++++-----
 .../timelines/7.15.0_space/mappings.json      | 10 +++++-----
 .../visualize/default/mappings.json           | 10 +++++-----
 34 files changed, 180 insertions(+), 180 deletions(-)

diff --git a/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker b/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker
index 9e7766ce16c9bc..4a8f9df4c4044c 100755
--- a/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker
+++ b/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker
@@ -211,12 +211,12 @@ kibana_vars=(
     xpack.alerts.invalidateApiKeysTask.interval
     xpack.alerts.invalidateApiKeysTask.removalDelay
     xpack.apm.enabled
-    xpack.apm.indices.errors
-    xpack.apm.indices.metrics
+    xpack.apm.indices.error
+    xpack.apm.indices.metric
     xpack.apm.indices.onboarding
-    xpack.apm.indices.sourcemaps
-    xpack.apm.indices.spans
-    xpack.apm.indices.transactions
+    xpack.apm.indices.sourcemap
+    xpack.apm.indices.span
+    xpack.apm.indices.transaction
     xpack.apm.maxServiceEnvironments
     xpack.apm.searchAggregatedTransactions
     xpack.apm.serviceMapEnabled
diff --git a/x-pack/plugins/apm/ftr_e2e/cypress/integration/power_user/no_data_screen.ts b/x-pack/plugins/apm/ftr_e2e/cypress/integration/power_user/no_data_screen.ts
index 47eba11e6f6fb1..56704d63a42f16 100644
--- a/x-pack/plugins/apm/ftr_e2e/cypress/integration/power_user/no_data_screen.ts
+++ b/x-pack/plugins/apm/ftr_e2e/cypress/integration/power_user/no_data_screen.ts
@@ -19,12 +19,12 @@ describe('No data screen', () => {
         url: apmIndicesSaveURL,
         method: 'POST',
         body: {
-          sourcemaps: 'foo-*',
-          errors: 'foo-*',
+          sourcemap: 'foo-*',
+          error: 'foo-*',
           onboarding: 'foo-*',
-          spans: 'foo-*',
-          transactions: 'foo-*',
-          metrics: 'foo-*',
+          span: 'foo-*',
+          transaction: 'foo-*',
+          metric: 'foo-*',
         },
         headers: {
           'kbn-xsrf': true,
@@ -49,12 +49,12 @@ describe('No data screen', () => {
         url: apmIndicesSaveURL,
         method: 'POST',
         body: {
-          sourcemaps: '',
-          errors: '',
+          sourcemap: '',
+          error: '',
           onboarding: '',
-          spans: '',
-          transactions: '',
-          metrics: '',
+          span: '',
+          transaction: '',
+          metric: '',
         },
         headers: { 'kbn-xsrf': true },
         auth: { user: 'apm_power_user', pass: 'changeme' },
diff --git a/x-pack/plugins/apm/public/utils/testHelpers.tsx b/x-pack/plugins/apm/public/utils/testHelpers.tsx
index 2203bc63f68cd3..9ce7d2e4a52d90 100644
--- a/x-pack/plugins/apm/public/utils/testHelpers.tsx
+++ b/x-pack/plugins/apm/public/utils/testHelpers.tsx
@@ -119,12 +119,12 @@ interface MockSetup {
   config: APMConfig;
   uiFilters: UxUIFilters;
   indices: {
-    sourcemaps: string;
-    errors: string;
+    sourcemap: string;
+    error: string;
     onboarding: string;
-    spans: string;
-    transactions: string;
-    metrics: string;
+    span: string;
+    transaction: string;
+    metric: string;
     apmAgentConfigurationIndex: string;
     apmCustomLinkIndex: string;
   };
@@ -176,12 +176,12 @@ export async function inspectSearchParams(
     ) as APMConfig,
     uiFilters: {},
     indices: {
-      sourcemaps: 'myIndex',
-      errors: 'myIndex',
+      sourcemap: 'myIndex',
+      error: 'myIndex',
       onboarding: 'myIndex',
-      spans: 'myIndex',
-      transactions: 'myIndex',
-      metrics: 'myIndex',
+      span: 'myIndex',
+      transaction: 'myIndex',
+      metric: 'myIndex',
       apmAgentConfigurationIndex: 'myIndex',
       apmCustomLinkIndex: 'myIndex',
     },
diff --git a/x-pack/test/encrypted_saved_objects_api_integration/fixtures/es_archiver/encrypted_saved_objects/mappings.json b/x-pack/test/encrypted_saved_objects_api_integration/fixtures/es_archiver/encrypted_saved_objects/mappings.json
index daa99c4d719678..be994527078149 100644
--- a/x-pack/test/encrypted_saved_objects_api_integration/fixtures/es_archiver/encrypted_saved_objects/mappings.json
+++ b/x-pack/test/encrypted_saved_objects_api_integration/fixtures/es_archiver/encrypted_saved_objects/mappings.json
@@ -189,22 +189,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/encrypted_saved_objects_api_integration/fixtures/es_archiver/encrypted_saved_objects_different_key/mappings.json b/x-pack/test/encrypted_saved_objects_api_integration/fixtures/es_archiver/encrypted_saved_objects_different_key/mappings.json
index 4e41d8cb72fb5b..dfcf3155b67ca2 100644
--- a/x-pack/test/encrypted_saved_objects_api_integration/fixtures/es_archiver/encrypted_saved_objects_different_key/mappings.json
+++ b/x-pack/test/encrypted_saved_objects_api_integration/fixtures/es_archiver/encrypted_saved_objects_different_key/mappings.json
@@ -216,22 +216,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/encrypted_saved_objects_api_integration/fixtures/es_archiver/key_rotation/mappings.json b/x-pack/test/encrypted_saved_objects_api_integration/fixtures/es_archiver/key_rotation/mappings.json
index 91644307302162..72f66db35cec68 100644
--- a/x-pack/test/encrypted_saved_objects_api_integration/fixtures/es_archiver/key_rotation/mappings.json
+++ b/x-pack/test/encrypted_saved_objects_api_integration/fixtures/es_archiver/key_rotation/mappings.json
@@ -214,22 +214,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/action_task_params/mappings.json b/x-pack/test/functional/es_archives/action_task_params/mappings.json
index 874886647e6d67..d28c1504d3eed1 100644
--- a/x-pack/test/functional/es_archives/action_task_params/mappings.json
+++ b/x-pack/test/functional/es_archives/action_task_params/mappings.json
@@ -206,22 +206,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/actions/mappings.json b/x-pack/test/functional/es_archives/actions/mappings.json
index 786005d1ab6a6d..a0da38c85f7246 100644
--- a/x-pack/test/functional/es_archives/actions/mappings.json
+++ b/x-pack/test/functional/es_archives/actions/mappings.json
@@ -202,22 +202,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/alerts_legacy/mappings.json b/x-pack/test/functional/es_archives/alerts_legacy/mappings.json
index 9c856a829a3430..6e40f811e1af4b 100644
--- a/x-pack/test/functional/es_archives/alerts_legacy/mappings.json
+++ b/x-pack/test/functional/es_archives/alerts_legacy/mappings.json
@@ -198,22 +198,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/canvas/reports/mappings.json b/x-pack/test/functional/es_archives/canvas/reports/mappings.json
index 51c48857d24818..d6c3f1b26a4302 100644
--- a/x-pack/test/functional/es_archives/canvas/reports/mappings.json
+++ b/x-pack/test/functional/es_archives/canvas/reports/mappings.json
@@ -229,22 +229,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/cases/migrations/7.10.0/mappings.json b/x-pack/test/functional/es_archives/cases/migrations/7.10.0/mappings.json
index bd0b2c4e9ad270..b1b6c468c3945f 100644
--- a/x-pack/test/functional/es_archives/cases/migrations/7.10.0/mappings.json
+++ b/x-pack/test/functional/es_archives/cases/migrations/7.10.0/mappings.json
@@ -199,22 +199,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/cases/migrations/7.11.1/mappings.json b/x-pack/test/functional/es_archives/cases/migrations/7.11.1/mappings.json
index 2da75330be93a4..94648d407a89b0 100644
--- a/x-pack/test/functional/es_archives/cases/migrations/7.11.1/mappings.json
+++ b/x-pack/test/functional/es_archives/cases/migrations/7.11.1/mappings.json
@@ -254,22 +254,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/cases/migrations/7.13.2/mappings.json b/x-pack/test/functional/es_archives/cases/migrations/7.13.2/mappings.json
index 62fec329aa40fb..6f4a2df3a75436 100644
--- a/x-pack/test/functional/es_archives/cases/migrations/7.13.2/mappings.json
+++ b/x-pack/test/functional/es_archives/cases/migrations/7.13.2/mappings.json
@@ -260,22 +260,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/cases/migrations/7.13_user_actions/mappings.json b/x-pack/test/functional/es_archives/cases/migrations/7.13_user_actions/mappings.json
index 8a9c1a626e6529..7026e50cdb6583 100644
--- a/x-pack/test/functional/es_archives/cases/migrations/7.13_user_actions/mappings.json
+++ b/x-pack/test/functional/es_archives/cases/migrations/7.13_user_actions/mappings.json
@@ -261,22 +261,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/cases/migrations/7.16.0_space/mappings.json b/x-pack/test/functional/es_archives/cases/migrations/7.16.0_space/mappings.json
index 4b8f2c7103b202..d7422d42365989 100644
--- a/x-pack/test/functional/es_archives/cases/migrations/7.16.0_space/mappings.json
+++ b/x-pack/test/functional/es_archives/cases/migrations/7.16.0_space/mappings.json
@@ -275,22 +275,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/data/search_sessions/mappings.json b/x-pack/test/functional/es_archives/data/search_sessions/mappings.json
index 1203e1d892d56b..07c2c88b9f38f5 100644
--- a/x-pack/test/functional/es_archives/data/search_sessions/mappings.json
+++ b/x-pack/test/functional/es_archives/data/search_sessions/mappings.json
@@ -169,22 +169,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/endpoint/telemetry/agent_only/mappings.json b/x-pack/test/functional/es_archives/endpoint/telemetry/agent_only/mappings.json
index daab89b69483e5..dd65c3977e1b74 100644
--- a/x-pack/test/functional/es_archives/endpoint/telemetry/agent_only/mappings.json
+++ b/x-pack/test/functional/es_archives/endpoint/telemetry/agent_only/mappings.json
@@ -198,22 +198,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_different_states/mappings.json b/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_different_states/mappings.json
index c133c3fec76e2c..eecc8ee5d88704 100644
--- a/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_different_states/mappings.json
+++ b/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_different_states/mappings.json
@@ -199,22 +199,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_installed/mappings.json b/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_installed/mappings.json
index c133c3fec76e2c..eecc8ee5d88704 100644
--- a/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_installed/mappings.json
+++ b/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_installed/mappings.json
@@ -199,22 +199,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_uninstalled/mappings.json b/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_uninstalled/mappings.json
index c133c3fec76e2c..eecc8ee5d88704 100644
--- a/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_uninstalled/mappings.json
+++ b/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_uninstalled/mappings.json
@@ -199,22 +199,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/endpoint/telemetry/endpoint_malware_disabled/mappings.json b/x-pack/test/functional/es_archives/endpoint/telemetry/endpoint_malware_disabled/mappings.json
index daab89b69483e5..dd65c3977e1b74 100644
--- a/x-pack/test/functional/es_archives/endpoint/telemetry/endpoint_malware_disabled/mappings.json
+++ b/x-pack/test/functional/es_archives/endpoint/telemetry/endpoint_malware_disabled/mappings.json
@@ -198,22 +198,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/endpoint/telemetry/endpoint_malware_enabled/mappings.json b/x-pack/test/functional/es_archives/endpoint/telemetry/endpoint_malware_enabled/mappings.json
index daab89b69483e5..dd65c3977e1b74 100644
--- a/x-pack/test/functional/es_archives/endpoint/telemetry/endpoint_malware_enabled/mappings.json
+++ b/x-pack/test/functional/es_archives/endpoint/telemetry/endpoint_malware_enabled/mappings.json
@@ -198,22 +198,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/endpoint/telemetry/endpoint_uninstalled/mappings.json b/x-pack/test/functional/es_archives/endpoint/telemetry/endpoint_uninstalled/mappings.json
index daab89b69483e5..dd65c3977e1b74 100644
--- a/x-pack/test/functional/es_archives/endpoint/telemetry/endpoint_uninstalled/mappings.json
+++ b/x-pack/test/functional/es_archives/endpoint/telemetry/endpoint_uninstalled/mappings.json
@@ -198,22 +198,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/fleet/agents/mappings.json b/x-pack/test/functional/es_archives/fleet/agents/mappings.json
index b2f5392ebd23a4..24b4a66624305b 100644
--- a/x-pack/test/functional/es_archives/fleet/agents/mappings.json
+++ b/x-pack/test/functional/es_archives/fleet/agents/mappings.json
@@ -189,22 +189,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/kibana_scripted_fields_on_logstash/mappings.json b/x-pack/test/functional/es_archives/kibana_scripted_fields_on_logstash/mappings.json
index 7853368bc37d57..e0dd6d90eacb4a 100644
--- a/x-pack/test/functional/es_archives/kibana_scripted_fields_on_logstash/mappings.json
+++ b/x-pack/test/functional/es_archives/kibana_scripted_fields_on_logstash/mappings.json
@@ -181,22 +181,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/lists/mappings.json b/x-pack/test/functional/es_archives/lists/mappings.json
index e23c5ad224506c..e687285f91b291 100644
--- a/x-pack/test/functional/es_archives/lists/mappings.json
+++ b/x-pack/test/functional/es_archives/lists/mappings.json
@@ -196,22 +196,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/reporting/canvas_disallowed_url/mappings.json b/x-pack/test/functional/es_archives/reporting/canvas_disallowed_url/mappings.json
index a35e4c8e07e97c..e67abaf2032c75 100644
--- a/x-pack/test/functional/es_archives/reporting/canvas_disallowed_url/mappings.json
+++ b/x-pack/test/functional/es_archives/reporting/canvas_disallowed_url/mappings.json
@@ -193,22 +193,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/reporting/ecommerce_kibana_spaces/mappings.json b/x-pack/test/functional/es_archives/reporting/ecommerce_kibana_spaces/mappings.json
index 9d11349819d685..0fe9a18ce2201e 100644
--- a/x-pack/test/functional/es_archives/reporting/ecommerce_kibana_spaces/mappings.json
+++ b/x-pack/test/functional/es_archives/reporting/ecommerce_kibana_spaces/mappings.json
@@ -214,22 +214,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/reporting/hugedata/mappings.json b/x-pack/test/functional/es_archives/reporting/hugedata/mappings.json
index 02a212d65cc1a8..d1cb75c1f5150f 100644
--- a/x-pack/test/functional/es_archives/reporting/hugedata/mappings.json
+++ b/x-pack/test/functional/es_archives/reporting/hugedata/mappings.json
@@ -170,22 +170,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/reporting/multi_index_kibana/mappings.json b/x-pack/test/functional/es_archives/reporting/multi_index_kibana/mappings.json
index f6b5df41938fb8..69c6cbc3b46b5f 100644
--- a/x-pack/test/functional/es_archives/reporting/multi_index_kibana/mappings.json
+++ b/x-pack/test/functional/es_archives/reporting/multi_index_kibana/mappings.json
@@ -172,22 +172,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/security_solution/migrations/mappings.json b/x-pack/test/functional/es_archives/security_solution/migrations/mappings.json
index fa49916066a1a0..8728ec4ad74a14 100644
--- a/x-pack/test/functional/es_archives/security_solution/migrations/mappings.json
+++ b/x-pack/test/functional/es_archives/security_solution/migrations/mappings.json
@@ -272,22 +272,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/security_solution/timelines/7.15.0/mappings.json b/x-pack/test/functional/es_archives/security_solution/timelines/7.15.0/mappings.json
index 2e6a9bcee3d8c0..7292878908cab6 100644
--- a/x-pack/test/functional/es_archives/security_solution/timelines/7.15.0/mappings.json
+++ b/x-pack/test/functional/es_archives/security_solution/timelines/7.15.0/mappings.json
@@ -276,22 +276,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/security_solution/timelines/7.15.0_space/mappings.json b/x-pack/test/functional/es_archives/security_solution/timelines/7.15.0_space/mappings.json
index 682b241c126f4f..45206c84b69ded 100644
--- a/x-pack/test/functional/es_archives/security_solution/timelines/7.15.0_space/mappings.json
+++ b/x-pack/test/functional/es_archives/security_solution/timelines/7.15.0_space/mappings.json
@@ -273,22 +273,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }
diff --git a/x-pack/test/functional/es_archives/visualize/default/mappings.json b/x-pack/test/functional/es_archives/visualize/default/mappings.json
index 2d761064d0a46d..abf6bcfa04c804 100644
--- a/x-pack/test/functional/es_archives/visualize/default/mappings.json
+++ b/x-pack/test/functional/es_archives/visualize/default/mappings.json
@@ -254,22 +254,22 @@
         },
         "apm-indices": {
           "properties": {
-            "errors": {
+            "error": {
               "type": "keyword"
             },
-            "metrics": {
+            "metric": {
               "type": "keyword"
             },
             "onboarding": {
               "type": "keyword"
             },
-            "sourcemaps": {
+            "sourcemap": {
               "type": "keyword"
             },
-            "spans": {
+            "span": {
               "type": "keyword"
             },
-            "transactions": {
+            "transaction": {
               "type": "keyword"
             }
           }

From f8cbbbb99fbed1a6dfcacbe13aee7e922030fb36 Mon Sep 17 00:00:00 2001
From: Devon Thomson <devon.thomson@hotmail.com>
Date: Wed, 13 Oct 2021 20:11:53 -0400
Subject: [PATCH 34/71] [Controls] Redux Toolkit and Embeddable Redux Wrapper
 (#114371)

Use new redux wrapper for control group management and upgrade all control group methods to use redux wrapper. Get order of controls from embeddable input, set up preconfigured story.

Co-authored-by: andreadelrio <delrio.andre@gmail.com>
---
 package.json                                  |   3 +
 .../__stories__/controls_service_stub.ts      |   2 +-
 .../__stories__/input_controls.stories.tsx    |  68 +++++-
 .../storybook_control_factories.ts            |  27 +++
 .../control_frame/control_frame_strings.ts    |  22 --
 .../component}/control_frame_component.tsx    |  47 ++--
 .../component/control_group_component.tsx     | 121 +++++-----
 .../component/control_group_sortable_item.tsx | 114 ++++-----
 .../control_group/control_group_container.tsx | 224 ------------------
 .../control_group/control_group_strings.ts    |  63 +++--
 ...{manage_control.tsx => control_editor.tsx} |   2 +-
 .../control_group/editor/create_control.tsx   | 158 ++++++++++++
 .../control_group/editor/edit_control.tsx     | 127 ++++++++++
 .../editor/edit_control_group.tsx             | 124 ++++++++++
 .../editor/forward_all_context.tsx            |  36 +++
 .../editor/manage_control_group_component.tsx | 113 ---------
 .../embeddable/control_group_container.tsx    |  77 ++++++
 .../control_group_container_factory.ts        |  19 +-
 .../state/control_group_reducers.ts           |  48 ++++
 .../controls/control_group/types.ts           |   4 +-
 .../options_list/options_list_embeddable.tsx  |   2 +-
 .../components/controls/controls_service.ts   |   6 +-
 .../controls/hooks/use_child_embeddable.ts    |  11 +-
 .../public/components/controls/types.ts       |  38 +--
 .../generic_embeddable_store.ts               |  40 ++++
 .../redux_embeddable_context.ts               |  73 ++++++
 .../redux_embeddable_wrapper.tsx              | 162 +++++++++++++
 .../components/redux_embeddables/types.ts     |  62 +++++
 src/plugins/presentation_util/public/mocks.ts |   1 +
 .../presentation_util/public/plugin.ts        |   1 +
 .../public/services/controls.ts               |  85 +++++++
 .../public/services/index.ts                  |   3 +
 .../index.ts => services/kibana/controls.ts}  |   6 +
 .../public/services/kibana/index.ts           |   2 +
 .../public/services/storybook/controls.ts     |  13 +
 .../public/services/storybook/index.ts        |  11 +-
 .../public/services/stub/controls.ts          |  13 +
 .../public/services/stub/index.ts             |   3 +-
 src/plugins/presentation_util/public/types.ts |   2 +
 39 files changed, 1308 insertions(+), 625 deletions(-)
 create mode 100644 src/plugins/presentation_util/public/components/controls/__stories__/storybook_control_factories.ts
 delete mode 100644 src/plugins/presentation_util/public/components/controls/control_frame/control_frame_strings.ts
 rename src/plugins/presentation_util/public/components/controls/{control_frame => control_group/component}/control_frame_component.tsx (71%)
 delete mode 100644 src/plugins/presentation_util/public/components/controls/control_group/control_group_container.tsx
 rename src/plugins/presentation_util/public/components/controls/control_group/editor/{manage_control.tsx => control_editor.tsx} (99%)
 create mode 100644 src/plugins/presentation_util/public/components/controls/control_group/editor/create_control.tsx
 create mode 100644 src/plugins/presentation_util/public/components/controls/control_group/editor/edit_control.tsx
 create mode 100644 src/plugins/presentation_util/public/components/controls/control_group/editor/edit_control_group.tsx
 create mode 100644 src/plugins/presentation_util/public/components/controls/control_group/editor/forward_all_context.tsx
 delete mode 100644 src/plugins/presentation_util/public/components/controls/control_group/editor/manage_control_group_component.tsx
 create mode 100644 src/plugins/presentation_util/public/components/controls/control_group/embeddable/control_group_container.tsx
 rename src/plugins/presentation_util/public/components/controls/control_group/{ => embeddable}/control_group_container_factory.ts (71%)
 create mode 100644 src/plugins/presentation_util/public/components/controls/control_group/state/control_group_reducers.ts
 create mode 100644 src/plugins/presentation_util/public/components/redux_embeddables/generic_embeddable_store.ts
 create mode 100644 src/plugins/presentation_util/public/components/redux_embeddables/redux_embeddable_context.ts
 create mode 100644 src/plugins/presentation_util/public/components/redux_embeddables/redux_embeddable_wrapper.tsx
 create mode 100644 src/plugins/presentation_util/public/components/redux_embeddables/types.ts
 create mode 100644 src/plugins/presentation_util/public/services/controls.ts
 rename src/plugins/presentation_util/public/{components/controls/index.ts => services/kibana/controls.ts} (54%)
 create mode 100644 src/plugins/presentation_util/public/services/storybook/controls.ts
 create mode 100644 src/plugins/presentation_util/public/services/stub/controls.ts

diff --git a/package.json b/package.json
index f526f357ff3476..6e4a37863bc821 100644
--- a/package.json
+++ b/package.json
@@ -91,6 +91,9 @@
     "yarn": "^1.21.1"
   },
   "dependencies": {
+    "@dnd-kit/core": "^3.1.1",
+    "@dnd-kit/sortable": "^4.0.0",
+    "@dnd-kit/utilities": "^2.0.0",
     "@babel/runtime": "^7.15.4",
     "@dnd-kit/core": "^3.1.1",
     "@dnd-kit/sortable": "^4.0.0",
diff --git a/src/plugins/presentation_util/public/components/controls/__stories__/controls_service_stub.ts b/src/plugins/presentation_util/public/components/controls/__stories__/controls_service_stub.ts
index 59e7a44a83a17e..faaa155249949d 100644
--- a/src/plugins/presentation_util/public/components/controls/__stories__/controls_service_stub.ts
+++ b/src/plugins/presentation_util/public/components/controls/__stories__/controls_service_stub.ts
@@ -6,8 +6,8 @@
  * Side Public License, v 1.
  */
 
-import { InputControlFactory } from '../types';
 import { ControlsService } from '../controls_service';
+import { InputControlFactory } from '../../../services/controls';
 import { flightFields, getEuiSelectableOptions } from './flights';
 import { OptionsListEmbeddableFactory } from '../control_types/options_list';
 
diff --git a/src/plugins/presentation_util/public/components/controls/__stories__/input_controls.stories.tsx b/src/plugins/presentation_util/public/components/controls/__stories__/input_controls.stories.tsx
index 2a463fece18da2..66f1d8b36399e4 100644
--- a/src/plugins/presentation_util/public/components/controls/__stories__/input_controls.stories.tsx
+++ b/src/plugins/presentation_util/public/components/controls/__stories__/input_controls.stories.tsx
@@ -10,9 +10,14 @@ import React, { useEffect, useMemo } from 'react';
 import uuid from 'uuid';
 
 import { decorators } from './decorators';
-import { providers } from '../../../services/storybook';
-import { getControlsServiceStub } from './controls_service_stub';
-import { ControlGroupContainerFactory } from '../control_group/control_group_container_factory';
+import { pluginServices, registry } from '../../../services/storybook';
+import { populateStorybookControlFactories } from './storybook_control_factories';
+import { ControlGroupContainerFactory } from '../control_group/embeddable/control_group_container_factory';
+import { ControlsPanels } from '../control_group/types';
+import {
+  OptionsListEmbeddableInput,
+  OPTIONS_LIST_CONTROL,
+} from '../control_types/options_list/options_list_embeddable';
 
 export default {
   title: 'Controls',
@@ -20,17 +25,15 @@ export default {
   decorators,
 };
 
-const ControlGroupStoryComponent = () => {
+const EmptyControlGroupStoryComponent = ({ panels }: { panels?: ControlsPanels }) => {
   const embeddableRoot: React.RefObject<HTMLDivElement> = useMemo(() => React.createRef(), []);
 
-  providers.overlays.start({});
-  const overlays = providers.overlays.getService();
-
-  const controlsServiceStub = getControlsServiceStub();
+  pluginServices.setRegistry(registry.start({}));
+  populateStorybookControlFactories(pluginServices.getServices().controls);
 
   useEffect(() => {
     (async () => {
-      const factory = new ControlGroupContainerFactory(controlsServiceStub, overlays);
+      const factory = new ControlGroupContainerFactory();
       const controlGroupContainerEmbeddable = await factory.create({
         inheritParentState: {
           useQuery: false,
@@ -38,16 +41,57 @@ const ControlGroupStoryComponent = () => {
           useTimerange: false,
         },
         controlStyle: 'oneLine',
+        panels: panels ?? {},
         id: uuid.v4(),
-        panels: {},
       });
       if (controlGroupContainerEmbeddable && embeddableRoot.current) {
         controlGroupContainerEmbeddable.render(embeddableRoot.current);
       }
     })();
-  }, [embeddableRoot, controlsServiceStub, overlays]);
+  }, [embeddableRoot, panels]);
 
   return <div ref={embeddableRoot} />;
 };
 
-export const ControlGroupStory = () => <ControlGroupStoryComponent />;
+export const EmptyControlGroupStory = () => <EmptyControlGroupStoryComponent />;
+export const ConfiguredControlGroupStory = () => (
+  <EmptyControlGroupStoryComponent
+    panels={{
+      optionsList1: {
+        type: OPTIONS_LIST_CONTROL,
+        order: 1,
+        width: 'auto',
+        explicitInput: {
+          title: 'Origin City',
+          id: 'optionsList1',
+          indexPattern: 'demo data flights',
+          field: 'OriginCityName',
+          defaultSelections: ['Toronto'],
+        } as OptionsListEmbeddableInput,
+      },
+      optionsList2: {
+        type: OPTIONS_LIST_CONTROL,
+        order: 2,
+        width: 'auto',
+        explicitInput: {
+          title: 'Destination City',
+          id: 'optionsList2',
+          indexPattern: 'demo data flights',
+          field: 'DestCityName',
+          defaultSelections: ['London'],
+        } as OptionsListEmbeddableInput,
+      },
+      optionsList3: {
+        type: OPTIONS_LIST_CONTROL,
+        order: 3,
+        width: 'auto',
+        explicitInput: {
+          title: 'Carrier',
+          id: 'optionsList3',
+          indexPattern: 'demo data flights',
+          field: 'Carrier',
+        } as OptionsListEmbeddableInput,
+      },
+    }}
+  />
+);
diff --git a/src/plugins/presentation_util/public/components/controls/__stories__/storybook_control_factories.ts b/src/plugins/presentation_util/public/components/controls/__stories__/storybook_control_factories.ts
new file mode 100644
index 00000000000000..3048adc74d8c7d
--- /dev/null
+++ b/src/plugins/presentation_util/public/components/controls/__stories__/storybook_control_factories.ts
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { flightFields, getEuiSelectableOptions } from './flights';
+import { OptionsListEmbeddableFactory } from '../control_types/options_list';
+import { InputControlFactory, PresentationControlsService } from '../../../services/controls';
+
+export const populateStorybookControlFactories = (
+  controlsServiceStub: PresentationControlsService
+) => {
+  const optionsListFactoryStub = new OptionsListEmbeddableFactory(
+    ({ field, search }) =>
+      new Promise((r) => setTimeout(() => r(getEuiSelectableOptions(field, search)), 500)),
+    () => Promise.resolve(['demo data flights']),
+    () => Promise.resolve(flightFields)
+  );
+
+  // cast to unknown because the stub cannot use the embeddable start contract to transform the EmbeddableFactoryDefinition into an EmbeddableFactory
+  const optionsListControlFactory = optionsListFactoryStub as unknown as InputControlFactory;
+  optionsListControlFactory.getDefaultInput = () => ({});
+  controlsServiceStub.registerInputControlType(optionsListControlFactory);
+};
diff --git a/src/plugins/presentation_util/public/components/controls/control_frame/control_frame_strings.ts b/src/plugins/presentation_util/public/components/controls/control_frame/control_frame_strings.ts
deleted file mode 100644
index 5f9e89aa797cb0..00000000000000
--- a/src/plugins/presentation_util/public/components/controls/control_frame/control_frame_strings.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { i18n } from '@kbn/i18n';
-
-export const ControlFrameStrings = {
-  floatingActions: {
-    getEditButtonTitle: () =>
-      i18n.translate('presentationUtil.inputControls.controlGroup.floatingActions.editTitle', {
-        defaultMessage: 'Manage control',
-      }),
-    getRemoveButtonTitle: () =>
-      i18n.translate('presentationUtil.inputControls.controlGroup.floatingActions.removeTitle', {
-        defaultMessage: 'Remove control',
-      }),
-  },
-};
diff --git a/src/plugins/presentation_util/public/components/controls/control_frame/control_frame_component.tsx b/src/plugins/presentation_util/public/components/controls/control_group/component/control_frame_component.tsx
similarity index 71%
rename from src/plugins/presentation_util/public/components/controls/control_frame/control_frame_component.tsx
rename to src/plugins/presentation_util/public/components/controls/control_group/component/control_frame_component.tsx
index 240beea13b0e2b..103ce6dd0e27cc 100644
--- a/src/plugins/presentation_util/public/components/controls/control_frame/control_frame_component.tsx
+++ b/src/plugins/presentation_util/public/components/controls/control_group/component/control_frame_component.tsx
@@ -15,32 +15,28 @@ import {
   EuiFormRow,
   EuiToolTip,
 } from '@elastic/eui';
-import { ControlGroupContainer } from '../control_group/control_group_container';
-import { useChildEmbeddable } from '../hooks/use_child_embeddable';
-import { ControlStyle } from '../types';
-import { ControlFrameStrings } from './control_frame_strings';
+
+import { ControlGroupInput } from '../types';
+import { EditControlButton } from '../editor/edit_control';
+import { useChildEmbeddable } from '../../hooks/use_child_embeddable';
+import { useReduxContainerContext } from '../../../redux_embeddables/redux_embeddable_context';
+import { ControlGroupStrings } from '../control_group_strings';
 
 export interface ControlFrameProps {
-  container: ControlGroupContainer;
   customPrepend?: JSX.Element;
-  controlStyle: ControlStyle;
   enableActions?: boolean;
-  onRemove?: () => void;
   embeddableId: string;
-  onEdit?: () => void;
 }
 
-export const ControlFrame = ({
-  customPrepend,
-  enableActions,
-  embeddableId,
-  controlStyle,
-  container,
-  onRemove,
-  onEdit,
-}: ControlFrameProps) => {
+export const ControlFrame = ({ customPrepend, enableActions, embeddableId }: ControlFrameProps) => {
   const embeddableRoot: React.RefObject<HTMLDivElement> = useMemo(() => React.createRef(), []);
-  const embeddable = useChildEmbeddable({ container, embeddableId });
+  const {
+    useEmbeddableSelector,
+    containerActions: { untilEmbeddableLoaded, removeEmbeddable },
+  } = useReduxContainerContext<ControlGroupInput>();
+  const { controlStyle } = useEmbeddableSelector((state) => state);
+
+  const embeddable = useChildEmbeddable({ untilEmbeddableLoaded, embeddableId });
 
   const [title, setTitle] = useState<string>();
 
@@ -61,18 +57,13 @@ export const ControlFrame = ({
         'controlFrame--floatingActions-oneLine': !usingTwoLineLayout,
       })}
     >
-      <EuiToolTip content={ControlFrameStrings.floatingActions.getEditButtonTitle()}>
-        <EuiButtonIcon
-          aria-label={ControlFrameStrings.floatingActions.getEditButtonTitle()}
-          iconType="pencil"
-          onClick={onEdit}
-          color="text"
-        />
+      <EuiToolTip content={ControlGroupStrings.floatingActions.getEditButtonTitle()}>
+        <EditControlButton embeddableId={embeddableId} />
       </EuiToolTip>
-      <EuiToolTip content={ControlFrameStrings.floatingActions.getRemoveButtonTitle()}>
+      <EuiToolTip content={ControlGroupStrings.floatingActions.getRemoveButtonTitle()}>
         <EuiButtonIcon
-          aria-label={ControlFrameStrings.floatingActions.getRemoveButtonTitle()}
-          onClick={onRemove}
+          aria-label={ControlGroupStrings.floatingActions.getRemoveButtonTitle()}
+          onClick={() => removeEmbeddable(embeddableId)}
           iconType="cross"
           color="danger"
         />
diff --git a/src/plugins/presentation_util/public/components/controls/control_group/component/control_group_component.tsx b/src/plugins/presentation_util/public/components/controls/control_group/component/control_group_component.tsx
index d683c0749d98d8..4d5e8bc270e237 100644
--- a/src/plugins/presentation_util/public/components/controls/control_group/component/control_group_component.tsx
+++ b/src/plugins/presentation_util/public/components/controls/control_group/component/control_group_component.tsx
@@ -9,7 +9,7 @@
 import '../control_group.scss';
 
 import { EuiButtonIcon, EuiFlexGroup, EuiFlexItem, EuiToolTip } from '@elastic/eui';
-import React, { useEffect, useMemo, useState } from 'react';
+import React, { useMemo, useState } from 'react';
 import classNames from 'classnames';
 import {
   arrayMove,
@@ -29,46 +29,51 @@ import {
   LayoutMeasuringStrategy,
 } from '@dnd-kit/core';
 
+import { ControlGroupInput } from '../types';
+import { pluginServices } from '../../../../services';
 import { ControlGroupStrings } from '../control_group_strings';
-import { ControlGroupContainer } from '../control_group_container';
+import { CreateControlButton } from '../editor/create_control';
+import { EditControlGroup } from '../editor/edit_control_group';
+import { forwardAllContext } from '../editor/forward_all_context';
 import { ControlClone, SortableControl } from './control_group_sortable_item';
-import { OPTIONS_LIST_CONTROL } from '../../control_types/options_list/options_list_embeddable';
+import { useReduxContainerContext } from '../../../redux_embeddables/redux_embeddable_context';
+import { controlGroupReducers } from '../state/control_group_reducers';
 
-interface ControlGroupProps {
-  controlGroupContainer: ControlGroupContainer;
-}
+export const ControlGroup = () => {
+  // Presentation Services Context
+  const { overlays } = pluginServices.getHooks();
+  const { openFlyout } = overlays.useService();
 
-export const ControlGroup = ({ controlGroupContainer }: ControlGroupProps) => {
-  const [controlIds, setControlIds] = useState<string[]>([]);
+  // Redux embeddable container Context
+  const reduxContainerContext = useReduxContainerContext<
+    ControlGroupInput,
+    typeof controlGroupReducers
+  >();
+  const {
+    useEmbeddableSelector,
+    useEmbeddableDispatch,
+    actions: { setControlOrders },
+  } = reduxContainerContext;
+  const dispatch = useEmbeddableDispatch();
 
-  // sync controlIds every time input panels change
-  useEffect(() => {
-    const subscription = controlGroupContainer.getInput$().subscribe(() => {
-      setControlIds((currentIds) => {
-        // sync control Ids with panels from container input.
-        const { panels } = controlGroupContainer.getInput();
-        const newIds: string[] = [];
-        const allIds = [...currentIds, ...Object.keys(panels)];
-        allIds.forEach((id) => {
-          const currentIndex = currentIds.indexOf(id);
-          if (!panels[id] && currentIndex !== -1) {
-            currentIds.splice(currentIndex, 1);
-          }
-          if (currentIndex === -1 && Boolean(panels[id])) {
-            newIds.push(id);
-          }
-        });
-        return [...currentIds, ...newIds];
-      });
-    });
-    return () => subscription.unsubscribe();
-  }, [controlGroupContainer]);
+  // current state
+  const { panels } = useEmbeddableSelector((state) => state);
 
-  const [draggingId, setDraggingId] = useState<string | null>(null);
+  const idsInOrder = useMemo(
+    () =>
+      Object.values(panels)
+        .sort((a, b) => (a.order > b.order ? 1 : -1))
+        .reduce((acc, panel) => {
+          acc.push(panel.explicitInput.id);
+          return acc;
+        }, [] as string[]),
+    [panels]
+  );
 
+  const [draggingId, setDraggingId] = useState<string | null>(null);
   const draggingIndex = useMemo(
-    () => (draggingId ? controlIds.indexOf(draggingId) : -1),
-    [controlIds, draggingId]
+    () => (draggingId ? idsInOrder.indexOf(draggingId) : -1),
+    [idsInOrder, draggingId]
   );
 
   const sensors = useSensors(
@@ -78,10 +83,10 @@ export const ControlGroup = ({ controlGroupContainer }: ControlGroupProps) => {
 
   const onDragEnd = ({ over }: DragEndEvent) => {
     if (over) {
-      const overIndex = controlIds.indexOf(over.id);
+      const overIndex = idsInOrder.indexOf(over.id);
       if (draggingIndex !== overIndex) {
         const newIndex = overIndex;
-        setControlIds((currentControlIds) => arrayMove(currentControlIds, draggingIndex, newIndex));
+        dispatch(setControlOrders({ ids: arrayMove([...idsInOrder], draggingIndex, newIndex) }));
       }
     }
     setDraggingId(null);
@@ -100,36 +105,26 @@ export const ControlGroup = ({ controlGroupContainer }: ControlGroupProps) => {
             strategy: LayoutMeasuringStrategy.Always,
           }}
         >
-          <SortableContext items={controlIds} strategy={rectSortingStrategy}>
+          <SortableContext items={idsInOrder} strategy={rectSortingStrategy}>
             <EuiFlexGroup
               className={classNames('controlGroup', { 'controlGroup-isDragging': draggingId })}
               alignItems="center"
               gutterSize={'m'}
               wrap={true}
             >
-              {controlIds.map((controlId, index) => (
-                <SortableControl
-                  onEdit={() => controlGroupContainer.editControl(controlId)}
-                  onRemove={() => controlGroupContainer.removeEmbeddable(controlId)}
-                  dragInfo={{ index, draggingIndex }}
-                  container={controlGroupContainer}
-                  controlStyle={controlGroupContainer.getInput().controlStyle}
-                  embeddableId={controlId}
-                  width={controlGroupContainer.getInput().panels[controlId].width}
-                  key={controlId}
-                />
-              ))}
+              {idsInOrder.map(
+                (controlId, index) =>
+                  panels[controlId] && (
+                    <SortableControl
+                      dragInfo={{ index, draggingIndex }}
+                      embeddableId={controlId}
+                      key={controlId}
+                    />
+                  )
+              )}
             </EuiFlexGroup>
           </SortableContext>
-          <DragOverlay>
-            {draggingId ? (
-              <ControlClone
-                width={controlGroupContainer.getInput().panels[draggingId].width}
-                embeddableId={draggingId}
-                container={controlGroupContainer}
-              />
-            ) : null}
-          </DragOverlay>
+          <DragOverlay>{draggingId ? <ControlClone draggingId={draggingId} /> : null}</DragOverlay>
         </DndContext>
       </EuiFlexItem>
       <EuiFlexItem grow={false}>
@@ -141,19 +136,15 @@ export const ControlGroup = ({ controlGroupContainer }: ControlGroupProps) => {
                 iconType="gear"
                 color="text"
                 data-test-subj="inputControlsSortingButton"
-                onClick={controlGroupContainer.editControlGroup}
+                onClick={() =>
+                  openFlyout(forwardAllContext(<EditControlGroup />, reduxContainerContext))
+                }
               />
             </EuiToolTip>
           </EuiFlexItem>
           <EuiFlexItem>
             <EuiToolTip content={ControlGroupStrings.management.getAddControlTitle()}>
-              <EuiButtonIcon
-                aria-label={ControlGroupStrings.management.getManageButtonTitle()}
-                iconType="plus"
-                color="text"
-                data-test-subj="inputControlsSortingButton"
-                onClick={() => controlGroupContainer.createNewControl(OPTIONS_LIST_CONTROL)} // use popover when there are multiple types of control
-              />
+              <CreateControlButton />
             </EuiToolTip>
           </EuiFlexItem>
         </EuiFlexGroup>
diff --git a/src/plugins/presentation_util/public/components/controls/control_group/component/control_group_sortable_item.tsx b/src/plugins/presentation_util/public/components/controls/control_group/component/control_group_sortable_item.tsx
index 3ae171a588da44..5c222e3c130b5f 100644
--- a/src/plugins/presentation_util/public/components/controls/control_group/component/control_group_sortable_item.tsx
+++ b/src/plugins/presentation_util/public/components/controls/control_group/component/control_group_sortable_item.tsx
@@ -12,10 +12,9 @@ import { useSortable } from '@dnd-kit/sortable';
 import { CSS } from '@dnd-kit/utilities';
 import classNames from 'classnames';
 
-import { ControlWidth } from '../../types';
-import { ControlGroupContainer } from '../control_group_container';
-import { useChildEmbeddable } from '../../hooks/use_child_embeddable';
-import { ControlFrame, ControlFrameProps } from '../../control_frame/control_frame_component';
+import { ControlGroupInput } from '../types';
+import { ControlFrame, ControlFrameProps } from './control_frame_component';
+import { useReduxContainerContext } from '../../../redux_embeddables/redux_embeddable_context';
 
 interface DragInfo {
   isOver?: boolean;
@@ -26,7 +25,6 @@ interface DragInfo {
 
 export type SortableControlProps = ControlFrameProps & {
   dragInfo: DragInfo;
-  width: ControlWidth;
 };
 
 /**
@@ -60,91 +58,67 @@ export const SortableControl = (frameProps: SortableControlProps) => {
 const SortableControlInner = forwardRef<
   HTMLButtonElement,
   SortableControlProps & { style: HTMLAttributes<HTMLButtonElement>['style'] }
->(
-  (
-    {
-      embeddableId,
-      controlStyle,
-      container,
-      dragInfo,
-      onRemove,
-      onEdit,
-      style,
-      width,
-      ...dragHandleProps
-    },
-    dragHandleRef
-  ) => {
-    const { isOver, isDragging, draggingIndex, index } = dragInfo;
+>(({ embeddableId, dragInfo, style, ...dragHandleProps }, dragHandleRef) => {
+  const { isOver, isDragging, draggingIndex, index } = dragInfo;
+  const { useEmbeddableSelector } = useReduxContainerContext<ControlGroupInput>();
+  const { panels } = useEmbeddableSelector((state) => state);
 
-    const dragHandle = (
-      <button ref={dragHandleRef} {...dragHandleProps} className="controlFrame--dragHandle">
-        <EuiIcon type="grabHorizontal" />
-      </button>
-    );
+  const width = panels[embeddableId].width;
 
-    return (
-      <EuiFlexItem
-        grow={width === 'auto'}
-        className={classNames('controlFrame--wrapper', {
-          'controlFrame--wrapper-isDragging': isDragging,
-          'controlFrame--wrapper-small': width === 'small',
-          'controlFrame--wrapper-medium': width === 'medium',
-          'controlFrame--wrapper-large': width === 'large',
-          'controlFrame--wrapper-insertBefore': isOver && (index ?? -1) < (draggingIndex ?? -1),
-          'controlFrame--wrapper-insertAfter': isOver && (index ?? -1) > (draggingIndex ?? -1),
-        })}
-        style={style}
-      >
-        <ControlFrame
-          enableActions={draggingIndex === -1}
-          controlStyle={controlStyle}
-          embeddableId={embeddableId}
-          customPrepend={dragHandle}
-          container={container}
-          onRemove={onRemove}
-          onEdit={onEdit}
-        />
-      </EuiFlexItem>
-    );
-  }
-);
+  const dragHandle = (
+    <button ref={dragHandleRef} {...dragHandleProps} className="controlFrame--dragHandle">
+      <EuiIcon type="grabHorizontal" />
+    </button>
+  );
+
+  return (
+    <EuiFlexItem
+      grow={width === 'auto'}
+      className={classNames('controlFrame--wrapper', {
+        'controlFrame--wrapper-isDragging': isDragging,
+        'controlFrame--wrapper-small': width === 'small',
+        'controlFrame--wrapper-medium': width === 'medium',
+        'controlFrame--wrapper-large': width === 'large',
+        'controlFrame--wrapper-insertBefore': isOver && (index ?? -1) < (draggingIndex ?? -1),
+        'controlFrame--wrapper-insertAfter': isOver && (index ?? -1) > (draggingIndex ?? -1),
+      })}
+      style={style}
+    >
+      <ControlFrame
+        enableActions={draggingIndex === -1}
+        embeddableId={embeddableId}
+        customPrepend={dragHandle}
+      />
+    </EuiFlexItem>
+  );
+});
 
 /**
  * A simplified clone version of the control which is dragged. This version only shows
  * the title, because individual controls can be any size, and dragging a wide item
  * can be quite cumbersome.
  */
-export const ControlClone = ({
-  embeddableId,
-  container,
-  width,
-}: {
-  embeddableId: string;
-  container: ControlGroupContainer;
-  width: ControlWidth;
-}) => {
-  const embeddable = useChildEmbeddable({ embeddableId, container });
-  const layout = container.getInput().controlStyle;
+export const ControlClone = ({ draggingId }: { draggingId: string }) => {
+  const { useEmbeddableSelector } = useReduxContainerContext<ControlGroupInput>();
+  const { panels, controlStyle } = useEmbeddableSelector((state) => state);
+
+  const width = panels[draggingId].width;
+  const title = panels[draggingId].explicitInput.title;
   return (
     <EuiFlexItem
       className={classNames('controlFrame--cloneWrapper', {
         'controlFrame--cloneWrapper-small': width === 'small',
         'controlFrame--cloneWrapper-medium': width === 'medium',
         'controlFrame--cloneWrapper-large': width === 'large',
-        'controlFrame--cloneWrapper-twoLine': layout === 'twoLine',
+        'controlFrame--cloneWrapper-twoLine': controlStyle === 'twoLine',
       })}
     >
-      {layout === 'twoLine' ? (
-        <EuiFormLabel>{embeddable?.getInput().title}</EuiFormLabel>
-      ) : undefined}
+      {controlStyle === 'twoLine' ? <EuiFormLabel>{title}</EuiFormLabel> : undefined}
       <EuiFlexGroup gutterSize="none" className={'controlFrame--draggable'}>
         <EuiFlexItem grow={false}>
           <EuiIcon type="grabHorizontal" className="controlFrame--dragHandle" />
         </EuiFlexItem>
-        {container.getInput().controlStyle === 'oneLine' ? (
-          <EuiFlexItem>{embeddable?.getInput().title}</EuiFlexItem>
-        ) : undefined}
+        {controlStyle === 'oneLine' ? <EuiFlexItem>{title}</EuiFlexItem> : undefined}
       </EuiFlexGroup>
     </EuiFlexItem>
   );
diff --git a/src/plugins/presentation_util/public/components/controls/control_group/control_group_container.tsx b/src/plugins/presentation_util/public/components/controls/control_group/control_group_container.tsx
deleted file mode 100644
index 03249889dfdead..00000000000000
--- a/src/plugins/presentation_util/public/components/controls/control_group/control_group_container.tsx
+++ /dev/null
@@ -1,224 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-import ReactDOM from 'react-dom';
-import { cloneDeep } from 'lodash';
-
-import {
-  Container,
-  EmbeddableFactory,
-  EmbeddableFactoryNotFoundError,
-} from '../../../../../embeddable/public';
-import {
-  InputControlEmbeddable,
-  InputControlInput,
-  InputControlOutput,
-  IEditableControlFactory,
-  ControlWidth,
-} from '../types';
-import { ControlsService } from '../controls_service';
-import { ControlGroupInput, ControlPanelState } from './types';
-import { ManageControlComponent } from './editor/manage_control';
-import { toMountPoint } from '../../../../../kibana_react/public';
-import { ControlGroup } from './component/control_group_component';
-import { PresentationOverlaysService } from '../../../services/overlays';
-import { CONTROL_GROUP_TYPE, DEFAULT_CONTROL_WIDTH } from './control_group_constants';
-import { ManageControlGroup } from './editor/manage_control_group_component';
-import { OverlayRef } from '../../../../../../core/public';
-import { ControlGroupStrings } from './control_group_strings';
-
-export class ControlGroupContainer extends Container<InputControlInput, ControlGroupInput> {
-  public readonly type = CONTROL_GROUP_TYPE;
-
-  private nextControlWidth: ControlWidth = DEFAULT_CONTROL_WIDTH;
-
-  constructor(
-    initialInput: ControlGroupInput,
-    private readonly controlsService: ControlsService,
-    private readonly overlays: PresentationOverlaysService,
-    parent?: Container
-  ) {
-    super(initialInput, { embeddableLoaded: {} }, controlsService.getControlFactory, parent);
-    this.overlays = overlays;
-    this.controlsService = controlsService;
-  }
-
-  protected createNewPanelState<TEmbeddableInput extends InputControlInput = InputControlInput>(
-    factory: EmbeddableFactory<InputControlInput, InputControlOutput, InputControlEmbeddable>,
-    partial: Partial<TEmbeddableInput> = {}
-  ): ControlPanelState<TEmbeddableInput> {
-    const panelState = super.createNewPanelState(factory, partial);
-    return {
-      order: 1,
-      width: this.nextControlWidth,
-      ...panelState,
-    } as ControlPanelState<TEmbeddableInput>;
-  }
-
-  protected getInheritedInput(id: string): InputControlInput {
-    const { filters, query, timeRange, inheritParentState } = this.getInput();
-    return {
-      filters: inheritParentState.useFilters ? filters : undefined,
-      query: inheritParentState.useQuery ? query : undefined,
-      timeRange: inheritParentState.useTimerange ? timeRange : undefined,
-      id,
-    };
-  }
-
-  public createNewControl = async (type: string) => {
-    const factory = this.controlsService.getControlFactory(type);
-    if (!factory) throw new EmbeddableFactoryNotFoundError(type);
-
-    const initialInputPromise = new Promise<Omit<InputControlInput, 'id'>>((resolve, reject) => {
-      let inputToReturn: Partial<InputControlInput> = {};
-
-      const onCancel = (ref: OverlayRef) => {
-        this.overlays
-          .openConfirm(ControlGroupStrings.management.discardNewControl.getSubtitle(), {
-            confirmButtonText: ControlGroupStrings.management.discardNewControl.getConfirm(),
-            cancelButtonText: ControlGroupStrings.management.discardNewControl.getCancel(),
-            title: ControlGroupStrings.management.discardNewControl.getTitle(),
-            buttonColor: 'danger',
-          })
-          .then((confirmed) => {
-            if (confirmed) {
-              reject();
-              ref.close();
-            }
-          });
-      };
-
-      const flyoutInstance = this.overlays.openFlyout(
-        toMountPoint(
-          <ManageControlComponent
-            width={this.nextControlWidth}
-            updateTitle={(newTitle) => (inputToReturn.title = newTitle)}
-            updateWidth={(newWidth) => (this.nextControlWidth = newWidth)}
-            controlEditorComponent={(factory as IEditableControlFactory).getControlEditor?.({
-              onChange: (partialInput) => {
-                inputToReturn = { ...inputToReturn, ...partialInput };
-              },
-            })}
-            onSave={() => {
-              resolve(inputToReturn);
-              flyoutInstance.close();
-            }}
-            onCancel={() => onCancel(flyoutInstance)}
-          />
-        ),
-        {
-          onClose: (flyout) => onCancel(flyout),
-        }
-      );
-    });
-    initialInputPromise.then(
-      async (explicitInput) => {
-        await this.addNewEmbeddable(type, explicitInput);
-      },
-      () => {} // swallow promise rejection because it can be part of normal flow
-    );
-  };
-
-  public editControl = async (embeddableId: string) => {
-    const panel = this.getInput().panels[embeddableId];
-    const factory = this.getFactory(panel.type);
-    const embeddable = await this.untilEmbeddableLoaded(embeddableId);
-
-    if (!factory) throw new EmbeddableFactoryNotFoundError(panel.type);
-
-    const initialExplicitInput = cloneDeep(panel.explicitInput);
-    const initialWidth = panel.width;
-
-    const onCancel = (ref: OverlayRef) => {
-      this.overlays
-        .openConfirm(ControlGroupStrings.management.discardChanges.getSubtitle(), {
-          confirmButtonText: ControlGroupStrings.management.discardChanges.getConfirm(),
-          cancelButtonText: ControlGroupStrings.management.discardChanges.getCancel(),
-          title: ControlGroupStrings.management.discardChanges.getTitle(),
-          buttonColor: 'danger',
-        })
-        .then((confirmed) => {
-          if (confirmed) {
-            embeddable.updateInput(initialExplicitInput);
-            this.updateInput({
-              panels: {
-                ...this.getInput().panels,
-                [embeddableId]: { ...this.getInput().panels[embeddableId], width: initialWidth },
-              },
-            });
-            ref.close();
-          }
-        });
-    };
-
-    const flyoutInstance = this.overlays.openFlyout(
-      toMountPoint(
-        <ManageControlComponent
-          width={panel.width}
-          title={embeddable.getTitle()}
-          removeControl={() => this.removeEmbeddable(embeddableId)}
-          updateTitle={(newTitle) => embeddable.updateInput({ title: newTitle })}
-          controlEditorComponent={(factory as IEditableControlFactory).getControlEditor?.({
-            onChange: (partialInput) => embeddable.updateInput(partialInput),
-            initialInput: embeddable.getInput(),
-          })}
-          onCancel={() => onCancel(flyoutInstance)}
-          onSave={() => flyoutInstance.close()}
-          updateWidth={(newWidth) =>
-            this.updateInput({
-              panels: {
-                ...this.getInput().panels,
-                [embeddableId]: { ...this.getInput().panels[embeddableId], width: newWidth },
-              },
-            })
-          }
-        />
-      ),
-      {
-        onClose: (flyout) => onCancel(flyout),
-      }
-    );
-  };
-
-  public editControlGroup = () => {
-    const flyoutInstance = this.overlays.openFlyout(
-      toMountPoint(
-        <ManageControlGroup
-          controlStyle={this.getInput().controlStyle}
-          setControlStyle={(newStyle) => this.updateInput({ controlStyle: newStyle })}
-          deleteAllEmbeddables={() => {
-            this.overlays
-              .openConfirm(ControlGroupStrings.management.deleteAllControls.getSubtitle(), {
-                confirmButtonText: ControlGroupStrings.management.deleteAllControls.getConfirm(),
-                cancelButtonText: ControlGroupStrings.management.deleteAllControls.getCancel(),
-                title: ControlGroupStrings.management.deleteAllControls.getTitle(),
-                buttonColor: 'danger',
-              })
-              .then((confirmed) => {
-                if (confirmed) {
-                  Object.keys(this.getInput().panels).forEach((id) => this.removeEmbeddable(id));
-                  flyoutInstance.close();
-                }
-              });
-          }}
-          setAllPanelWidths={(newWidth) => {
-            const newPanels = cloneDeep(this.getInput().panels);
-            Object.values(newPanels).forEach((panel) => (panel.width = newWidth));
-            this.updateInput({ panels: { ...newPanels, ...newPanels } });
-          }}
-          panels={this.getInput().panels}
-        />
-      )
-    );
-  };
-
-  public render(dom: HTMLElement) {
-    ReactDOM.render(<ControlGroup controlGroupContainer={this} />, dom);
-  }
-}
diff --git a/src/plugins/presentation_util/public/components/controls/control_group/control_group_strings.ts b/src/plugins/presentation_util/public/components/controls/control_group/control_group_strings.ts
index 78e50d8651931c..35e490b0ea530a 100644
--- a/src/plugins/presentation_util/public/components/controls/control_group/control_group_strings.ts
+++ b/src/plugins/presentation_util/public/components/controls/control_group/control_group_strings.ts
@@ -48,13 +48,9 @@ export const ControlGroupStrings = {
       i18n.translate('presentationUtil.inputControls.controlGroup.management.flyoutTitle', {
         defaultMessage: 'Manage controls',
       }),
-    getDesignTitle: () =>
-      i18n.translate('presentationUtil.inputControls.controlGroup.management.designTitle', {
-        defaultMessage: 'Design',
-      }),
-    getWidthTitle: () =>
-      i18n.translate('presentationUtil.inputControls.controlGroup.management.widthTitle', {
-        defaultMessage: 'Width',
+    getDefaultWidthTitle: () =>
+      i18n.translate('presentationUtil.inputControls.controlGroup.management.defaultWidthTitle', {
+        defaultMessage: 'Default width',
       }),
     getLayoutTitle: () =>
       i18n.translate('presentationUtil.inputControls.controlGroup.management.layoutTitle', {
@@ -64,23 +60,20 @@ export const ControlGroupStrings = {
       i18n.translate('presentationUtil.inputControls.controlGroup.management.delete', {
         defaultMessage: 'Delete control',
       }),
+    getSetAllWidthsToDefaultTitle: () =>
+      i18n.translate('presentationUtil.inputControls.controlGroup.management.setAllWidths', {
+        defaultMessage: 'Set all widths to default',
+      }),
     getDeleteAllButtonTitle: () =>
       i18n.translate('presentationUtil.inputControls.controlGroup.management.deleteAll', {
         defaultMessage: 'Delete all',
       }),
     controlWidth: {
-      getChangeAllControlWidthsTitle: () =>
-        i18n.translate(
-          'presentationUtil.inputControls.controlGroup.management.layout.changeAllControlWidths',
-          {
-            defaultMessage: 'Set width for all controls',
-          }
-        ),
       getWidthSwitchLegend: () =>
         i18n.translate(
           'presentationUtil.inputControls.controlGroup.management.layout.controlWidthLegend',
           {
-            defaultMessage: 'Change individual control width',
+            defaultMessage: 'Change control width',
           }
         ),
       getAutoWidthTitle: () =>
@@ -117,21 +110,31 @@ export const ControlGroupStrings = {
           defaultMessage: 'Two line layout',
         }),
     },
-    deleteAllControls: {
-      getTitle: () =>
-        i18n.translate('presentationUtil.inputControls.controlGroup.management.deleteAll.title', {
-          defaultMessage: 'Delete all?',
-        }),
+    deleteControls: {
+      getDeleteAllTitle: () =>
+        i18n.translate(
+          'presentationUtil.inputControls.controlGroup.management.delete.deleteAllTitle',
+          {
+            defaultMessage: 'Delete all controls?',
+          }
+        ),
+      getDeleteTitle: () =>
+        i18n.translate(
+          'presentationUtil.inputControls.controlGroup.management.delete.deleteTitle',
+          {
+            defaultMessage: 'Delete control?',
+          }
+        ),
       getSubtitle: () =>
-        i18n.translate('presentationUtil.inputControls.controlGroup.management.deleteAll.sub', {
+        i18n.translate('presentationUtil.inputControls.controlGroup.management.delete.sub', {
           defaultMessage: 'Controls are not recoverable once removed.',
         }),
       getConfirm: () =>
-        i18n.translate('presentationUtil.inputControls.controlGroup.management.deleteAll.confirm', {
+        i18n.translate('presentationUtil.inputControls.controlGroup.management.delete.confirm', {
           defaultMessage: 'Delete',
         }),
       getCancel: () =>
-        i18n.translate('presentationUtil.inputControls.controlGroup.management.deleteAll.cancel', {
+        i18n.translate('presentationUtil.inputControls.controlGroup.management.delete.cancel', {
           defaultMessage: 'Cancel',
         }),
     },
@@ -143,7 +146,7 @@ export const ControlGroupStrings = {
       getSubtitle: () =>
         i18n.translate('presentationUtil.inputControls.controlGroup.management.discard.sub', {
           defaultMessage:
-            'Discard changes to this control? Controls are not recoverable once removed.',
+            'Discard changes to this control? Changes are not recoverable once discardsd.',
         }),
       getConfirm: () =>
         i18n.translate('presentationUtil.inputControls.controlGroup.management.discard.confirm', {
@@ -161,7 +164,7 @@ export const ControlGroupStrings = {
         }),
       getSubtitle: () =>
         i18n.translate('presentationUtil.inputControls.controlGroup.management.deleteNew.sub', {
-          defaultMessage: 'Discard new control? Controls are not recoverable once removed.',
+          defaultMessage: 'Discard new control? Controls are not recoverable once discarded.',
         }),
       getConfirm: () =>
         i18n.translate('presentationUtil.inputControls.controlGroup.management.deleteNew.confirm', {
@@ -173,4 +176,14 @@ export const ControlGroupStrings = {
         }),
     },
   },
+  floatingActions: {
+    getEditButtonTitle: () =>
+      i18n.translate('presentationUtil.inputControls.controlGroup.floatingActions.editTitle', {
+        defaultMessage: 'Manage control',
+      }),
+    getRemoveButtonTitle: () =>
+      i18n.translate('presentationUtil.inputControls.controlGroup.floatingActions.removeTitle', {
+        defaultMessage: 'Remove control',
+      }),
+  },
 };
diff --git a/src/plugins/presentation_util/public/components/controls/control_group/editor/manage_control.tsx b/src/plugins/presentation_util/public/components/controls/control_group/editor/control_editor.tsx
similarity index 99%
rename from src/plugins/presentation_util/public/components/controls/control_group/editor/manage_control.tsx
rename to src/plugins/presentation_util/public/components/controls/control_group/editor/control_editor.tsx
index 6d80a6e0b31f67..38d8faf37397a8 100644
--- a/src/plugins/presentation_util/public/components/controls/control_group/editor/manage_control.tsx
+++ b/src/plugins/presentation_util/public/components/controls/control_group/editor/control_editor.tsx
@@ -46,7 +46,7 @@ interface ManageControlProps {
   updateWidth: (newWidth: ControlWidth) => void;
 }
 
-export const ManageControlComponent = ({
+export const ControlEditor = ({
   controlEditorComponent,
   removeControl,
   updateTitle,
diff --git a/src/plugins/presentation_util/public/components/controls/control_group/editor/create_control.tsx b/src/plugins/presentation_util/public/components/controls/control_group/editor/create_control.tsx
new file mode 100644
index 00000000000000..9f59fe98cc0c11
--- /dev/null
+++ b/src/plugins/presentation_util/public/components/controls/control_group/editor/create_control.tsx
@@ -0,0 +1,158 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import {
+  EuiButtonIcon,
+  EuiButtonIconColor,
+  EuiContextMenuItem,
+  EuiContextMenuPanel,
+  EuiPopover,
+} from '@elastic/eui';
+import React, { useState, ReactElement } from 'react';
+
+import { ControlGroupInput } from '../types';
+import { ControlEditor } from './control_editor';
+import { pluginServices } from '../../../../services';
+import { forwardAllContext } from './forward_all_context';
+import { OverlayRef } from '../../../../../../../core/public';
+import { ControlGroupStrings } from '../control_group_strings';
+import { InputControlInput } from '../../../../services/controls';
+import { DEFAULT_CONTROL_WIDTH } from '../control_group_constants';
+import { ControlWidth, IEditableControlFactory } from '../../types';
+import { controlGroupReducers } from '../state/control_group_reducers';
+import { EmbeddableFactoryNotFoundError } from '../../../../../../embeddable/public';
+import { useReduxContainerContext } from '../../../redux_embeddables/redux_embeddable_context';
+
+export const CreateControlButton = () => {
+  // Presentation Services Context
+  const { overlays, controls } = pluginServices.getHooks();
+  const { getInputControlTypes, getControlFactory } = controls.useService();
+  const { openFlyout, openConfirm } = overlays.useService();
+
+  // Redux embeddable container Context
+  const reduxContainerContext = useReduxContainerContext<
+    ControlGroupInput,
+    typeof controlGroupReducers
+  >();
+  const {
+    containerActions: { addNewEmbeddable },
+    actions: { setDefaultControlWidth },
+    useEmbeddableSelector,
+    useEmbeddableDispatch,
+  } = reduxContainerContext;
+  const dispatch = useEmbeddableDispatch();
+
+  // current state
+  const { defaultControlWidth } = useEmbeddableSelector((state) => state);
+  const [isPopoverOpen, setIsPopoverOpen] = useState(false);
+
+  const createNewControl = async (type: string) => {
+    const factory = getControlFactory(type);
+    if (!factory) throw new EmbeddableFactoryNotFoundError(type);
+
+    const initialInputPromise = new Promise<Omit<InputControlInput, 'id'>>((resolve, reject) => {
+      let inputToReturn: Partial<InputControlInput> = {};
+
+      const onCancel = (ref: OverlayRef) => {
+        if (Object.keys(inputToReturn).length === 0) {
+          reject();
+          ref.close();
+          return;
+        }
+        openConfirm(ControlGroupStrings.management.discardNewControl.getSubtitle(), {
+          confirmButtonText: ControlGroupStrings.management.discardNewControl.getConfirm(),
+          cancelButtonText: ControlGroupStrings.management.discardNewControl.getCancel(),
+          title: ControlGroupStrings.management.discardNewControl.getTitle(),
+          buttonColor: 'danger',
+        }).then((confirmed) => {
+          if (confirmed) {
+            reject();
+            ref.close();
+          }
+        });
+      };
+
+      const flyoutInstance = openFlyout(
+        forwardAllContext(
+          <ControlEditor
+            width={defaultControlWidth ?? DEFAULT_CONTROL_WIDTH}
+            updateTitle={(newTitle) => (inputToReturn.title = newTitle)}
+            updateWidth={(newWidth) => dispatch(setDefaultControlWidth(newWidth as ControlWidth))}
+            controlEditorComponent={(factory as IEditableControlFactory).getControlEditor?.({
+              onChange: (partialInput) => {
+                inputToReturn = { ...inputToReturn, ...partialInput };
+              },
+            })}
+            onSave={() => {
+              resolve(inputToReturn);
+              flyoutInstance.close();
+            }}
+            onCancel={() => onCancel(flyoutInstance)}
+          />,
+          reduxContainerContext
+        ),
+        {
+          onClose: (flyout) => onCancel(flyout),
+        }
+      );
+    });
+    initialInputPromise.then(
+      async (explicitInput) => {
+        await addNewEmbeddable(type, explicitInput);
+      },
+      () => {} // swallow promise rejection because it can be part of normal flow
+    );
+  };
+
+  if (getInputControlTypes().length === 0) return null;
+
+  const commonButtonProps = {
+    iconType: 'plus',
+    color: 'text' as EuiButtonIconColor,
+    'data-test-subj': 'inputControlsSortingButton',
+    'aria-label': ControlGroupStrings.management.getManageButtonTitle(),
+  };
+
+  if (getInputControlTypes().length > 1) {
+    const items: ReactElement[] = [];
+    getInputControlTypes().forEach((type) => {
+      const factory = getControlFactory(type);
+      items.push(
+        <EuiContextMenuItem
+          key={type}
+          icon={factory.getIconType?.()}
+          onClick={() => {
+            setIsPopoverOpen(false);
+            createNewControl(type);
+          }}
+        >
+          {factory.getDisplayName()}
+        </EuiContextMenuItem>
+      );
+    });
+    const button = <EuiButtonIcon {...commonButtonProps} onClick={() => setIsPopoverOpen(true)} />;
+
+    return (
+      <EuiPopover
+        button={button}
+        isOpen={isPopoverOpen}
+        panelPaddingSize="none"
+        anchorPosition="downLeft"
+        closePopover={() => setIsPopoverOpen(false)}
+      >
+        <EuiContextMenuPanel size="s" items={items} />
+      </EuiPopover>
+    );
+  }
+  return (
+    <EuiButtonIcon
+      {...commonButtonProps}
+      onClick={() => createNewControl(getInputControlTypes()[0])}
+    />
+  );
+};
diff --git a/src/plugins/presentation_util/public/components/controls/control_group/editor/edit_control.tsx b/src/plugins/presentation_util/public/components/controls/control_group/editor/edit_control.tsx
new file mode 100644
index 00000000000000..58c59c8f84fe0d
--- /dev/null
+++ b/src/plugins/presentation_util/public/components/controls/control_group/editor/edit_control.tsx
@@ -0,0 +1,127 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { isEqual } from 'lodash';
+import { EuiButtonIcon } from '@elastic/eui';
+import React, { useEffect, useRef } from 'react';
+
+import { ControlGroupInput } from '../types';
+import { ControlEditor } from './control_editor';
+import { IEditableControlFactory } from '../../types';
+import { pluginServices } from '../../../../services';
+import { forwardAllContext } from './forward_all_context';
+import { OverlayRef } from '../../../../../../../core/public';
+import { ControlGroupStrings } from '../control_group_strings';
+import { controlGroupReducers } from '../state/control_group_reducers';
+import { EmbeddableFactoryNotFoundError } from '../../../../../../embeddable/public';
+import { useReduxContainerContext } from '../../../redux_embeddables/redux_embeddable_context';
+
+export const EditControlButton = ({ embeddableId }: { embeddableId: string }) => {
+  // Presentation Services Context
+  const { overlays, controls } = pluginServices.getHooks();
+  const { getControlFactory } = controls.useService();
+  const { openFlyout, openConfirm } = overlays.useService();
+
+  // Redux embeddable container Context
+  const reduxContainerContext = useReduxContainerContext<
+    ControlGroupInput,
+    typeof controlGroupReducers
+  >();
+  const {
+    containerActions: { untilEmbeddableLoaded, removeEmbeddable, updateInputForChild },
+    actions: { setControlWidth },
+    useEmbeddableSelector,
+    useEmbeddableDispatch,
+  } = reduxContainerContext;
+  const dispatch = useEmbeddableDispatch();
+
+  // current state
+  const { panels } = useEmbeddableSelector((state) => state);
+
+  // keep up to date ref of latest panel state for comparison when closing editor.
+  const latestPanelState = useRef(panels[embeddableId]);
+  useEffect(() => {
+    latestPanelState.current = panels[embeddableId];
+  }, [panels, embeddableId]);
+
+  const editControl = async () => {
+    const panel = panels[embeddableId];
+    const factory = getControlFactory(panel.type);
+    const embeddable = await untilEmbeddableLoaded(embeddableId);
+
+    if (!factory) throw new EmbeddableFactoryNotFoundError(panel.type);
+
+    let removed = false;
+    const onCancel = (ref: OverlayRef) => {
+      if (
+        removed ||
+        (isEqual(latestPanelState.current.explicitInput, panel.explicitInput) &&
+          isEqual(latestPanelState.current.width, panel.width))
+      ) {
+        ref.close();
+        return;
+      }
+      openConfirm(ControlGroupStrings.management.discardChanges.getSubtitle(), {
+        confirmButtonText: ControlGroupStrings.management.discardChanges.getConfirm(),
+        cancelButtonText: ControlGroupStrings.management.discardChanges.getCancel(),
+        title: ControlGroupStrings.management.discardChanges.getTitle(),
+        buttonColor: 'danger',
+      }).then((confirmed) => {
+        if (confirmed) {
+          updateInputForChild(embeddableId, panel.explicitInput);
+          dispatch(setControlWidth({ width: panel.width, embeddableId }));
+          ref.close();
+        }
+      });
+    };
+
+    const flyoutInstance = openFlyout(
+      forwardAllContext(
+        <ControlEditor
+          width={panel.width}
+          title={embeddable.getTitle()}
+          removeControl={() => {
+            openConfirm(ControlGroupStrings.management.deleteControls.getSubtitle(), {
+              confirmButtonText: ControlGroupStrings.management.deleteControls.getConfirm(),
+              cancelButtonText: ControlGroupStrings.management.deleteControls.getCancel(),
+              title: ControlGroupStrings.management.deleteControls.getDeleteTitle(),
+              buttonColor: 'danger',
+            }).then((confirmed) => {
+              if (confirmed) {
+                removeEmbeddable(embeddableId);
+                removed = true;
+                flyoutInstance.close();
+              }
+            });
+          }}
+          updateTitle={(newTitle) => updateInputForChild(embeddableId, { title: newTitle })}
+          controlEditorComponent={(factory as IEditableControlFactory).getControlEditor?.({
+            onChange: (partialInput) => updateInputForChild(embeddableId, partialInput),
+            initialInput: embeddable.getInput(),
+          })}
+          onCancel={() => onCancel(flyoutInstance)}
+          onSave={() => flyoutInstance.close()}
+          updateWidth={(newWidth) => dispatch(setControlWidth({ width: newWidth, embeddableId }))}
+        />,
+        reduxContainerContext
+      ),
+      {
+        onClose: (flyout) => onCancel(flyout),
+      }
+    );
+  };
+
+  return (
+    <EuiButtonIcon
+      aria-label={ControlGroupStrings.floatingActions.getEditButtonTitle()}
+      iconType="pencil"
+      onClick={() => editControl()}
+      color="text"
+    />
+  );
+};
diff --git a/src/plugins/presentation_util/public/components/controls/control_group/editor/edit_control_group.tsx b/src/plugins/presentation_util/public/components/controls/control_group/editor/edit_control_group.tsx
new file mode 100644
index 00000000000000..9438091e2fb1da
--- /dev/null
+++ b/src/plugins/presentation_util/public/components/controls/control_group/editor/edit_control_group.tsx
@@ -0,0 +1,124 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import {
+  EuiTitle,
+  EuiSpacer,
+  EuiFormRow,
+  EuiFlexItem,
+  EuiFlexGroup,
+  EuiFlyoutBody,
+  EuiButtonGroup,
+  EuiButtonEmpty,
+  EuiFlyoutHeader,
+} from '@elastic/eui';
+
+import {
+  CONTROL_LAYOUT_OPTIONS,
+  CONTROL_WIDTH_OPTIONS,
+  DEFAULT_CONTROL_WIDTH,
+} from '../control_group_constants';
+import { ControlGroupInput } from '../types';
+import { pluginServices } from '../../../../services';
+import { ControlStyle, ControlWidth } from '../../types';
+import { ControlGroupStrings } from '../control_group_strings';
+import { controlGroupReducers } from '../state/control_group_reducers';
+import { useReduxContainerContext } from '../../../redux_embeddables/redux_embeddable_context';
+
+export const EditControlGroup = () => {
+  const { overlays } = pluginServices.getHooks();
+  const { openConfirm } = overlays.useService();
+
+  const {
+    containerActions,
+    useEmbeddableSelector,
+    useEmbeddableDispatch,
+    actions: { setControlStyle, setAllControlWidths, setDefaultControlWidth },
+  } = useReduxContainerContext<ControlGroupInput, typeof controlGroupReducers>();
+
+  const dispatch = useEmbeddableDispatch();
+  const { panels, controlStyle, defaultControlWidth } = useEmbeddableSelector((state) => state);
+
+  return (
+    <>
+      <EuiFlyoutHeader hasBorder>
+        <EuiTitle size="m">
+          <h2>{ControlGroupStrings.management.getFlyoutTitle()}</h2>
+        </EuiTitle>
+      </EuiFlyoutHeader>
+      <EuiFlyoutBody>
+        <EuiFormRow label={ControlGroupStrings.management.getLayoutTitle()}>
+          <EuiButtonGroup
+            color="primary"
+            legend={ControlGroupStrings.management.controlStyle.getDesignSwitchLegend()}
+            options={CONTROL_LAYOUT_OPTIONS}
+            idSelected={controlStyle}
+            onChange={(newControlStyle) =>
+              dispatch(setControlStyle(newControlStyle as ControlStyle))
+            }
+          />
+        </EuiFormRow>
+        <EuiSpacer size="m" />
+        <EuiFormRow label={ControlGroupStrings.management.getDefaultWidthTitle()}>
+          <EuiFlexGroup direction={'row'}>
+            <EuiFlexItem>
+              <EuiButtonGroup
+                color="primary"
+                idSelected={defaultControlWidth ?? DEFAULT_CONTROL_WIDTH}
+                legend={ControlGroupStrings.management.controlWidth.getWidthSwitchLegend()}
+                options={CONTROL_WIDTH_OPTIONS}
+                onChange={(newWidth: string) =>
+                  dispatch(setDefaultControlWidth(newWidth as ControlWidth))
+                }
+              />
+            </EuiFlexItem>
+            <EuiFlexItem>
+              <EuiButtonEmpty
+                onClick={() =>
+                  dispatch(setAllControlWidths(defaultControlWidth ?? DEFAULT_CONTROL_WIDTH))
+                }
+                aria-label={'delete-all'}
+                iconType="returnKey"
+                size="s"
+              >
+                {ControlGroupStrings.management.getSetAllWidthsToDefaultTitle()}
+              </EuiButtonEmpty>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiFormRow>
+
+        <EuiSpacer size="xl" />
+
+        <EuiButtonEmpty
+          onClick={() => {
+            if (!containerActions?.removeEmbeddable) return;
+            openConfirm(ControlGroupStrings.management.deleteControls.getSubtitle(), {
+              confirmButtonText: ControlGroupStrings.management.deleteControls.getConfirm(),
+              cancelButtonText: ControlGroupStrings.management.deleteControls.getCancel(),
+              title: ControlGroupStrings.management.deleteControls.getDeleteAllTitle(),
+              buttonColor: 'danger',
+            }).then((confirmed) => {
+              if (confirmed)
+                Object.keys(panels).forEach((panelId) =>
+                  containerActions.removeEmbeddable(panelId)
+                );
+            });
+          }}
+          aria-label={'delete-all'}
+          iconType="trash"
+          color="danger"
+          flush="left"
+          size="s"
+        >
+          {ControlGroupStrings.management.getDeleteAllButtonTitle()}
+        </EuiButtonEmpty>
+      </EuiFlyoutBody>
+    </>
+  );
+};
diff --git a/src/plugins/presentation_util/public/components/controls/control_group/editor/forward_all_context.tsx b/src/plugins/presentation_util/public/components/controls/control_group/editor/forward_all_context.tsx
new file mode 100644
index 00000000000000..bb7356c2406482
--- /dev/null
+++ b/src/plugins/presentation_util/public/components/controls/control_group/editor/forward_all_context.tsx
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { Provider } from 'react-redux';
+import { ReactElement } from 'react';
+import React from 'react';
+
+import { ControlGroupInput } from '../types';
+import { pluginServices } from '../../../../services';
+import { toMountPoint } from '../../../../../../kibana_react/public';
+import { ReduxContainerContextServices } from '../../../redux_embeddables/types';
+import { ReduxEmbeddableContext } from '../../../redux_embeddables/redux_embeddable_context';
+import { getManagedEmbeddablesStore } from '../../../redux_embeddables/generic_embeddable_store';
+
+/**
+ * The overlays service creates its divs outside the flow of the component. This necessitates
+ * passing all context from the component to the flyout.
+ */
+export const forwardAllContext = (
+  component: ReactElement,
+  reduxContainerContext: ReduxContainerContextServices<ControlGroupInput>
+) => {
+  const PresentationUtilProvider = pluginServices.getContextProvider();
+  return toMountPoint(
+    <Provider store={getManagedEmbeddablesStore()}>
+      <ReduxEmbeddableContext.Provider value={reduxContainerContext}>
+        <PresentationUtilProvider>{component}</PresentationUtilProvider>
+      </ReduxEmbeddableContext.Provider>
+    </Provider>
+  );
+};
diff --git a/src/plugins/presentation_util/public/components/controls/control_group/editor/manage_control_group_component.tsx b/src/plugins/presentation_util/public/components/controls/control_group/editor/manage_control_group_component.tsx
deleted file mode 100644
index e766b16ade13af..00000000000000
--- a/src/plugins/presentation_util/public/components/controls/control_group/editor/manage_control_group_component.tsx
+++ /dev/null
@@ -1,113 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import useMount from 'react-use/lib/useMount';
-import React, { useState } from 'react';
-import {
-  EuiFlyoutHeader,
-  EuiButtonEmpty,
-  EuiButtonGroup,
-  EuiFlyoutBody,
-  EuiFormRow,
-  EuiSpacer,
-  EuiSwitch,
-  EuiTitle,
-} from '@elastic/eui';
-
-import { ControlsPanels } from '../types';
-import { ControlStyle, ControlWidth } from '../../types';
-import { ControlGroupStrings } from '../control_group_strings';
-import { CONTROL_LAYOUT_OPTIONS, CONTROL_WIDTH_OPTIONS } from '../control_group_constants';
-
-interface ManageControlGroupProps {
-  panels: ControlsPanels;
-  controlStyle: ControlStyle;
-  deleteAllEmbeddables: () => void;
-  setControlStyle: (style: ControlStyle) => void;
-  setAllPanelWidths: (newWidth: ControlWidth) => void;
-}
-
-export const ManageControlGroup = ({
-  panels,
-  controlStyle,
-  setControlStyle,
-  setAllPanelWidths,
-  deleteAllEmbeddables,
-}: ManageControlGroupProps) => {
-  const [currentControlStyle, setCurrentControlStyle] = useState<ControlStyle>(controlStyle);
-  const [selectedWidth, setSelectedWidth] = useState<ControlWidth>();
-  const [selectionDisplay, setSelectionDisplay] = useState(false);
-
-  useMount(() => {
-    if (!panels || Object.keys(panels).length === 0) return;
-    const firstWidth = panels[Object.keys(panels)[0]].width;
-    if (Object.values(panels).every((panel) => panel.width === firstWidth)) {
-      setSelectedWidth(firstWidth);
-    }
-  });
-
-  return (
-    <>
-      <EuiFlyoutHeader hasBorder>
-        <EuiTitle size="m">
-          <h2>{ControlGroupStrings.management.getFlyoutTitle()}</h2>
-        </EuiTitle>
-      </EuiFlyoutHeader>
-      <EuiFlyoutBody>
-        <EuiFormRow label={ControlGroupStrings.management.getLayoutTitle()}>
-          <EuiButtonGroup
-            color="primary"
-            legend={ControlGroupStrings.management.controlStyle.getDesignSwitchLegend()}
-            options={CONTROL_LAYOUT_OPTIONS}
-            idSelected={currentControlStyle}
-            onChange={(newControlStyle) => {
-              setControlStyle(newControlStyle as ControlStyle);
-              setCurrentControlStyle(newControlStyle as ControlStyle);
-            }}
-          />
-        </EuiFormRow>
-        <EuiSpacer size="m" />
-        <EuiFormRow label={ControlGroupStrings.management.getWidthTitle()}>
-          <EuiSwitch
-            label={ControlGroupStrings.management.controlWidth.getChangeAllControlWidthsTitle()}
-            checked={selectionDisplay}
-            onChange={() => setSelectionDisplay(!selectionDisplay)}
-          />
-        </EuiFormRow>
-        {selectionDisplay ? (
-          <>
-            <EuiSpacer size="s" />
-            <EuiButtonGroup
-              color="primary"
-              idSelected={selectedWidth ?? ''}
-              legend={ControlGroupStrings.management.controlWidth.getWidthSwitchLegend()}
-              options={CONTROL_WIDTH_OPTIONS}
-              onChange={(newWidth: string) => {
-                setAllPanelWidths(newWidth as ControlWidth);
-                setSelectedWidth(newWidth as ControlWidth);
-              }}
-            />
-          </>
-        ) : undefined}
-
-        <EuiSpacer size="xl" />
-
-        <EuiButtonEmpty
-          onClick={deleteAllEmbeddables}
-          aria-label={'delete-all'}
-          iconType="trash"
-          color="danger"
-          flush="left"
-          size="s"
-        >
-          {ControlGroupStrings.management.getDeleteAllButtonTitle()}
-        </EuiButtonEmpty>
-      </EuiFlyoutBody>
-    </>
-  );
-};
diff --git a/src/plugins/presentation_util/public/components/controls/control_group/embeddable/control_group_container.tsx b/src/plugins/presentation_util/public/components/controls/control_group/embeddable/control_group_container.tsx
new file mode 100644
index 00000000000000..a722bed6c07d23
--- /dev/null
+++ b/src/plugins/presentation_util/public/components/controls/control_group/embeddable/control_group_container.tsx
@@ -0,0 +1,77 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import ReactDOM from 'react-dom';
+
+import {
+  InputControlEmbeddable,
+  InputControlInput,
+  InputControlOutput,
+} from '../../../../services/controls';
+import { pluginServices } from '../../../../services';
+import { ControlGroupInput, ControlPanelState } from '../types';
+import { ControlGroup } from '../component/control_group_component';
+import { controlGroupReducers } from '../state/control_group_reducers';
+import { Container, EmbeddableFactory } from '../../../../../../embeddable/public';
+import { CONTROL_GROUP_TYPE, DEFAULT_CONTROL_WIDTH } from '../control_group_constants';
+import { ReduxEmbeddableWrapper } from '../../../redux_embeddables/redux_embeddable_wrapper';
+
+export class ControlGroupContainer extends Container<InputControlInput, ControlGroupInput> {
+  public readonly type = CONTROL_GROUP_TYPE;
+
+  constructor(initialInput: ControlGroupInput, parent?: Container) {
+    super(
+      initialInput,
+      { embeddableLoaded: {} },
+      pluginServices.getServices().controls.getControlFactory,
+      parent
+    );
+  }
+
+  protected createNewPanelState<TEmbeddableInput extends InputControlInput = InputControlInput>(
+    factory: EmbeddableFactory<InputControlInput, InputControlOutput, InputControlEmbeddable>,
+    partial: Partial<TEmbeddableInput> = {}
+  ): ControlPanelState<TEmbeddableInput> {
+    const panelState = super.createNewPanelState(factory, partial);
+    const highestOrder = Object.values(this.getInput().panels).reduce((highestSoFar, panel) => {
+      if (panel.order > highestSoFar) highestSoFar = panel.order;
+      return highestSoFar;
+    }, 0);
+    return {
+      order: highestOrder + 1,
+      width: this.getInput().defaultControlWidth ?? DEFAULT_CONTROL_WIDTH,
+      ...panelState,
+    } as ControlPanelState<TEmbeddableInput>;
+  }
+
+  protected getInheritedInput(id: string): InputControlInput {
+    const { filters, query, timeRange, inheritParentState } = this.getInput();
+    return {
+      filters: inheritParentState.useFilters ? filters : undefined,
+      query: inheritParentState.useQuery ? query : undefined,
+      timeRange: inheritParentState.useTimerange ? timeRange : undefined,
+      id,
+    };
+  }
+
+  public render(dom: HTMLElement) {
+    const PresentationUtilProvider = pluginServices.getContextProvider();
+    ReactDOM.render(
+      <PresentationUtilProvider>
+        <ReduxEmbeddableWrapper<ControlGroupInput>
+          embeddable={this}
+          reducers={controlGroupReducers}
+        >
+          <ControlGroup />
+        </ReduxEmbeddableWrapper>
+      </PresentationUtilProvider>,
+      dom
+    );
+  }
+}
diff --git a/src/plugins/presentation_util/public/components/controls/control_group/control_group_container_factory.ts b/src/plugins/presentation_util/public/components/controls/control_group/embeddable/control_group_container_factory.ts
similarity index 71%
rename from src/plugins/presentation_util/public/components/controls/control_group/control_group_container_factory.ts
rename to src/plugins/presentation_util/public/components/controls/control_group/embeddable/control_group_container_factory.ts
index 97ef48e6b240cd..e50b1c5d734e4c 100644
--- a/src/plugins/presentation_util/public/components/controls/control_group/control_group_container_factory.ts
+++ b/src/plugins/presentation_util/public/components/controls/control_group/embeddable/control_group_container_factory.ts
@@ -20,13 +20,11 @@ import {
   EmbeddableFactory,
   EmbeddableFactoryDefinition,
   ErrorEmbeddable,
-} from '../../../../../embeddable/public';
-import { ControlGroupInput } from './types';
-import { ControlsService } from '../controls_service';
-import { ControlGroupStrings } from './control_group_strings';
-import { CONTROL_GROUP_TYPE } from './control_group_constants';
+} from '../../../../../../embeddable/public';
+import { ControlGroupInput } from '../types';
+import { ControlGroupStrings } from '../control_group_strings';
+import { CONTROL_GROUP_TYPE } from '../control_group_constants';
 import { ControlGroupContainer } from './control_group_container';
-import { PresentationOverlaysService } from '../../../services/overlays';
 
 export type DashboardContainerFactory = EmbeddableFactory<
   ControlGroupInput,
@@ -38,13 +36,6 @@ export class ControlGroupContainerFactory
 {
   public readonly isContainerType = true;
   public readonly type = CONTROL_GROUP_TYPE;
-  public readonly controlsService: ControlsService;
-  private readonly overlays: PresentationOverlaysService;
-
-  constructor(controlsService: ControlsService, overlays: PresentationOverlaysService) {
-    this.overlays = overlays;
-    this.controlsService = controlsService;
-  }
 
   public isEditable = async () => false;
 
@@ -67,6 +58,6 @@ export class ControlGroupContainerFactory
     initialInput: ControlGroupInput,
     parent?: Container
   ): Promise<ControlGroupContainer | ErrorEmbeddable> => {
-    return new ControlGroupContainer(initialInput, this.controlsService, this.overlays, parent);
+    return new ControlGroupContainer(initialInput, parent);
   };
 }
diff --git a/src/plugins/presentation_util/public/components/controls/control_group/state/control_group_reducers.ts b/src/plugins/presentation_util/public/components/controls/control_group/state/control_group_reducers.ts
new file mode 100644
index 00000000000000..b7c0c62535d4cd
--- /dev/null
+++ b/src/plugins/presentation_util/public/components/controls/control_group/state/control_group_reducers.ts
@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { PayloadAction } from '@reduxjs/toolkit';
+import { WritableDraft } from 'immer/dist/types/types-external';
+
+import { ControlWidth } from '../../types';
+import { ControlGroupInput } from '../types';
+
+export const controlGroupReducers = {
+  setControlStyle: (
+    state: WritableDraft<ControlGroupInput>,
+    action: PayloadAction<ControlGroupInput['controlStyle']>
+  ) => {
+    state.controlStyle = action.payload;
+  },
+  setDefaultControlWidth: (
+    state: WritableDraft<ControlGroupInput>,
+    action: PayloadAction<ControlGroupInput['defaultControlWidth']>
+  ) => {
+    state.defaultControlWidth = action.payload;
+  },
+  setAllControlWidths: (
+    state: WritableDraft<ControlGroupInput>,
+    action: PayloadAction<ControlWidth>
+  ) => {
+    Object.keys(state.panels).forEach((panelId) => (state.panels[panelId].width = action.payload));
+  },
+  setControlWidth: (
+    state: WritableDraft<ControlGroupInput>,
+    action: PayloadAction<{ width: ControlWidth; embeddableId: string }>
+  ) => {
+    state.panels[action.payload.embeddableId].width = action.payload.width;
+  },
+  setControlOrders: (
+    state: WritableDraft<ControlGroupInput>,
+    action: PayloadAction<{ ids: string[] }>
+  ) => {
+    action.payload.ids.forEach((id, index) => {
+      state.panels[id].order = index;
+    });
+  },
+};
diff --git a/src/plugins/presentation_util/public/components/controls/control_group/types.ts b/src/plugins/presentation_util/public/components/controls/control_group/types.ts
index fb381610711e57..438eee1c461ddb 100644
--- a/src/plugins/presentation_util/public/components/controls/control_group/types.ts
+++ b/src/plugins/presentation_util/public/components/controls/control_group/types.ts
@@ -7,7 +7,8 @@
  */
 
 import { PanelState, EmbeddableInput } from '../../../../../embeddable/public';
-import { ControlStyle, ControlWidth, InputControlInput } from '../types';
+import { InputControlInput } from '../../../services/controls';
+import { ControlStyle, ControlWidth } from '../types';
 
 export interface ControlGroupInput
   extends EmbeddableInput,
@@ -17,6 +18,7 @@ export interface ControlGroupInput
     useQuery: boolean;
     useTimerange: boolean;
   };
+  defaultControlWidth?: ControlWidth;
   controlStyle: ControlStyle;
   panels: ControlsPanels;
 }
diff --git a/src/plugins/presentation_util/public/components/controls/control_types/options_list/options_list_embeddable.tsx b/src/plugins/presentation_util/public/components/controls/control_types/options_list/options_list_embeddable.tsx
index 93a7b3e353bdf1..97a128c3e84eb9 100644
--- a/src/plugins/presentation_util/public/components/controls/control_types/options_list/options_list_embeddable.tsx
+++ b/src/plugins/presentation_util/public/components/controls/control_types/options_list/options_list_embeddable.tsx
@@ -16,7 +16,7 @@ import { tap, debounceTime, map, distinctUntilChanged } from 'rxjs/operators';
 import { esFilters } from '../../../../../../data/public';
 import { OptionsListStrings } from './options_list_strings';
 import { Embeddable, IContainer } from '../../../../../../embeddable/public';
-import { InputControlInput, InputControlOutput } from '../../types';
+import { InputControlInput, InputControlOutput } from '../../../../services/controls';
 import { OptionsListComponent, OptionsListComponentState } from './options_list_component';
 
 const toggleAvailableOptions = (
diff --git a/src/plugins/presentation_util/public/components/controls/controls_service.ts b/src/plugins/presentation_util/public/components/controls/controls_service.ts
index 4e01f3cf9ab6a8..82242946e4563e 100644
--- a/src/plugins/presentation_util/public/components/controls/controls_service.ts
+++ b/src/plugins/presentation_util/public/components/controls/controls_service.ts
@@ -8,12 +8,12 @@
 
 import { EmbeddableFactory } from '../../../../embeddable/public';
 import {
-  ControlTypeRegistry,
   InputControlEmbeddable,
+  ControlTypeRegistry,
   InputControlFactory,
-  InputControlInput,
   InputControlOutput,
-} from './types';
+  InputControlInput,
+} from '../../services/controls';
 
 export class ControlsService {
   private controlsFactoriesMap: ControlTypeRegistry = {};
diff --git a/src/plugins/presentation_util/public/components/controls/hooks/use_child_embeddable.ts b/src/plugins/presentation_util/public/components/controls/hooks/use_child_embeddable.ts
index 82b9aa528bf35e..c4f700ec059d9e 100644
--- a/src/plugins/presentation_util/public/components/controls/hooks/use_child_embeddable.ts
+++ b/src/plugins/presentation_util/public/components/controls/hooks/use_child_embeddable.ts
@@ -6,14 +6,13 @@
  * Side Public License, v 1.
  */
 import { useEffect, useState } from 'react';
-import { InputControlEmbeddable } from '../types';
-import { IContainer } from '../../../../../embeddable/public';
+import { InputControlEmbeddable } from '../../../services/controls';
 
 export const useChildEmbeddable = ({
-  container,
+  untilEmbeddableLoaded,
   embeddableId,
 }: {
-  container: IContainer;
+  untilEmbeddableLoaded: (embeddableId: string) => Promise<InputControlEmbeddable>;
   embeddableId: string;
 }) => {
   const [embeddable, setEmbeddable] = useState<InputControlEmbeddable>();
@@ -21,14 +20,14 @@ export const useChildEmbeddable = ({
   useEffect(() => {
     let mounted = true;
     (async () => {
-      const newEmbeddable = await container.untilEmbeddableLoaded(embeddableId);
+      const newEmbeddable = await untilEmbeddableLoaded(embeddableId);
       if (!mounted) return;
       setEmbeddable(newEmbeddable);
     })();
     return () => {
       mounted = false;
     };
-  }, [container, embeddableId]);
+  }, [untilEmbeddableLoaded, embeddableId]);
 
   return embeddable;
 };
diff --git a/src/plugins/presentation_util/public/components/controls/types.ts b/src/plugins/presentation_util/public/components/controls/types.ts
index c94e2957e34ea9..0704a601640e63 100644
--- a/src/plugins/presentation_util/public/components/controls/types.ts
+++ b/src/plugins/presentation_util/public/components/controls/types.ts
@@ -6,47 +6,11 @@
  * Side Public License, v 1.
  */
 
-import { Filter } from '@kbn/es-query';
-import { Query, TimeRange } from '../../../../data/public';
-import {
-  EmbeddableFactory,
-  EmbeddableInput,
-  EmbeddableOutput,
-  IEmbeddable,
-} from '../../../../embeddable/public';
+import { InputControlInput } from '../../services/controls';
 
 export type ControlWidth = 'auto' | 'small' | 'medium' | 'large';
 export type ControlStyle = 'twoLine' | 'oneLine';
 
-/**
- * Control embeddable types
- */
-export type InputControlFactory = EmbeddableFactory<
-  InputControlInput,
-  InputControlOutput,
-  InputControlEmbeddable
->;
-
-export interface ControlTypeRegistry {
-  [key: string]: InputControlFactory;
-}
-
-export type InputControlInput = EmbeddableInput & {
-  query?: Query;
-  filters?: Filter[];
-  timeRange?: TimeRange;
-  twoLineLayout?: boolean;
-};
-
-export type InputControlOutput = EmbeddableOutput & {
-  filters?: Filter[];
-};
-
-export type InputControlEmbeddable<
-  TInputControlEmbeddableInput extends InputControlInput = InputControlInput,
-  TInputControlEmbeddableOutput extends InputControlOutput = InputControlOutput
-> = IEmbeddable<TInputControlEmbeddableInput, TInputControlEmbeddableOutput>;
-
 /**
  * Control embeddable editor types
  */
diff --git a/src/plugins/presentation_util/public/components/redux_embeddables/generic_embeddable_store.ts b/src/plugins/presentation_util/public/components/redux_embeddables/generic_embeddable_store.ts
new file mode 100644
index 00000000000000..36ba1fcaa49b91
--- /dev/null
+++ b/src/plugins/presentation_util/public/components/redux_embeddables/generic_embeddable_store.ts
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { configureStore, EnhancedStore } from '@reduxjs/toolkit';
+import { combineReducers, Reducer } from 'redux';
+
+export interface InjectReducerProps<StateShape> {
+  key: string;
+  asyncReducer: Reducer<StateShape>;
+}
+
+type ManagedEmbeddableReduxStore = EnhancedStore & {
+  asyncReducers: { [key: string]: Reducer<unknown> };
+  injectReducer: <StateShape>(props: InjectReducerProps<StateShape>) => void;
+};
+const embeddablesStore = configureStore({ reducer: {} as { [key: string]: Reducer } });
+
+const managedEmbeddablesStore = embeddablesStore as ManagedEmbeddableReduxStore;
+managedEmbeddablesStore.asyncReducers = {};
+
+managedEmbeddablesStore.injectReducer = <StateShape>({
+  key,
+  asyncReducer,
+}: InjectReducerProps<StateShape>) => {
+  managedEmbeddablesStore.asyncReducers[key] = asyncReducer as Reducer<unknown>;
+  managedEmbeddablesStore.replaceReducer(
+    combineReducers({ ...managedEmbeddablesStore.asyncReducers })
+  );
+};
+
+/**
+ * A managed Redux store which can be used with multiple embeddables at once. When a new embeddable is created at runtime,
+ * all passed in reducers will be made into a slice, then combined into the store using combineReducers.
+ */
+export const getManagedEmbeddablesStore = () => managedEmbeddablesStore;
diff --git a/src/plugins/presentation_util/public/components/redux_embeddables/redux_embeddable_context.ts b/src/plugins/presentation_util/public/components/redux_embeddables/redux_embeddable_context.ts
new file mode 100644
index 00000000000000..159230e4de0248
--- /dev/null
+++ b/src/plugins/presentation_util/public/components/redux_embeddables/redux_embeddable_context.ts
@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import { createContext, useContext } from 'react';
+
+import {
+  GenericEmbeddableReducers,
+  ReduxContainerContextServices,
+  ReduxEmbeddableContextServices,
+} from './types';
+import { ContainerInput, EmbeddableInput } from '../../../../embeddable/public';
+
+/**
+ * When creating the context, a generic EmbeddableInput as placeholder is used. This will later be cast to
+ * the generic type passed in by the useReduxEmbeddableContext or useReduxContainerContext hooks
+ **/
+export const ReduxEmbeddableContext = createContext<
+  | ReduxEmbeddableContextServices<EmbeddableInput>
+  | ReduxContainerContextServices<EmbeddableInput>
+  | null
+>(null);
+
+/**
+ * A typed use context hook for embeddables that are not containers. it @returns an
+ * ReduxEmbeddableContextServices object typed to the generic inputTypes and ReducerTypes you pass in.
+ * Note that the reducer type is optional, but will be required to correctly infer the keys and payload
+ * types of your reducers. use `typeof MyReducers` here to retain them.
+ */
+export const useReduxEmbeddableContext = <
+  InputType extends EmbeddableInput = EmbeddableInput,
+  ReducerType extends GenericEmbeddableReducers<InputType> = GenericEmbeddableReducers<InputType>
+>(): ReduxEmbeddableContextServices<InputType, ReducerType> => {
+  const context = useContext<ReduxEmbeddableContextServices<InputType, ReducerType>>(
+    ReduxEmbeddableContext as unknown as React.Context<
+      ReduxEmbeddableContextServices<InputType, ReducerType>
+    >
+  );
+  if (context == null) {
+    throw new Error(
+      'useReduxEmbeddableContext must be used inside the useReduxEmbeddableContextProvider.'
+    );
+  }
+
+  return context!;
+};
+
+/**
+ * A typed use context hook for embeddable containers. it @returns an
+ * ReduxContainerContextServices object typed to the generic inputTypes and ReducerTypes you pass in.
+ * Note that the reducer type is optional, but will be required to correctly infer the keys and payload
+ * types of your reducers. use `typeof MyReducers` here to retain them. It also includes a containerActions
+ * key which contains most of the commonly used container operations
+ */
+export const useReduxContainerContext = <
+  InputType extends ContainerInput = ContainerInput,
+  ReducerType extends GenericEmbeddableReducers<InputType> = GenericEmbeddableReducers<InputType>
+>(): ReduxContainerContextServices<InputType, ReducerType> => {
+  const context = useContext<ReduxContainerContextServices<InputType, ReducerType>>(
+    ReduxEmbeddableContext as unknown as React.Context<
+      ReduxContainerContextServices<InputType, ReducerType>
+    >
+  );
+  if (context == null) {
+    throw new Error(
+      'useReduxEmbeddableContext must be used inside the useReduxEmbeddableContextProvider.'
+    );
+  }
+  return context!;
+};
diff --git a/src/plugins/presentation_util/public/components/redux_embeddables/redux_embeddable_wrapper.tsx b/src/plugins/presentation_util/public/components/redux_embeddables/redux_embeddable_wrapper.tsx
new file mode 100644
index 00000000000000..a4912b5b5f2fc2
--- /dev/null
+++ b/src/plugins/presentation_util/public/components/redux_embeddables/redux_embeddable_wrapper.tsx
@@ -0,0 +1,162 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React, { PropsWithChildren, useEffect, useMemo, useRef } from 'react';
+import { Provider, TypedUseSelectorHook, useDispatch, useSelector } from 'react-redux';
+import { Draft } from 'immer/dist/types/types-external';
+import { isEqual } from 'lodash';
+import { SliceCaseReducers, PayloadAction, createSlice } from '@reduxjs/toolkit';
+
+import {
+  IEmbeddable,
+  EmbeddableInput,
+  EmbeddableOutput,
+  IContainer,
+} from '../../../../embeddable/public';
+import { getManagedEmbeddablesStore } from './generic_embeddable_store';
+import {
+  ReduxContainerContextServices,
+  ReduxEmbeddableContextServices,
+  ReduxEmbeddableWrapperProps,
+} from './types';
+import { ReduxEmbeddableContext, useReduxEmbeddableContext } from './redux_embeddable_context';
+
+const getDefaultProps = <InputType extends EmbeddableInput = EmbeddableInput>(): Required<
+  Pick<ReduxEmbeddableWrapperProps<InputType>, 'diffInput'>
+> => ({
+  diffInput: (a, b) => {
+    const differences: Partial<InputType> = {};
+    const allKeys = [...Object.keys(a), ...Object.keys(b)] as Array<keyof InputType>;
+    allKeys.forEach((key) => {
+      if (!isEqual(a[key], b[key])) differences[key] = a[key];
+    });
+    return differences;
+  },
+});
+
+const embeddableIsContainer = (
+  embeddable: IEmbeddable<EmbeddableInput, EmbeddableOutput>
+): embeddable is IContainer => embeddable.isContainer;
+
+/**
+ * Place this wrapper around the react component when rendering an embeddable to automatically set up
+ * redux for use with the embeddable via the supplied reducers. Any child components can then use ReduxEmbeddableContext
+ * or ReduxContainerContext to interface with the state of the embeddable.
+ */
+export const ReduxEmbeddableWrapper = <InputType extends EmbeddableInput = EmbeddableInput>(
+  props: PropsWithChildren<ReduxEmbeddableWrapperProps<InputType>>
+) => {
+  const { embeddable, reducers, diffInput } = useMemo(
+    () => ({ ...getDefaultProps<InputType>(), ...props }),
+    [props]
+  );
+
+  const containerActions: ReduxContainerContextServices['containerActions'] | undefined =
+    useMemo(() => {
+      if (embeddableIsContainer(embeddable)) {
+        return {
+          untilEmbeddableLoaded: embeddable.untilEmbeddableLoaded.bind(embeddable),
+          updateInputForChild: embeddable.updateInputForChild.bind(embeddable),
+          removeEmbeddable: embeddable.removeEmbeddable.bind(embeddable),
+          addNewEmbeddable: embeddable.addNewEmbeddable.bind(embeddable),
+        };
+      }
+      return;
+    }, [embeddable]);
+
+  const reduxEmbeddableContext: ReduxEmbeddableContextServices | ReduxContainerContextServices =
+    useMemo(() => {
+      const key = `${embeddable.type}_${embeddable.id}`;
+
+      // A generic reducer used to update redux state when the embeddable input changes
+      const updateEmbeddableReduxState = (
+        state: Draft<InputType>,
+        action: PayloadAction<Partial<InputType>>
+      ) => {
+        return { ...state, ...action.payload };
+      };
+
+      const slice = createSlice<InputType, SliceCaseReducers<InputType>>({
+        initialState: embeddable.getInput(),
+        name: key,
+        reducers: { ...reducers, updateEmbeddableReduxState },
+      });
+      const store = getManagedEmbeddablesStore();
+
+      store.injectReducer({
+        key,
+        asyncReducer: slice.reducer,
+      });
+
+      const useEmbeddableSelector: TypedUseSelectorHook<InputType> = () =>
+        useSelector((state: ReturnType<typeof store.getState>) => state[key]);
+
+      return {
+        useEmbeddableDispatch: () => useDispatch<typeof store.dispatch>(),
+        useEmbeddableSelector,
+        actions: slice.actions as ReduxEmbeddableContextServices['actions'],
+        containerActions,
+      };
+    }, [reducers, embeddable, containerActions]);
+
+  return (
+    <Provider store={getManagedEmbeddablesStore()}>
+      <ReduxEmbeddableContext.Provider value={reduxEmbeddableContext}>
+        <ReduxEmbeddableSync diffInput={diffInput} embeddable={embeddable}>
+          {props.children}
+        </ReduxEmbeddableSync>
+      </ReduxEmbeddableContext.Provider>
+    </Provider>
+  );
+};
+
+interface ReduxEmbeddableSyncProps<InputType extends EmbeddableInput = EmbeddableInput> {
+  diffInput: (a: InputType, b: InputType) => Partial<InputType>;
+  embeddable: IEmbeddable<InputType, EmbeddableOutput>;
+}
+
+/**
+ * This component uses the context from the embeddable wrapper to set up a generic two-way binding between the embeddable input and
+ * the redux store. a custom diffInput function can be provided, this function should always prioritize input A over input B.
+ */
+const ReduxEmbeddableSync = <InputType extends EmbeddableInput = EmbeddableInput>({
+  embeddable,
+  diffInput,
+  children,
+}: PropsWithChildren<ReduxEmbeddableSyncProps<InputType>>) => {
+  const {
+    useEmbeddableSelector,
+    useEmbeddableDispatch,
+    actions: { updateEmbeddableReduxState },
+  } = useReduxEmbeddableContext<InputType>();
+
+  const dispatch = useEmbeddableDispatch();
+  const currentState = useEmbeddableSelector((state) => state);
+  const stateRef = useRef(currentState);
+
+  // When Embeddable Input changes, push differences to redux.
+  useEffect(() => {
+    embeddable.getInput$().subscribe(() => {
+      const differences = diffInput(embeddable.getInput(), stateRef.current);
+      if (differences && Object.keys(differences).length > 0) {
+        dispatch(updateEmbeddableReduxState(differences));
+      }
+    });
+  }, [diffInput, dispatch, embeddable, updateEmbeddableReduxState]);
+
+  // When redux state changes, push differences to Embeddable Input.
+  useEffect(() => {
+    stateRef.current = currentState;
+    const differences = diffInput(currentState, embeddable.getInput());
+    if (differences && Object.keys(differences).length > 0) {
+      embeddable.updateInput(differences);
+    }
+  }, [currentState, diffInput, embeddable]);
+
+  return <>{children}</>;
+};
diff --git a/src/plugins/presentation_util/public/components/redux_embeddables/types.ts b/src/plugins/presentation_util/public/components/redux_embeddables/types.ts
new file mode 100644
index 00000000000000..118b5d340528ea
--- /dev/null
+++ b/src/plugins/presentation_util/public/components/redux_embeddables/types.ts
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import {
+  ActionCreatorWithPayload,
+  AnyAction,
+  CaseReducer,
+  Dispatch,
+  PayloadAction,
+} from '@reduxjs/toolkit';
+import { TypedUseSelectorHook } from 'react-redux';
+import {
+  EmbeddableInput,
+  EmbeddableOutput,
+  IContainer,
+  IEmbeddable,
+} from '../../../../embeddable/public';
+
+export interface GenericEmbeddableReducers<InputType> {
+  /**
+   * PayloadAction of type any is strategic here because we want to allow payloads of any shape in generic reducers.
+   * This type will be overridden to remove any and be type safe when returned by ReduxEmbeddableContextServices.
+   */
+  [key: string]: CaseReducer<InputType, PayloadAction<any>>;
+}
+
+export interface ReduxEmbeddableWrapperProps<InputType extends EmbeddableInput = EmbeddableInput> {
+  embeddable: IEmbeddable<InputType, EmbeddableOutput>;
+  reducers: GenericEmbeddableReducers<InputType>;
+  diffInput?: (a: InputType, b: InputType) => Partial<InputType>;
+}
+
+/**
+ * This context allows components underneath the redux embeddable wrapper to get access to the actions, selector, dispatch, and containerActions.
+ */
+export interface ReduxEmbeddableContextServices<
+  InputType extends EmbeddableInput = EmbeddableInput,
+  ReducerType extends GenericEmbeddableReducers<InputType> = GenericEmbeddableReducers<InputType>
+> {
+  actions: {
+    [Property in keyof ReducerType]: ActionCreatorWithPayload<
+      Parameters<ReducerType[Property]>[1]['payload']
+    >;
+  } & { updateEmbeddableReduxState: ActionCreatorWithPayload<Partial<InputType>> };
+  useEmbeddableSelector: TypedUseSelectorHook<InputType>;
+  useEmbeddableDispatch: () => Dispatch<AnyAction>;
+}
+
+export type ReduxContainerContextServices<
+  InputType extends EmbeddableInput = EmbeddableInput,
+  ReducerType extends GenericEmbeddableReducers<InputType> = GenericEmbeddableReducers<InputType>
+> = ReduxEmbeddableContextServices<InputType, ReducerType> & {
+  containerActions: Pick<
+    IContainer,
+    'untilEmbeddableLoaded' | 'removeEmbeddable' | 'addNewEmbeddable' | 'updateInputForChild'
+  >;
+};
diff --git a/src/plugins/presentation_util/public/mocks.ts b/src/plugins/presentation_util/public/mocks.ts
index 91c461646c280c..ddb02ce464e22e 100644
--- a/src/plugins/presentation_util/public/mocks.ts
+++ b/src/plugins/presentation_util/public/mocks.ts
@@ -17,6 +17,7 @@ const createStartContract = (coreStart: CoreStart): PresentationUtilPluginStart
   const startContract: PresentationUtilPluginStart = {
     ContextProvider: pluginServices.getContextProvider(),
     labsService: pluginServices.getServices().labs,
+    controlsService: pluginServices.getServices().controls,
   };
   return startContract;
 };
diff --git a/src/plugins/presentation_util/public/plugin.ts b/src/plugins/presentation_util/public/plugin.ts
index f34bd2f1f8afed..f697f1a29eb82e 100644
--- a/src/plugins/presentation_util/public/plugin.ts
+++ b/src/plugins/presentation_util/public/plugin.ts
@@ -39,6 +39,7 @@ export class PresentationUtilPlugin
     pluginServices.setRegistry(registry.start({ coreStart, startPlugins }));
     return {
       ContextProvider: pluginServices.getContextProvider(),
+      controlsService: pluginServices.getServices().controls,
       labsService: pluginServices.getServices().labs,
     };
   }
diff --git a/src/plugins/presentation_util/public/services/controls.ts b/src/plugins/presentation_util/public/services/controls.ts
new file mode 100644
index 00000000000000..197e986381b10a
--- /dev/null
+++ b/src/plugins/presentation_util/public/services/controls.ts
@@ -0,0 +1,85 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { Filter } from '@kbn/es-query';
+import { Query, TimeRange } from '../../../data/public';
+import {
+  EmbeddableFactory,
+  EmbeddableInput,
+  EmbeddableOutput,
+  IEmbeddable,
+} from '../../../embeddable/public';
+
+/**
+ * Control embeddable types
+ */
+export type InputControlFactory = EmbeddableFactory<
+  InputControlInput,
+  InputControlOutput,
+  InputControlEmbeddable
+>;
+
+export type InputControlInput = EmbeddableInput & {
+  query?: Query;
+  filters?: Filter[];
+  timeRange?: TimeRange;
+  twoLineLayout?: boolean;
+};
+
+export type InputControlOutput = EmbeddableOutput & {
+  filters?: Filter[];
+};
+
+export type InputControlEmbeddable<
+  TInputControlEmbeddableInput extends InputControlInput = InputControlInput,
+  TInputControlEmbeddableOutput extends InputControlOutput = InputControlOutput
+> = IEmbeddable<TInputControlEmbeddableInput, TInputControlEmbeddableOutput>;
+
+export interface ControlTypeRegistry {
+  [key: string]: InputControlFactory;
+}
+
+export interface PresentationControlsService {
+  registerInputControlType: (factory: InputControlFactory) => void;
+
+  getControlFactory: <
+    I extends InputControlInput = InputControlInput,
+    O extends InputControlOutput = InputControlOutput,
+    E extends InputControlEmbeddable<I, O> = InputControlEmbeddable<I, O>
+  >(
+    type: string
+  ) => EmbeddableFactory<I, O, E>;
+
+  getInputControlTypes: () => string[];
+}
+
+export const getCommonControlsService = () => {
+  const controlsFactoriesMap: ControlTypeRegistry = {};
+
+  const registerInputControlType = (factory: InputControlFactory) => {
+    controlsFactoriesMap[factory.type] = factory;
+  };
+
+  const getControlFactory = <
+    I extends InputControlInput = InputControlInput,
+    O extends InputControlOutput = InputControlOutput,
+    E extends InputControlEmbeddable<I, O> = InputControlEmbeddable<I, O>
+  >(
+    type: string
+  ) => {
+    return controlsFactoriesMap[type] as EmbeddableFactory<I, O, E>;
+  };
+
+  const getInputControlTypes = () => Object.keys(controlsFactoriesMap);
+
+  return {
+    registerInputControlType,
+    getControlFactory,
+    getInputControlTypes,
+  };
+};
diff --git a/src/plugins/presentation_util/public/services/index.ts b/src/plugins/presentation_util/public/services/index.ts
index c622ad82bb888f..21012971ca86d2 100644
--- a/src/plugins/presentation_util/public/services/index.ts
+++ b/src/plugins/presentation_util/public/services/index.ts
@@ -13,6 +13,7 @@ import { PresentationDashboardsService } from './dashboards';
 import { PresentationLabsService } from './labs';
 import { registry as stubRegistry } from './stub';
 import { PresentationOverlaysService } from './overlays';
+import { PresentationControlsService } from './controls';
 
 export { PresentationCapabilitiesService } from './capabilities';
 export { PresentationDashboardsService } from './dashboards';
@@ -21,6 +22,7 @@ export interface PresentationUtilServices {
   dashboards: PresentationDashboardsService;
   capabilities: PresentationCapabilitiesService;
   overlays: PresentationOverlaysService;
+  controls: PresentationControlsService;
   labs: PresentationLabsService;
 }
 
@@ -31,5 +33,6 @@ export const getStubPluginServices = (): PresentationUtilPluginStart => {
   return {
     ContextProvider: pluginServices.getContextProvider(),
     labsService: pluginServices.getServices().labs,
+    controlsService: pluginServices.getServices().controls,
   };
 };
diff --git a/src/plugins/presentation_util/public/components/controls/index.ts b/src/plugins/presentation_util/public/services/kibana/controls.ts
similarity index 54%
rename from src/plugins/presentation_util/public/components/controls/index.ts
rename to src/plugins/presentation_util/public/services/kibana/controls.ts
index 5c2d5b68ae2e03..e5dc84a3dd645d 100644
--- a/src/plugins/presentation_util/public/components/controls/index.ts
+++ b/src/plugins/presentation_util/public/services/kibana/controls.ts
@@ -5,3 +5,9 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
+
+import { PluginServiceFactory } from '../create';
+import { getCommonControlsService, PresentationControlsService } from '../controls';
+
+export type ControlsServiceFactory = PluginServiceFactory<PresentationControlsService>;
+export const controlsServiceFactory = () => getCommonControlsService();
diff --git a/src/plugins/presentation_util/public/services/kibana/index.ts b/src/plugins/presentation_util/public/services/kibana/index.ts
index 8a9a28606f24b9..48c921bff1efd6 100644
--- a/src/plugins/presentation_util/public/services/kibana/index.ts
+++ b/src/plugins/presentation_util/public/services/kibana/index.ts
@@ -18,6 +18,7 @@ import {
 } from '../create';
 import { PresentationUtilPluginStartDeps } from '../../types';
 import { PresentationUtilServices } from '..';
+import { controlsServiceFactory } from './controls';
 
 export { capabilitiesServiceFactory } from './capabilities';
 export { dashboardsServiceFactory } from './dashboards';
@@ -32,6 +33,7 @@ export const providers: PluginServiceProviders<
   labs: new PluginServiceProvider(labsServiceFactory),
   dashboards: new PluginServiceProvider(dashboardsServiceFactory),
   overlays: new PluginServiceProvider(overlaysServiceFactory),
+  controls: new PluginServiceProvider(controlsServiceFactory),
 };
 
 export const registry = new PluginServiceRegistry<
diff --git a/src/plugins/presentation_util/public/services/storybook/controls.ts b/src/plugins/presentation_util/public/services/storybook/controls.ts
new file mode 100644
index 00000000000000..e5dc84a3dd645d
--- /dev/null
+++ b/src/plugins/presentation_util/public/services/storybook/controls.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { PluginServiceFactory } from '../create';
+import { getCommonControlsService, PresentationControlsService } from '../controls';
+
+export type ControlsServiceFactory = PluginServiceFactory<PresentationControlsService>;
+export const controlsServiceFactory = () => getCommonControlsService();
diff --git a/src/plugins/presentation_util/public/services/storybook/index.ts b/src/plugins/presentation_util/public/services/storybook/index.ts
index 1ce1eb72848c9f..9de4934d513000 100644
--- a/src/plugins/presentation_util/public/services/storybook/index.ts
+++ b/src/plugins/presentation_util/public/services/storybook/index.ts
@@ -6,12 +6,18 @@
  * Side Public License, v 1.
  */
 
-import { PluginServices, PluginServiceProviders, PluginServiceProvider } from '../create';
+import {
+  PluginServices,
+  PluginServiceProviders,
+  PluginServiceProvider,
+  PluginServiceRegistry,
+} from '../create';
 import { dashboardsServiceFactory } from '../stub/dashboards';
 import { labsServiceFactory } from './labs';
 import { capabilitiesServiceFactory } from './capabilities';
 import { PresentationUtilServices } from '..';
 import { overlaysServiceFactory } from './overlays';
+import { controlsServiceFactory } from './controls';
 
 export { PluginServiceProviders, PluginServiceProvider, PluginServiceRegistry } from '../create';
 export { PresentationUtilServices } from '..';
@@ -27,7 +33,10 @@ export const providers: PluginServiceProviders<PresentationUtilServices, Storybo
   capabilities: new PluginServiceProvider(capabilitiesServiceFactory),
   dashboards: new PluginServiceProvider(dashboardsServiceFactory),
   overlays: new PluginServiceProvider(overlaysServiceFactory),
+  controls: new PluginServiceProvider(controlsServiceFactory),
   labs: new PluginServiceProvider(labsServiceFactory),
 };
 
 export const pluginServices = new PluginServices<PresentationUtilServices>();
+
+export const registry = new PluginServiceRegistry<PresentationUtilServices>(providers);
diff --git a/src/plugins/presentation_util/public/services/stub/controls.ts b/src/plugins/presentation_util/public/services/stub/controls.ts
new file mode 100644
index 00000000000000..e5dc84a3dd645d
--- /dev/null
+++ b/src/plugins/presentation_util/public/services/stub/controls.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { PluginServiceFactory } from '../create';
+import { getCommonControlsService, PresentationControlsService } from '../controls';
+
+export type ControlsServiceFactory = PluginServiceFactory<PresentationControlsService>;
+export const controlsServiceFactory = () => getCommonControlsService();
diff --git a/src/plugins/presentation_util/public/services/stub/index.ts b/src/plugins/presentation_util/public/services/stub/index.ts
index 61dca474275315..35aabdb465b147 100644
--- a/src/plugins/presentation_util/public/services/stub/index.ts
+++ b/src/plugins/presentation_util/public/services/stub/index.ts
@@ -12,7 +12,7 @@ import { labsServiceFactory } from './labs';
 import { PluginServiceProviders, PluginServiceProvider, PluginServiceRegistry } from '../create';
 import { PresentationUtilServices } from '..';
 import { overlaysServiceFactory } from './overlays';
-
+import { controlsServiceFactory } from './controls';
 export { dashboardsServiceFactory } from './dashboards';
 export { capabilitiesServiceFactory } from './capabilities';
 
@@ -20,6 +20,7 @@ export const providers: PluginServiceProviders<PresentationUtilServices> = {
   dashboards: new PluginServiceProvider(dashboardsServiceFactory),
   capabilities: new PluginServiceProvider(capabilitiesServiceFactory),
   overlays: new PluginServiceProvider(overlaysServiceFactory),
+  controls: new PluginServiceProvider(controlsServiceFactory),
   labs: new PluginServiceProvider(labsServiceFactory),
 };
 
diff --git a/src/plugins/presentation_util/public/types.ts b/src/plugins/presentation_util/public/types.ts
index 05779ffb206c4d..3903d1bc2786e7 100644
--- a/src/plugins/presentation_util/public/types.ts
+++ b/src/plugins/presentation_util/public/types.ts
@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 
+import { PresentationControlsService } from './services/controls';
 import { PresentationLabsService } from './services/labs';
 
 // eslint-disable-next-line @typescript-eslint/no-empty-interface
@@ -14,6 +15,7 @@ export interface PresentationUtilPluginSetup {}
 export interface PresentationUtilPluginStart {
   ContextProvider: React.FC;
   labsService: PresentationLabsService;
+  controlsService: PresentationControlsService;
 }
 
 // eslint-disable-next-line @typescript-eslint/no-empty-interface

From 461f9f65ccb5e3e9444d2ce69013fd9856f49b30 Mon Sep 17 00:00:00 2001
From: Devon Thomson <devon.thomson@hotmail.com>
Date: Wed, 13 Oct 2021 21:12:21 -0400
Subject: [PATCH 35/71] fix package.json: (#114936)

---
 package.json | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/package.json b/package.json
index 6e4a37863bc821..f526f357ff3476 100644
--- a/package.json
+++ b/package.json
@@ -91,9 +91,6 @@
     "yarn": "^1.21.1"
   },
   "dependencies": {
-    "@dnd-kit/core": "^3.1.1",
-    "@dnd-kit/sortable": "^4.0.0",
-    "@dnd-kit/utilities": "^2.0.0",
     "@babel/runtime": "^7.15.4",
     "@dnd-kit/core": "^3.1.1",
     "@dnd-kit/sortable": "^4.0.0",

From 5647de3b4a32815a5c8c4df1a35072bb3d1db7db Mon Sep 17 00:00:00 2001
From: Tyler Smalley <tyler.smalley@elastic.co>
Date: Wed, 13 Oct 2021 18:18:06 -0700
Subject: [PATCH 36/71] [ci] Fixes Bazel cache writes (#114915)

Signed-off-by: Tyler Smalley <tyler.smalley@elastic.co>
---
 .../scripts/common/persist_bazel_cache.sh     | 14 +++++++++++
 .buildkite/scripts/common/setup_bazel.sh      | 24 -------------------
 .../steps/on_merge_build_and_metrics.sh       |  2 +-
 src/dev/ci_setup/.bazelrc-ci                  | 13 +++++-----
 src/dev/ci_setup/.bazelrc-ci.common           | 11 ---------
 5 files changed, 21 insertions(+), 43 deletions(-)
 create mode 100755 .buildkite/scripts/common/persist_bazel_cache.sh
 delete mode 100755 .buildkite/scripts/common/setup_bazel.sh
 delete mode 100644 src/dev/ci_setup/.bazelrc-ci.common

diff --git a/.buildkite/scripts/common/persist_bazel_cache.sh b/.buildkite/scripts/common/persist_bazel_cache.sh
new file mode 100755
index 00000000000000..597ab0947c2676
--- /dev/null
+++ b/.buildkite/scripts/common/persist_bazel_cache.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+source .buildkite/scripts/common/util.sh
+
+KIBANA_BUILDBUDDY_CI_API_KEY=$(retry 5 5 vault read -field=value secret/kibana-issues/dev/kibana-buildbuddy-ci-api-key)
+export KIBANA_BUILDBUDDY_CI_API_KEY
+
+cp "$KIBANA_DIR/src/dev/ci_setup/.bazelrc-ci" "$KIBANA_DIR/.bazelrc"
+
+###
+### append auth token to buildbuddy into "$HOME/.bazelrc";
+###
+echo "# Appended by .buildkite/scripts/persist_bazel_cache.sh" >> "$KIBANA_DIR/.bazelrc"
+echo "build --remote_header=x-buildbuddy-api-key=$KIBANA_BUILDBUDDY_CI_API_KEY" >> "$KIBANA_DIR/.bazelrc"
diff --git a/.buildkite/scripts/common/setup_bazel.sh b/.buildkite/scripts/common/setup_bazel.sh
deleted file mode 100755
index bbd1c584971721..00000000000000
--- a/.buildkite/scripts/common/setup_bazel.sh
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/usr/bin/env bash
-
-source .buildkite/scripts/common/util.sh
-
-KIBANA_BUILDBUDDY_CI_API_KEY=$(retry 5 5 vault read -field=value secret/kibana-issues/dev/kibana-buildbuddy-ci-api-key)
-export KIBANA_BUILDBUDDY_CI_API_KEY
-
-cp "$KIBANA_DIR/src/dev/ci_setup/.bazelrc-ci" "$HOME/.bazelrc"
-
-###
-### append auth token to buildbuddy into "$HOME/.bazelrc";
-###
-echo "# Appended by .buildkite/scripts/setup_bazel.sh" >> "$HOME/.bazelrc"
-echo "build --remote_header=x-buildbuddy-api-key=$KIBANA_BUILDBUDDY_CI_API_KEY" >> "$HOME/.bazelrc"
-
-###
-### remove write permissions on buildbuddy remote cache for prs
-###
-if [[ "${BUILDKITE_PULL_REQUEST:-}" && "$BUILDKITE_PULL_REQUEST" != "false" ]] ; then
-  {
-    echo "# Uploads logs & artifacts without writing to cache"
-    echo "build --noremote_upload_local_results"
-  } >> "$HOME/.bazelrc"
-fi
diff --git a/.buildkite/scripts/steps/on_merge_build_and_metrics.sh b/.buildkite/scripts/steps/on_merge_build_and_metrics.sh
index b24e585e707354..315ba08f8719b0 100755
--- a/.buildkite/scripts/steps/on_merge_build_and_metrics.sh
+++ b/.buildkite/scripts/steps/on_merge_build_and_metrics.sh
@@ -3,7 +3,7 @@
 set -euo pipefail
 
 # Write Bazel cache for Linux
-.buildkite/scripts/common/setup_bazel.sh
+.buildkite/scripts/common/persist_bazel_cache.sh
 
 .buildkite/scripts/bootstrap.sh
 .buildkite/scripts/build_kibana.sh
diff --git a/src/dev/ci_setup/.bazelrc-ci b/src/dev/ci_setup/.bazelrc-ci
index ef6fab3a30590a..9aee657f37bcbc 100644
--- a/src/dev/ci_setup/.bazelrc-ci
+++ b/src/dev/ci_setup/.bazelrc-ci
@@ -1,16 +1,15 @@
-# Inspired on https://github.com/angular/angular/blob/master/.circleci/bazel.linux.rc
-# These options are only enabled when running on CI
-# That is done by copying this file into "$HOME/.bazelrc" which loads after the .bazelrc into the workspace
+# Used in the on-merge job to persist the Bazel cache to BuildBuddy
+# from: .buildkite/scripts/common/persist_bazel_cache.sh
 
-# Import and load bazelrc common settings for ci env
-try-import %workspace%/src/dev/ci_setup/.bazelrc-ci.common
+import %workspace%/.bazelrc.common
 
 # BuildBuddy settings
-## Remote settings including cache
 build --bes_results_url=https://app.buildbuddy.io/invocation/
 build --bes_backend=grpcs://cloud.buildbuddy.io
 build --remote_cache=grpcs://cloud.buildbuddy.io
 build --remote_timeout=3600
+# --remote_header=x-buildbuddy-api-key= # appended in CI script
 
-## Metadata settings
+# Metadata settings
 build --build_metadata=ROLE=CI
+build --workspace_status_command="node ./src/dev/bazel_workspace_status.js"
diff --git a/src/dev/ci_setup/.bazelrc-ci.common b/src/dev/ci_setup/.bazelrc-ci.common
deleted file mode 100644
index 56a5ee8d30cd6d..00000000000000
--- a/src/dev/ci_setup/.bazelrc-ci.common
+++ /dev/null
@@ -1,11 +0,0 @@
-# Inspired on https://github.com/angular/angular/blob/master/.circleci/bazel.common.rc
-# Settings in this file should be OS agnostic
-
-# Don't be spammy in the logs
-build --noshow_progress
-
-# More details on failures
-build --verbose_failures=true
-
-## Avoid to keep connections to build event backend connections alive across builds
-build --keep_backend_build_event_connections_alive=false

From 423b0e801fb29dcf02f6588fa8f888b9aebe2f15 Mon Sep 17 00:00:00 2001
From: Tiago Costa <tiagoffcc@hotmail.com>
Date: Thu, 14 Oct 2021 03:35:17 +0100
Subject: [PATCH 37/71] chore(NA): fixes a typo on persist_bazel_cache.sh
 comment (#114943)

---
 .buildkite/scripts/common/persist_bazel_cache.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.buildkite/scripts/common/persist_bazel_cache.sh b/.buildkite/scripts/common/persist_bazel_cache.sh
index 597ab0947c2676..357805c11acecf 100755
--- a/.buildkite/scripts/common/persist_bazel_cache.sh
+++ b/.buildkite/scripts/common/persist_bazel_cache.sh
@@ -5,10 +5,11 @@ source .buildkite/scripts/common/util.sh
 KIBANA_BUILDBUDDY_CI_API_KEY=$(retry 5 5 vault read -field=value secret/kibana-issues/dev/kibana-buildbuddy-ci-api-key)
 export KIBANA_BUILDBUDDY_CI_API_KEY
 
+# overwrites the file checkout .bazelrc file with the one intended for CI env
 cp "$KIBANA_DIR/src/dev/ci_setup/.bazelrc-ci" "$KIBANA_DIR/.bazelrc"
 
 ###
-### append auth token to buildbuddy into "$HOME/.bazelrc";
+### append auth token to buildbuddy into "$KIBANA_DIR/.bazelrc";
 ###
 echo "# Appended by .buildkite/scripts/persist_bazel_cache.sh" >> "$KIBANA_DIR/.bazelrc"
 echo "build --remote_header=x-buildbuddy-api-key=$KIBANA_BUILDBUDDY_CI_API_KEY" >> "$KIBANA_DIR/.bazelrc"

From 86f0733e5642a10b77025f36199d895282c1e601 Mon Sep 17 00:00:00 2001
From: Jen Huang <its.jenetic@gmail.com>
Date: Wed, 13 Oct 2021 19:49:16 -0700
Subject: [PATCH 38/71] Clean up inaccurate comments (#114935)

---
 .../create_package_policy_page/step_configure_package.tsx        | 1 -
 x-pack/plugins/fleet/server/services/epm/packages/get.ts         | 1 -
 2 files changed, 2 deletions(-)

diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/step_configure_package.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/step_configure_package.tsx
index 1ff5d20baec068..390e540f1b10f6 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/step_configure_package.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/step_configure_package.tsx
@@ -49,7 +49,6 @@ export const StepConfigurePackagePolicy: React.FunctionComponent<{
   );
 
   // Configure inputs (and their streams)
-  // Assume packages only export one config template for now
   const renderConfigureInputs = () =>
     packagePolicyTemplates.length ? (
       <>
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/get.ts b/x-pack/plugins/fleet/server/services/epm/packages/get.ts
index cf847cdf62bc20..8d3c1fbe0daa4a 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/get.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/get.ts
@@ -69,7 +69,6 @@ export async function getPackages(
 }
 
 // Get package names for packages which cannot have more than one package policy on an agent policy
-// Assume packages only export one policy template for now
 export async function getLimitedPackages(options: {
   savedObjectsClient: SavedObjectsClientContract;
 }): Promise<string[]> {

From 69a6cf329ce8be83b48a102e28983b7d0ca11ab8 Mon Sep 17 00:00:00 2001
From: Yara Tercero <yctercero@users.noreply.github.com>
Date: Wed, 13 Oct 2021 20:32:43 -0700
Subject: [PATCH 39/71] Fixing exceptions export format (#114920)

### Summary

Fixing exceptions export format and adding integration tests for it.
---
 .../src/api/index.ts                          |   2 +-
 .../kbn-securitysolution-utils/src/index.ts   |   1 +
 .../transform_data_to_ndjson/index.test.ts    |  88 ++++++++++
 .../src/transform_data_to_ndjson/index.ts     |  16 ++
 .../lists/public/exceptions/api.test.ts       |   2 +-
 .../routes/export_exception_list_route.ts     |  42 +++--
 .../downloads/test_exception_list.ndjson      |   2 +
 .../exceptions/exceptions_table.spec.ts       |   2 +-
 .../cypress/objects/exception.ts              |   3 +-
 .../detection_engine/rules/get_export_all.ts  |   3 +-
 .../rules/get_export_by_object_ids.ts         |   2 +-
 .../server/lib/telemetry/sender.ts            |   3 +-
 .../timelines/export_timelines/helpers.ts     |   3 +-
 .../create_stream_from_ndjson.test.ts         |  71 --------
 .../read_stream/create_stream_from_ndjson.ts  |   9 -
 .../tests/export_exception_list.ts            | 155 ++++++++++++++++++
 .../security_and_spaces/tests/index.ts        |   1 +
 17 files changed, 292 insertions(+), 113 deletions(-)
 create mode 100644 packages/kbn-securitysolution-utils/src/transform_data_to_ndjson/index.test.ts
 create mode 100644 packages/kbn-securitysolution-utils/src/transform_data_to_ndjson/index.ts
 create mode 100644 x-pack/plugins/security_solution/cypress/downloads/test_exception_list.ndjson
 delete mode 100644 x-pack/plugins/security_solution/server/utils/read_stream/create_stream_from_ndjson.test.ts
 create mode 100644 x-pack/test/lists_api_integration/security_and_spaces/tests/export_exception_list.ts

diff --git a/packages/kbn-securitysolution-list-api/src/api/index.ts b/packages/kbn-securitysolution-list-api/src/api/index.ts
index d70417a29971f8..77c50fb32c299e 100644
--- a/packages/kbn-securitysolution-list-api/src/api/index.ts
+++ b/packages/kbn-securitysolution-list-api/src/api/index.ts
@@ -558,7 +558,7 @@ export const exportExceptionList = async ({
   signal,
 }: ExportExceptionListProps): Promise<Blob> =>
   http.fetch<Blob>(`${EXCEPTION_LIST_URL}/_export`, {
-    method: 'GET',
+    method: 'POST',
     query: { id, list_id: listId, namespace_type: namespaceType },
     signal,
   });
diff --git a/packages/kbn-securitysolution-utils/src/index.ts b/packages/kbn-securitysolution-utils/src/index.ts
index 0bb36c590ffdfd..755bbd2203dffd 100644
--- a/packages/kbn-securitysolution-utils/src/index.ts
+++ b/packages/kbn-securitysolution-utils/src/index.ts
@@ -7,3 +7,4 @@
  */
 
 export * from './add_remove_id_to_item';
+export * from './transform_data_to_ndjson';
diff --git a/packages/kbn-securitysolution-utils/src/transform_data_to_ndjson/index.test.ts b/packages/kbn-securitysolution-utils/src/transform_data_to_ndjson/index.test.ts
new file mode 100644
index 00000000000000..b10626357f5b10
--- /dev/null
+++ b/packages/kbn-securitysolution-utils/src/transform_data_to_ndjson/index.test.ts
@@ -0,0 +1,88 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { transformDataToNdjson } from './';
+
+export const ANCHOR_DATE = '2020-02-20T03:57:54.037Z';
+
+const getRulesSchemaMock = (anchorDate: string = ANCHOR_DATE) => ({
+  author: [],
+  id: '7a7065d7-6e8b-4aae-8d20-c93613dec9f9',
+  created_at: new Date(anchorDate).toISOString(),
+  updated_at: new Date(anchorDate).toISOString(),
+  created_by: 'elastic',
+  description: 'some description',
+  enabled: true,
+  false_positives: ['false positive 1', 'false positive 2'],
+  from: 'now-6m',
+  immutable: false,
+  name: 'Query with a rule id',
+  query: 'user.name: root or user.name: admin',
+  references: ['test 1', 'test 2'],
+  severity: 'high',
+  severity_mapping: [],
+  updated_by: 'elastic_kibana',
+  tags: ['some fake tag 1', 'some fake tag 2'],
+  to: 'now',
+  type: 'query',
+  threat: [],
+  version: 1,
+  status: 'succeeded',
+  status_date: '2020-02-22T16:47:50.047Z',
+  last_success_at: '2020-02-22T16:47:50.047Z',
+  last_success_message: 'succeeded',
+  output_index: '.siem-signals-default',
+  max_signals: 100,
+  risk_score: 55,
+  risk_score_mapping: [],
+  language: 'kuery',
+  rule_id: 'query-rule-id',
+  interval: '5m',
+  exceptions_list: [],
+});
+
+describe('transformDataToNdjson', () => {
+  test('if rules are empty it returns an empty string', () => {
+    const ruleNdjson = transformDataToNdjson([]);
+    expect(ruleNdjson).toEqual('');
+  });
+
+  test('single rule will transform with new line ending character for ndjson', () => {
+    const rule = getRulesSchemaMock();
+    const ruleNdjson = transformDataToNdjson([rule]);
+    expect(ruleNdjson.endsWith('\n')).toBe(true);
+  });
+
+  test('multiple rules will transform with two new line ending characters for ndjson', () => {
+    const result1 = getRulesSchemaMock();
+    const result2 = getRulesSchemaMock();
+    result2.id = 'some other id';
+    result2.rule_id = 'some other id';
+    result2.name = 'Some other rule';
+
+    const ruleNdjson = transformDataToNdjson([result1, result2]);
+    // this is how we count characters in JavaScript :-)
+    const count = ruleNdjson.split('\n').length - 1;
+    expect(count).toBe(2);
+  });
+
+  test('you can parse two rules back out without errors', () => {
+    const result1 = getRulesSchemaMock();
+    const result2 = getRulesSchemaMock();
+    result2.id = 'some other id';
+    result2.rule_id = 'some other id';
+    result2.name = 'Some other rule';
+
+    const ruleNdjson = transformDataToNdjson([result1, result2]);
+    const ruleStrings = ruleNdjson.split('\n');
+    const reParsed1 = JSON.parse(ruleStrings[0]);
+    const reParsed2 = JSON.parse(ruleStrings[1]);
+    expect(reParsed1).toEqual(result1);
+    expect(reParsed2).toEqual(result2);
+  });
+});
diff --git a/packages/kbn-securitysolution-utils/src/transform_data_to_ndjson/index.ts b/packages/kbn-securitysolution-utils/src/transform_data_to_ndjson/index.ts
new file mode 100644
index 00000000000000..66a500731f4974
--- /dev/null
+++ b/packages/kbn-securitysolution-utils/src/transform_data_to_ndjson/index.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export const transformDataToNdjson = (data: unknown[]): string => {
+  if (data.length !== 0) {
+    const dataString = data.map((item) => JSON.stringify(item)).join('\n');
+    return `${dataString}\n`;
+  } else {
+    return '';
+  }
+};
diff --git a/x-pack/plugins/lists/public/exceptions/api.test.ts b/x-pack/plugins/lists/public/exceptions/api.test.ts
index a196999d149438..65c11bfc1dfd09 100644
--- a/x-pack/plugins/lists/public/exceptions/api.test.ts
+++ b/x-pack/plugins/lists/public/exceptions/api.test.ts
@@ -759,7 +759,7 @@ describe('Exceptions Lists API', () => {
       });
 
       expect(httpMock.fetch).toHaveBeenCalledWith('/api/exception_lists/_export', {
-        method: 'GET',
+        method: 'POST',
         query: {
           id: 'some-id',
           list_id: 'list-id',
diff --git a/x-pack/plugins/lists/server/routes/export_exception_list_route.ts b/x-pack/plugins/lists/server/routes/export_exception_list_route.ts
index a238d0e6529ff2..aa30c8a7d435d4 100644
--- a/x-pack/plugins/lists/server/routes/export_exception_list_route.ts
+++ b/x-pack/plugins/lists/server/routes/export_exception_list_route.ts
@@ -6,6 +6,7 @@
  */
 
 import { transformError } from '@kbn/securitysolution-es-utils';
+import { transformDataToNdjson } from '@kbn/securitysolution-utils';
 import { exportExceptionListQuerySchema } from '@kbn/securitysolution-io-ts-list-types';
 import { EXCEPTION_LIST_URL } from '@kbn/securitysolution-list-constants';
 
@@ -14,7 +15,7 @@ import type { ListsPluginRouter } from '../types';
 import { buildRouteValidation, buildSiemResponse, getExceptionListClient } from './utils';
 
 export const exportExceptionListRoute = (router: ListsPluginRouter): void => {
-  router.get(
+  router.post(
     {
       options: {
         tags: ['access:lists-read'],
@@ -26,6 +27,7 @@ export const exportExceptionListRoute = (router: ListsPluginRouter): void => {
     },
     async (context, request, response) => {
       const siemResponse = buildSiemResponse(response);
+
       try {
         const { id, list_id: listId, namespace_type: namespaceType } = request.query;
         const exceptionLists = getExceptionListClient(context);
@@ -37,11 +39,10 @@ export const exportExceptionListRoute = (router: ListsPluginRouter): void => {
 
         if (exceptionList == null) {
           return siemResponse.error({
-            body: `list_id: ${listId} does not exist`,
+            body: `exception list with list_id: ${listId} does not exist`,
             statusCode: 400,
           });
         } else {
-          const { exportData: exportList } = getExport([exceptionList]);
           const listItems = await exceptionLists.findExceptionListItem({
             filter: undefined,
             listId,
@@ -51,19 +52,15 @@ export const exportExceptionListRoute = (router: ListsPluginRouter): void => {
             sortField: 'exception-list.created_at',
             sortOrder: 'desc',
           });
+          const exceptionItems = listItems?.data ?? [];
 
-          const { exportData: exportListItems, exportDetails } = getExport(listItems?.data ?? []);
-
-          const responseBody = [
-            exportList,
-            exportListItems,
-            { exception_list_items_details: exportDetails },
-          ];
+          const { exportData } = getExport([exceptionList, ...exceptionItems]);
+          const { exportDetails } = getExportDetails(exceptionItems);
 
           // TODO: Allow the API to override the name of the file to export
           const fileName = exceptionList.list_id;
           return response.ok({
-            body: transformDataToNdjson(responseBody),
+            body: `${exportData}${exportDetails}`,
             headers: {
               'Content-Disposition': `attachment; filename="${fileName}"`,
               'Content-Type': 'application/ndjson',
@@ -81,24 +78,23 @@ export const exportExceptionListRoute = (router: ListsPluginRouter): void => {
   );
 };
 
-const transformDataToNdjson = (data: unknown[]): string => {
-  if (data.length !== 0) {
-    const dataString = data.map((dataItem) => JSON.stringify(dataItem)).join('\n');
-    return `${dataString}\n`;
-  } else {
-    return '';
-  }
-};
-
 export const getExport = (
   data: unknown[]
 ): {
   exportData: string;
-  exportDetails: string;
 } => {
   const ndjson = transformDataToNdjson(data);
+
+  return { exportData: ndjson };
+};
+
+export const getExportDetails = (
+  items: unknown[]
+): {
+  exportDetails: string;
+} => {
   const exportDetails = JSON.stringify({
-    exported_count: data.length,
+    exported_list_items_count: items.length,
   });
-  return { exportData: ndjson, exportDetails: `${exportDetails}\n` };
+  return { exportDetails: `${exportDetails}\n` };
 };
diff --git a/x-pack/plugins/security_solution/cypress/downloads/test_exception_list.ndjson b/x-pack/plugins/security_solution/cypress/downloads/test_exception_list.ndjson
new file mode 100644
index 00000000000000..54420eff29e0de
--- /dev/null
+++ b/x-pack/plugins/security_solution/cypress/downloads/test_exception_list.ndjson
@@ -0,0 +1,2 @@
+{"_version":"WzQyNjA0LDFd","created_at":"2021-10-14T01:30:22.034Z","created_by":"elastic","description":"Test exception list description","id":"4c65a230-2c8e-11ec-be1c-2bbdec602f88","immutable":false,"list_id":"test_exception_list","name":"Test exception list","namespace_type":"single","os_types":[],"tags":[],"tie_breaker_id":"b04983b4-1617-441c-bb6c-c729281fa2e9","type":"detection","updated_at":"2021-10-14T01:30:22.036Z","updated_by":"elastic","version":1}
+{"exported_list_items_count":0}
diff --git a/x-pack/plugins/security_solution/cypress/integration/exceptions/exceptions_table.spec.ts b/x-pack/plugins/security_solution/cypress/integration/exceptions/exceptions_table.spec.ts
index 8530f949664b86..c8b6f73912acf5 100644
--- a/x-pack/plugins/security_solution/cypress/integration/exceptions/exceptions_table.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/exceptions/exceptions_table.spec.ts
@@ -81,7 +81,7 @@ describe('Exceptions Table', () => {
 
     cy.wait('@export').then(({ response }) =>
       cy
-        .wrap(response?.body!)
+        .wrap(response?.body)
         .should('eql', expectedExportedExceptionList(this.exceptionListResponse))
     );
   });
diff --git a/x-pack/plugins/security_solution/cypress/objects/exception.ts b/x-pack/plugins/security_solution/cypress/objects/exception.ts
index 81c3b885ab94da..b7729246971480 100644
--- a/x-pack/plugins/security_solution/cypress/objects/exception.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/exception.ts
@@ -41,6 +41,5 @@ export const expectedExportedExceptionList = (
   exceptionListResponse: Cypress.Response<ExceptionListItemSchema>
 ): string => {
   const jsonrule = exceptionListResponse.body;
-
-  return `"{\\"_version\\":\\"${jsonrule._version}\\",\\"created_at\\":\\"${jsonrule.created_at}\\",\\"created_by\\":\\"elastic\\",\\"description\\":\\"${jsonrule.description}\\",\\"id\\":\\"${jsonrule.id}\\",\\"immutable\\":false,\\"list_id\\":\\"test_exception_list\\",\\"name\\":\\"Test exception list\\",\\"namespace_type\\":\\"single\\",\\"os_types\\":[],\\"tags\\":[],\\"tie_breaker_id\\":\\"${jsonrule.tie_breaker_id}\\",\\"type\\":\\"detection\\",\\"updated_at\\":\\"${jsonrule.updated_at}\\",\\"updated_by\\":\\"elastic\\",\\"version\\":1}\\n"\n""\n{"exception_list_items_details":"{\\"exported_count\\":0}\\n"}\n`;
+  return `{"_version":"${jsonrule._version}","created_at":"${jsonrule.created_at}","created_by":"elastic","description":"${jsonrule.description}","id":"${jsonrule.id}","immutable":false,"list_id":"test_exception_list","name":"Test exception list","namespace_type":"single","os_types":[],"tags":[],"tie_breaker_id":"${jsonrule.tie_breaker_id}","type":"detection","updated_at":"${jsonrule.updated_at}","updated_by":"elastic","version":1}\n{"exported_list_items_count":0}\n`;
 };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.ts
index f44471e6e26f98..71079ccefc97ab 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.ts
@@ -5,11 +5,12 @@
  * 2.0.
  */
 
+import { transformDataToNdjson } from '@kbn/securitysolution-utils';
+
 import { RulesClient } from '../../../../../alerting/server';
 import { getNonPackagedRules } from './get_existing_prepackaged_rules';
 import { getExportDetailsNdjson } from './get_export_details_ndjson';
 import { transformAlertsToRules } from '../routes/rules/utils';
-import { transformDataToNdjson } from '../../../utils/read_stream/create_stream_from_ndjson';
 
 export const getExportAll = async (
   rulesClient: RulesClient,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.ts
index 31a7604306de70..4cf3ad9133a714 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.ts
@@ -6,13 +6,13 @@
  */
 
 import { chunk } from 'lodash';
+import { transformDataToNdjson } from '@kbn/securitysolution-utils';
 
 import { RulesSchema } from '../../../../common/detection_engine/schemas/response/rules_schema';
 import { RulesClient } from '../../../../../alerting/server';
 import { getExportDetailsNdjson } from './get_export_details_ndjson';
 import { isAlertType } from '../rules/types';
 import { transformAlertToRule } from '../routes/rules/utils';
-import { transformDataToNdjson } from '../../../utils/read_stream/create_stream_from_ndjson';
 import { INTERNAL_RULE_ID_KEY } from '../../../../common/constants';
 import { findRules } from './find_rules';
 
diff --git a/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts b/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts
index 2966fa3decc261..7c9906d0eae48c 100644
--- a/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts
+++ b/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts
@@ -8,10 +8,11 @@
 import { cloneDeep } from 'lodash';
 import axios from 'axios';
 import { URL } from 'url';
+import { transformDataToNdjson } from '@kbn/securitysolution-utils';
+
 import { Logger } from 'src/core/server';
 import { TelemetryPluginStart, TelemetryPluginSetup } from 'src/plugins/telemetry/server';
 import { UsageCounter } from 'src/plugins/usage_collection/server';
-import { transformDataToNdjson } from '../../utils/read_stream/create_stream_from_ndjson';
 import {
   TaskManagerSetupContract,
   TaskManagerStartContract,
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/export_timelines/helpers.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/export_timelines/helpers.ts
index a33b8be0c2f31b..c857e7fa38a27c 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/export_timelines/helpers.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/export_timelines/helpers.ts
@@ -6,6 +6,7 @@
  */
 
 import { omit } from 'lodash/fp';
+import { transformDataToNdjson } from '@kbn/securitysolution-utils';
 
 import {
   ExportedTimelines,
@@ -15,8 +16,6 @@ import {
 import { NoteSavedObject } from '../../../../../../common/types/timeline/note';
 import { PinnedEventSavedObject } from '../../../../../../common/types/timeline/pinned_event';
 
-import { transformDataToNdjson } from '../../../../../utils/read_stream/create_stream_from_ndjson';
-
 import { FrameworkRequest } from '../../../../framework';
 import * as noteLib from '../../../saved_object/notes';
 import * as pinnedEventLib from '../../../saved_object/pinned_events';
diff --git a/x-pack/plugins/security_solution/server/utils/read_stream/create_stream_from_ndjson.test.ts b/x-pack/plugins/security_solution/server/utils/read_stream/create_stream_from_ndjson.test.ts
deleted file mode 100644
index c3163da6ac9491..00000000000000
--- a/x-pack/plugins/security_solution/server/utils/read_stream/create_stream_from_ndjson.test.ts
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { transformDataToNdjson } from './create_stream_from_ndjson';
-import { ImportRulesSchemaDecoded } from '../../../common/detection_engine/schemas/request/import_rules_schema';
-import { getRulesSchemaMock } from '../../../common/detection_engine/schemas/response/rules_schema.mocks';
-
-export const getOutputSample = (): Partial<ImportRulesSchemaDecoded> => ({
-  rule_id: 'rule-1',
-  output_index: '.siem-signals',
-  risk_score: 50,
-  description: 'some description',
-  from: 'now-5m',
-  to: 'now',
-  index: ['index-1'],
-  name: 'some-name',
-  severity: 'low',
-  interval: '5m',
-  type: 'query',
-});
-
-export const getSampleAsNdjson = (sample: Partial<ImportRulesSchemaDecoded>): string => {
-  return `${JSON.stringify(sample)}\n`;
-};
-
-describe('create_rules_stream_from_ndjson', () => {
-  describe('transformDataToNdjson', () => {
-    test('if rules are empty it returns an empty string', () => {
-      const ruleNdjson = transformDataToNdjson([]);
-      expect(ruleNdjson).toEqual('');
-    });
-
-    test('single rule will transform with new line ending character for ndjson', () => {
-      const rule = getRulesSchemaMock();
-      const ruleNdjson = transformDataToNdjson([rule]);
-      expect(ruleNdjson.endsWith('\n')).toBe(true);
-    });
-
-    test('multiple rules will transform with two new line ending characters for ndjson', () => {
-      const result1 = getRulesSchemaMock();
-      const result2 = getRulesSchemaMock();
-      result2.id = 'some other id';
-      result2.rule_id = 'some other id';
-      result2.name = 'Some other rule';
-
-      const ruleNdjson = transformDataToNdjson([result1, result2]);
-      // this is how we count characters in JavaScript :-)
-      const count = ruleNdjson.split('\n').length - 1;
-      expect(count).toBe(2);
-    });
-
-    test('you can parse two rules back out without errors', () => {
-      const result1 = getRulesSchemaMock();
-      const result2 = getRulesSchemaMock();
-      result2.id = 'some other id';
-      result2.rule_id = 'some other id';
-      result2.name = 'Some other rule';
-
-      const ruleNdjson = transformDataToNdjson([result1, result2]);
-      const ruleStrings = ruleNdjson.split('\n');
-      const reParsed1 = JSON.parse(ruleStrings[0]);
-      const reParsed2 = JSON.parse(ruleStrings[1]);
-      expect(reParsed1).toEqual(result1);
-      expect(reParsed2).toEqual(result2);
-    });
-  });
-});
diff --git a/x-pack/plugins/security_solution/server/utils/read_stream/create_stream_from_ndjson.ts b/x-pack/plugins/security_solution/server/utils/read_stream/create_stream_from_ndjson.ts
index 42f1b467ed4c2d..eb5abaee8cd3b8 100644
--- a/x-pack/plugins/security_solution/server/utils/read_stream/create_stream_from_ndjson.ts
+++ b/x-pack/plugins/security_solution/server/utils/read_stream/create_stream_from_ndjson.ts
@@ -48,12 +48,3 @@ export const createLimitStream = (limit: number): Transform => {
     },
   });
 };
-
-export const transformDataToNdjson = (data: unknown[]): string => {
-  if (data.length !== 0) {
-    const dataString = data.map((rule) => JSON.stringify(rule)).join('\n');
-    return `${dataString}\n`;
-  } else {
-    return '';
-  }
-};
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/export_exception_list.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/export_exception_list.ts
new file mode 100644
index 00000000000000..d35d34fde5bcc6
--- /dev/null
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/export_exception_list.ts
@@ -0,0 +1,155 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import type { CreateExceptionListItemSchema } from '@kbn/securitysolution-io-ts-list-types';
+import { EXCEPTION_LIST_URL, EXCEPTION_LIST_ITEM_URL } from '@kbn/securitysolution-list-constants';
+
+import { FtrProviderContext } from '../../common/ftr_provider_context';
+import {
+  removeExceptionListServerGeneratedProperties,
+  removeExceptionListItemServerGeneratedProperties,
+  binaryToString,
+  deleteAllExceptions,
+} from '../../utils';
+import { getCreateExceptionListMinimalSchemaMock } from '../../../../plugins/lists/common/schemas/request/create_exception_list_schema.mock';
+import { getCreateExceptionListItemMinimalSchemaMock } from '../../../../plugins/lists/common/schemas/request/create_exception_list_item_schema.mock';
+
+// eslint-disable-next-line import/no-default-export
+export default ({ getService }: FtrProviderContext): void => {
+  const supertest = getService('supertest');
+  const es = getService('es');
+
+  describe('export_exception_list_route', () => {
+    describe('exporting exception lists', () => {
+      afterEach(async () => {
+        await deleteAllExceptions(es);
+      });
+
+      it('should set the response content types to be expected', async () => {
+        // create an exception list
+        const { body } = await supertest
+          .post(EXCEPTION_LIST_URL)
+          .set('kbn-xsrf', 'true')
+          .send(getCreateExceptionListMinimalSchemaMock())
+          .expect(200);
+
+        // create an exception list item
+        await supertest
+          .post(EXCEPTION_LIST_ITEM_URL)
+          .set('kbn-xsrf', 'true')
+          .send(getCreateExceptionListItemMinimalSchemaMock())
+          .expect(200);
+
+        await supertest
+          .post(
+            `${EXCEPTION_LIST_URL}/_export?id=${body.id}&list_id=${body.list_id}&namespace_type=single`
+          )
+          .set('kbn-xsrf', 'true')
+          .expect('Content-Disposition', `attachment; filename="${body.list_id}"`)
+          .expect(200);
+      });
+
+      it('should return 404 if given ids that do not exist', async () => {
+        // create an exception list
+        await supertest
+          .post(EXCEPTION_LIST_URL)
+          .set('kbn-xsrf', 'true')
+          .send(getCreateExceptionListMinimalSchemaMock())
+          .expect(200);
+
+        // create an exception list item
+        await supertest
+          .post(EXCEPTION_LIST_ITEM_URL)
+          .set('kbn-xsrf', 'true')
+          .send(getCreateExceptionListItemMinimalSchemaMock())
+          .expect(200);
+
+        const { body: exportBody } = await supertest
+          .post(
+            `${EXCEPTION_LIST_URL}/_export?id=not_exist&list_id=not_exist&namespace_type=single`
+          )
+          .set('kbn-xsrf', 'true')
+          .expect(400);
+
+        expect(exportBody).to.eql({
+          message: 'exception list with list_id: not_exist does not exist',
+          status_code: 400,
+        });
+      });
+
+      it('should export a single list with a list id', async () => {
+        const { body } = await supertest
+          .post(EXCEPTION_LIST_URL)
+          .set('kbn-xsrf', 'true')
+          .send(getCreateExceptionListMinimalSchemaMock())
+          .expect(200);
+
+        const { body: itemBody } = await supertest
+          .post(EXCEPTION_LIST_ITEM_URL)
+          .set('kbn-xsrf', 'true')
+          .send(getCreateExceptionListItemMinimalSchemaMock())
+          .expect(200);
+
+        const { body: exportResult } = await supertest
+          .post(
+            `${EXCEPTION_LIST_URL}/_export?id=${body.id}&list_id=${body.list_id}&namespace_type=single`
+          )
+          .set('kbn-xsrf', 'true')
+          .expect(200)
+          .parse(binaryToString);
+
+        const exportedItemsToArray = exportResult.toString().split('\n');
+        const list = JSON.parse(exportedItemsToArray[0]);
+        const item = JSON.parse(exportedItemsToArray[1]);
+
+        expect(removeExceptionListServerGeneratedProperties(list)).to.eql(
+          removeExceptionListServerGeneratedProperties(body)
+        );
+        expect(removeExceptionListItemServerGeneratedProperties(item)).to.eql(
+          removeExceptionListItemServerGeneratedProperties(itemBody)
+        );
+      });
+
+      it('should export two list items with a list id', async () => {
+        const { body } = await supertest
+          .post(EXCEPTION_LIST_URL)
+          .set('kbn-xsrf', 'true')
+          .send(getCreateExceptionListMinimalSchemaMock())
+          .expect(200);
+
+        await supertest
+          .post(EXCEPTION_LIST_ITEM_URL)
+          .set('kbn-xsrf', 'true')
+          .send(getCreateExceptionListItemMinimalSchemaMock())
+          .expect(200);
+
+        const secondExceptionListItem: CreateExceptionListItemSchema = {
+          ...getCreateExceptionListItemMinimalSchemaMock(),
+          item_id: 'some-list-item-id-2',
+        };
+        await supertest
+          .post(EXCEPTION_LIST_ITEM_URL)
+          .set('kbn-xsrf', 'true')
+          .send(secondExceptionListItem)
+          .expect(200);
+
+        const { body: exportResult } = await supertest
+          .post(
+            `${EXCEPTION_LIST_URL}/_export?id=${body.id}&list_id=${body.list_id}&namespace_type=single`
+          )
+          .set('kbn-xsrf', 'true')
+          .expect(200)
+          .parse(binaryToString);
+
+        const bodyString = exportResult.toString();
+        expect(bodyString.includes('some-list-item-id-2')).to.be(true);
+        expect(bodyString.includes('some-list-item-id')).to.be(true);
+      });
+    });
+  });
+};
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/index.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/index.ts
index 89a1183da67903..afb6057dedfff7 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/index.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/index.ts
@@ -24,6 +24,7 @@ export default ({ loadTestFile }: FtrProviderContext): void => {
     loadTestFile(require.resolve('./find_list_items'));
     loadTestFile(require.resolve('./import_list_items'));
     loadTestFile(require.resolve('./export_list_items'));
+    loadTestFile(require.resolve('./export_exception_list'));
     loadTestFile(require.resolve('./create_exception_lists'));
     loadTestFile(require.resolve('./create_exception_list_items'));
     loadTestFile(require.resolve('./read_exception_lists'));

From 95e8595a1287ee9148846f1f9e4707b703c2d65d Mon Sep 17 00:00:00 2001
From: Justin Ibarra <brokensound77@users.noreply.github.com>
Date: Wed, 13 Oct 2021 21:49:07 -0800
Subject: [PATCH 40/71] [Detection Rules] Add 7.16 rules (#114939)

---
 ...ion_email_powershell_exchange_mailbox.json |  11 +-
 .../collection_winrar_encryption.json         |  11 +-
 ...ommand_and_control_common_webservices.json |  29 ++-
 ..._control_dns_directly_to_the_internet.json |   4 +-
 ...nd_and_control_dns_tunneling_nslookup.json |  11 +-
 ...download_rar_powershell_from_internet.json |   4 +-
 .../command_and_control_iexplore_via_com.json |  24 ++-
 ...ntrol_port_forwarding_added_registry.json} |  23 +--
 ...command_and_control_rdp_tunnel_plink.json} |  18 +-
 ..._and_control_remote_file_copy_scripts.json |   4 +-
 ...d_control_teamviewer_remote_file_copy.json |   7 +-
 .../credential_access_cmdline_dump_tool.json  |  16 +-
 ...ess_copy_ntds_sam_volshadowcp_cmdline.json |  11 +-
 ...cess_domain_backup_dpapi_private_keys.json |   7 +-
 ...credential_access_dump_registry_hives.json |  16 +-
 ..._access_kerberoasting_unusual_process.json |   4 +-
 .../credential_access_kerberosdump_kcc.json   |  14 +-
 ...ial_access_lsass_memdump_file_created.json |  11 +-
 ..._potential_lsa_memdump_via_mirrordump.json |  55 ++++++
 ...redential_access_saved_creds_vaultcmd.json |  14 +-
 ...e_evasion_clearing_windows_event_logs.json |  11 +-
 ...vasion_clearing_windows_security_logs.json |  14 +-
 ...ion_defender_exclusion_via_powershell.json |   4 +-
 ...ble_windows_firewall_rules_with_netsh.json |   8 +-
 ...efense_evasion_disabling_windows_logs.json |  11 +-
 ...vasion_dotnet_compiler_parent_process.json |  15 +-
 ...n_elasticache_security_group_creation.json |  61 ++++++
 ...he_security_group_modified_or_deleted.json |  61 ++++++
 ...evasion_enable_inbound_rdp_with_netsh.json |   8 +-
 ...n_enable_network_discovery_with_netsh.json |   8 +-
 ...ecution_control_panel_suspicious_args.json |  56 ++++++
 ...ecution_msbuild_started_by_office_app.json |  11 +-
 ...n_execution_msbuild_started_by_script.json |  11 +-
 ...ion_msbuild_started_by_system_process.json |  11 +-
 ...ion_execution_msbuild_started_renamed.json |  11 +-
 ...sion_execution_windefend_unusual_path.json |   7 +-
 ..._evasion_file_creation_mult_extension.json |  24 ++-
 ...on_frontdoor_firewall_policy_deletion.json |  60 ++++++
 ...sion_hide_encoded_executable_registry.json |   7 +-
 ...ense_evasion_iis_httplogging_disabled.json |  15 +-
 .../defense_evasion_installutil_beacon.json   |   4 +-
 ...e_evasion_masquerading_renamed_autoit.json |  11 +-
 ...vasion_masquerading_trusted_directory.json |  11 +-
 ...defense_evasion_masquerading_werfault.json |   4 +-
 ...on_msbuild_making_network_connections.json |  11 +-
 ...cess_termination_followed_by_deletion.json |  11 +-
 .../defense_evasion_unusual_dir_ads.json      |  11 +-
 .../defense_evasion_via_filter_manager.json   |  15 +-
 ...on_whitespace_padding_in_command_line.json |   4 +-
 .../discovery_adfind_command_activity.json    |   9 +-
 .../discovery_admin_recon.json                |  11 +-
 .../discovery_net_command_system_account.json |   8 +-
 .../discovery_security_software_wmic.json     |  11 +-
 ...y_virtual_machine_fingerprinting_grep.json |  52 ++++++
 .../execution_enumeration_via_wmiprvse.json   |  27 ++-
 ...le_program_connecting_to_the_internet.json |  17 +-
 ...tion_scheduled_task_powershell_source.json |  11 +-
 .../execution_via_compiled_html_file.json     |  17 +-
 .../exfiltration_rds_snapshot_export.json     |   5 +-
 .../impact_backup_file_deletion.json          |  52 ++++++
 ...eleting_backup_catalogs_with_wbadmin.json} |  23 +--
 ...oft_365_potential_ransomware_activity.json |  54 ++++++
 ...t_365_unusual_volume_of_file_deletion.json |  54 ++++++
 ...> impact_modification_of_boot_config.json} |  23 +--
 ...mpact_stop_process_service_threshold.json} |  25 +--
 ...opy_deletion_or_resized_via_vssadmin.json} |   8 +-
 ...e_shadow_copy_deletion_via_powershell.json |  52 ++++++
 ...volume_shadow_copy_deletion_via_wmic.json} |  23 +--
 .../rules/prepackaged_rules/index.ts          | 174 +++++++++++-------
 ...65_user_restricted_from_sending_email.json |  54 ++++++
 ...ta_user_attempted_unauthorized_access.json |  74 ++++++++
 ...ss_suspicious_ms_office_child_process.json |   4 +-
 ...ential_access_kerberos_bifrostconsole.json |  11 +-
 .../lateral_movement_dcom_hta.json            |  35 +++-
 .../lateral_movement_dcom_mmc20.json          |  13 +-
 ...t_dcom_shellwindow_shellbrowserwindow.json |  13 +-
 ...vement_direct_outbound_smb_connection.json |  15 +-
 .../lateral_movement_dns_server_overflow.json |   4 +-
 ...movement_executable_tool_transfer_smb.json |   4 +-
 ...vement_incoming_winrm_shell_execution.json |   4 +-
 .../lateral_movement_incoming_wmi.json        |   4 +-
 ...l_movement_powershell_remoting_target.json |   4 +-
 ...lateral_movement_rdp_enabled_registry.json |  11 +-
 .../lateral_movement_rdp_sharprdp_target.json |  13 +-
 .../lateral_movement_remote_services.json     |   4 +-
 ...ateral_movement_scheduled_task_target.json |  15 +-
 .../ml_auth_rare_user_logon.json              |   4 +-
 ...pike_in_logon_events_from_a_source_ip.json |   4 +-
 .../ml_cloudtrail_error_message_spike.json    |   4 +-
 .../ml_cloudtrail_rare_error_code.json        |   4 +-
 .../ml_cloudtrail_rare_method_by_city.json    |   4 +-
 .../ml_cloudtrail_rare_method_by_country.json |   4 +-
 .../ml_cloudtrail_rare_method_by_user.json    |   4 +-
 .../ml_rare_process_by_host_windows.json      |   4 +-
 ..._group_configuration_change_detection.json |  19 +-
 ...evasion_hidden_local_account_creation.json |  11 +-
 ...egistry_startup_shell_folder_modified.json |   4 +-
 ...e_suspicious_mailbox_right_delegation.json |  57 ++++++
 ...sistence_gpo_schtask_service_creation.json |  11 +-
 ...sistence_local_scheduled_job_creation.json |  11 +-
 ...stence_local_scheduled_task_scripting.json |  11 +-
 ...l_exch_mailbox_activesync_add_device.json} |  28 +--
 .../persistence_rds_instance_creation.json    |   5 +-
 .../persistence_registry_uncommon.json        |  17 +-
 ...tence_route_table_modified_or_deleted.json |  55 ++++++
 ...saver_engine_unexpected_child_process.json |  50 +++++
 ...e_screensaver_plist_file_modification.json |  50 +++++
 ...nce_suspicious_scheduled_task_runtime.json |  11 +-
 ..._account_added_to_privileged_group_ad.json |  15 +-
 .../persistence_user_account_creation.json    |  11 +-
 ...emetrycontroller_scheduledtask_hijack.json |  11 +-
 ...nt_instrumentation_event_subscription.json |  11 +-
 .../persistence_webshell_detection.json       |   4 +-
 ...ion_new_or_modified_federation_domain.json |  61 ++++++
 ..._escalation_sts_getsessiontoken_abuse.json |  74 ++++++++
 ...tion_unusual_parentchild_relationship.json |   4 +-
 .../threat_intel_module_match.json            |   6 +-
 117 files changed, 1920 insertions(+), 377 deletions(-)
 rename x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/{defense_evasion_port_forwarding_added_registry.json => command_and_control_port_forwarding_added_registry.json} (66%)
 rename x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/{lateral_movement_rdp_tunnel_plink.json => command_and_control_rdp_tunnel_plink.json} (69%)
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_potential_lsa_memdump_via_mirrordump.json
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_elasticache_security_group_creation.json
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_elasticache_security_group_modified_or_deleted.json
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_control_panel_suspicious_args.json
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_frontdoor_firewall_policy_deletion.json
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_virtual_machine_fingerprinting_grep.json
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_backup_file_deletion.json
 rename x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/{defense_evasion_deleting_backup_catalogs_with_wbadmin.json => impact_deleting_backup_catalogs_with_wbadmin.json} (66%)
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_microsoft_365_potential_ransomware_activity.json
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_microsoft_365_unusual_volume_of_file_deletion.json
 rename x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/{defense_evasion_modification_of_boot_config.json => impact_modification_of_boot_config.json} (69%)
 rename x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/{defense_evasion_stop_process_service_threshold.json => impact_stop_process_service_threshold.json} (64%)
 rename x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/{impact_volume_shadow_copy_deletion_via_vssadmin.json => impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.json} (70%)
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_via_powershell.json
 rename x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/{defense_evasion_volume_shadow_copy_deletion_via_wmic.json => impact_volume_shadow_copy_deletion_via_wmic.json} (66%)
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_microsoft_365_user_restricted_from_sending_email.json
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_okta_user_attempted_unauthorized_access.json
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_exchange_suspicious_mailbox_right_delegation.json
 rename x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/{collection_persistence_powershell_exch_mailbox_activesync_add_device.json => persistence_powershell_exch_mailbox_activesync_add_device.json} (72%)
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_route_table_modified_or_deleted.json
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_screensaver_engine_unexpected_child_process.json
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_screensaver_plist_file_modification.json
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_new_or_modified_federation_domain.json
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_sts_getsessiontoken_abuse.json

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_email_powershell_exchange_mailbox.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_email_powershell_exchange_mailbox.json
index 25ad15f1b0a51f..6e2073bbb82b62 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_email_powershell_exchange_mailbox.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_email_powershell_exchange_mailbox.json
@@ -42,7 +42,14 @@
         {
           "id": "T1114",
           "name": "Email Collection",
-          "reference": "https://attack.mitre.org/techniques/T1114/"
+          "reference": "https://attack.mitre.org/techniques/T1114/",
+          "subtechnique": [
+            {
+              "id": "T1114.002",
+              "name": "Remote Email Collection",
+              "reference": "https://attack.mitre.org/techniques/T1114/002/"
+            }
+          ]
         },
         {
           "id": "T1005",
@@ -54,5 +61,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 4
+  "version": 5
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_winrar_encryption.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_winrar_encryption.json
index 73c4300556a02a..fa0ee2b18bb15d 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_winrar_encryption.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_winrar_encryption.json
@@ -38,12 +38,19 @@
         {
           "id": "T1560",
           "name": "Archive Collected Data",
-          "reference": "https://attack.mitre.org/techniques/T1560/"
+          "reference": "https://attack.mitre.org/techniques/T1560/",
+          "subtechnique": [
+            {
+              "id": "T1560.001",
+              "name": "Archive via Utility",
+              "reference": "https://attack.mitre.org/techniques/T1560/001/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 3
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_common_webservices.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_common_webservices.json
index 0d80e78c556b92..b1774ab3dd052e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_common_webservices.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_common_webservices.json
@@ -38,9 +38,36 @@
           "reference": "https://attack.mitre.org/techniques/T1102/"
         }
       ]
+    },
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0010",
+        "name": "Exfiltration",
+        "reference": "https://attack.mitre.org/tactics/TA0010/"
+      },
+      "technique": [
+        {
+          "id": "T1567",
+          "name": "Exfiltration Over Web Service",
+          "reference": "https://attack.mitre.org/techniques/T1567/",
+          "subtechnique": [
+            {
+              "id": "T1567.001",
+              "name": "Exfiltration to Code Repository",
+              "reference": "https://attack.mitre.org/techniques/T1567/001/"
+            },
+            {
+              "id": "T1567.002",
+              "name": "Exfiltration to Cloud Storage",
+              "reference": "https://attack.mitre.org/techniques/T1567/002/"
+            }
+          ]
+        }
+      ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 4
+  "version": 5
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_dns_directly_to_the_internet.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_dns_directly_to_the_internet.json
index 8567b18670301e..f57bd65b6d992f 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_dns_directly_to_the_internet.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_dns_directly_to_the_internet.json
@@ -2,7 +2,7 @@
   "author": [
     "Elastic"
   ],
-  "description": "This rule detects when an internal network client sends DNS traffic directly to the Internet. This is atypical behavior for a managed network and can be indicative of malware, exfiltration, command and control, or simply misconfiguration. This DNS activity also impacts your organization's ability to provide enterprise monitoring and logging of DNS and it opens your network to a variety of abuses and malicious communications.",
+  "description": "This rule detects when an internal network client sends DNS traffic directly to the Internet. This is atypical behavior for a managed network and can be indicative of malware, exfiltration, command and control, or simply misconfiguration. This DNS activity also impacts your organization's ability to provide enterprise monitoring and logging of DNS, and it opens your network to a variety of abuses and malicious communications.",
   "false_positives": [
     "Exclude DNS servers from this rule as this is expected behavior. Endpoints usually query local DNS servers defined in their DHCP scopes, but this may be overridden if a user configures their endpoint to use a remote DNS server. This is uncommon in managed enterprise networks because it could break intranet name resolution when split horizon DNS is utilized. Some consumer VPN services and browser plug-ins may send DNS traffic to remote Internet destinations. In that case, such devices or networks can be excluded from this rule when this is expected behavior."
   ],
@@ -45,5 +45,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 11
+  "version": 12
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_dns_tunneling_nslookup.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_dns_tunneling_nslookup.json
index 0920f336bab441..29c30f6bc0b49e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_dns_tunneling_nslookup.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_dns_tunneling_nslookup.json
@@ -38,7 +38,14 @@
         {
           "id": "T1071",
           "name": "Application Layer Protocol",
-          "reference": "https://attack.mitre.org/techniques/T1071/"
+          "reference": "https://attack.mitre.org/techniques/T1071/",
+          "subtechnique": [
+            {
+              "id": "T1071.004",
+              "name": "DNS",
+              "reference": "https://attack.mitre.org/techniques/T1071/004/"
+            }
+          ]
         }
       ]
     }
@@ -50,5 +57,5 @@
     "value": 15
   },
   "type": "threshold",
-  "version": 2
+  "version": 3
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_download_rar_powershell_from_internet.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_download_rar_powershell_from_internet.json
index 0bcbb0d2d031dd..dcca38dd242d80 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_download_rar_powershell_from_internet.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_download_rar_powershell_from_internet.json
@@ -2,7 +2,7 @@
   "author": [
     "Elastic"
   ],
-  "description": "Detects a Roshal Archive (RAR) file or PowerShell script downloaded from the internet by an internal host. Gaining initial access to a system and then downloading encoded or encrypted tools to move laterally is a common practice for adversaries as a way to protect their more valuable tools and TTPs (tactics, techniques, and procedures). This may be atypical behavior for a managed network and can be indicative of malware, exfiltration, or command and control.",
+  "description": "Detects a Roshal Archive (RAR) file or PowerShell script downloaded from the internet by an internal host. Gaining initial access to a system and then downloading encoded or encrypted tools to move laterally is a common practice for adversaries as a way to protect their more valuable tools and tactics, techniques, and procedures (TTPs). This may be atypical behavior for a managed network and can be indicative of malware, exfiltration, or command and control.",
   "false_positives": [
     "Downloading RAR or PowerShell files from the Internet may be expected for certain systems. This rule should be tailored to either exclude systems as sources or destinations in which this behavior is expected."
   ],
@@ -52,5 +52,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 7
+  "version": 8
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_iexplore_via_com.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_iexplore_via_com.json
index 2cfbbc1c5e1015..d0039ab4f02d40 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_iexplore_via_com.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_iexplore_via_com.json
@@ -41,8 +41,30 @@
           "reference": "https://attack.mitre.org/techniques/T1071/"
         }
       ]
+    },
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0002",
+        "name": "Execution",
+        "reference": "https://attack.mitre.org/tactics/TA0002/"
+      },
+      "technique": [
+        {
+          "id": "T1559",
+          "name": "Inter-Process Communication",
+          "reference": "https://attack.mitre.org/techniques/T1559/",
+          "subtechnique": [
+            {
+              "id": "T1559.001",
+              "name": "Component Object Model",
+              "reference": "https://attack.mitre.org/techniques/T1559/001/"
+            }
+          ]
+        }
+      ]
     }
   ],
   "type": "eql",
-  "version": 3
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_port_forwarding_added_registry.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_port_forwarding_added_registry.json
similarity index 66%
rename from x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_port_forwarding_added_registry.json
rename to x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_port_forwarding_added_registry.json
index cb5c8e87dcae81..65612e6c28f20f 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_port_forwarding_added_registry.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_port_forwarding_added_registry.json
@@ -24,33 +24,26 @@
     "Host",
     "Windows",
     "Threat Detection",
-    "Defense Evasion"
+    "Command and Control"
   ],
   "threat": [
     {
       "framework": "MITRE ATT&CK",
       "tactic": {
-        "id": "TA0005",
-        "name": "Defense Evasion",
-        "reference": "https://attack.mitre.org/tactics/TA0005/"
+        "id": "TA0011",
+        "name": "Command and Control",
+        "reference": "https://attack.mitre.org/tactics/TA0011/"
       },
       "technique": [
         {
-          "id": "T1562",
-          "name": "Impair Defenses",
-          "reference": "https://attack.mitre.org/techniques/T1562/",
-          "subtechnique": [
-            {
-              "id": "T1562.001",
-              "name": "Disable or Modify Tools",
-              "reference": "https://attack.mitre.org/techniques/T1562/001/"
-            }
-          ]
+          "id": "T1572",
+          "name": "Protocol Tunneling",
+          "reference": "https://attack.mitre.org/techniques/T1572/"
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 3
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_rdp_tunnel_plink.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_rdp_tunnel_plink.json
similarity index 69%
rename from x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_rdp_tunnel_plink.json
rename to x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_rdp_tunnel_plink.json
index dd6bdfa0c37d68..3c89ff7c9ff9ad 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_rdp_tunnel_plink.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_rdp_tunnel_plink.json
@@ -2,7 +2,7 @@
   "author": [
     "Elastic"
   ],
-  "description": "Identifies potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This could be indicative of adversary lateral movement to interactively access restricted networks.",
+  "description": "Identifies potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.",
   "from": "now-9m",
   "index": [
     "logs-endpoint.events.*",
@@ -24,26 +24,26 @@
     "Host",
     "Windows",
     "Threat Detection",
-    "Lateral Movement"
+    "Command and Control"
   ],
   "threat": [
     {
       "framework": "MITRE ATT&CK",
       "tactic": {
-        "id": "TA0008",
-        "name": "Lateral Movement",
-        "reference": "https://attack.mitre.org/tactics/TA0008/"
+        "id": "TA0011",
+        "name": "Command and Control",
+        "reference": "https://attack.mitre.org/tactics/TA0011/"
       },
       "technique": [
         {
-          "id": "T1021",
-          "name": "Remote Services",
-          "reference": "https://attack.mitre.org/techniques/T1021/"
+          "id": "T1572",
+          "name": "Protocol Tunneling",
+          "reference": "https://attack.mitre.org/techniques/T1572/"
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 3
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_remote_file_copy_scripts.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_remote_file_copy_scripts.json
index 428b08891c15aa..eed29634daeefb 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_remote_file_copy_scripts.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_remote_file_copy_scripts.json
@@ -12,7 +12,7 @@
   "language": "eql",
   "license": "Elastic License v2",
   "name": "Remote File Download via Script Interpreter",
-  "query": "sequence by host.id, process.entity_id\n  [network where process.name : (\"wscript.exe\", \"cscript.exe\") and network.protocol != \"dns\" and\n   network.direction == \"outgoing\" and network.type == \"ipv4\" and destination.ip != \"127.0.0.1\"\n  ]\n  [file where event.type == \"creation\" and file.extension : (\"exe\", \"dll\")]\n",
+  "query": "sequence by host.id, process.entity_id\n  [network where process.name : (\"wscript.exe\", \"cscript.exe\") and network.protocol != \"dns\" and\n   network.direction : (\"outgoing\", \"egress\") and network.type == \"ipv4\" and destination.ip != \"127.0.0.1\"\n  ]\n  [file where event.type == \"creation\" and file.extension : (\"exe\", \"dll\")]\n",
   "risk_score": 47,
   "rule_id": "1d276579-3380-4095-ad38-e596a01bc64f",
   "severity": "medium",
@@ -41,5 +41,5 @@
     }
   ],
   "type": "eql",
-  "version": 2
+  "version": 3
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_teamviewer_remote_file_copy.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_teamviewer_remote_file_copy.json
index 08d4df2556f6a7..a1f0f061a69bcf 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_teamviewer_remote_file_copy.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_teamviewer_remote_file_copy.json
@@ -39,11 +39,16 @@
           "id": "T1105",
           "name": "Ingress Tool Transfer",
           "reference": "https://attack.mitre.org/techniques/T1105/"
+        },
+        {
+          "id": "T1219",
+          "name": "Remote Access Software",
+          "reference": "https://attack.mitre.org/techniques/T1219/"
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 4
+  "version": 5
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_cmdline_dump_tool.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_cmdline_dump_tool.json
index 32c271f736e4a3..9671f3c4edf2a9 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_cmdline_dump_tool.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_cmdline_dump_tool.json
@@ -38,12 +38,24 @@
         {
           "id": "T1003",
           "name": "OS Credential Dumping",
-          "reference": "https://attack.mitre.org/techniques/T1003/"
+          "reference": "https://attack.mitre.org/techniques/T1003/",
+          "subtechnique": [
+            {
+              "id": "T1003.001",
+              "name": "LSASS Memory",
+              "reference": "https://attack.mitre.org/techniques/T1003/001/"
+            },
+            {
+              "id": "T1003.003",
+              "name": "NTDS",
+              "reference": "https://attack.mitre.org/techniques/T1003/003/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 4
+  "version": 5
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_copy_ntds_sam_volshadowcp_cmdline.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_copy_ntds_sam_volshadowcp_cmdline.json
index 91613078c61679..0aeba882241389 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_copy_ntds_sam_volshadowcp_cmdline.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_copy_ntds_sam_volshadowcp_cmdline.json
@@ -41,12 +41,19 @@
         {
           "id": "T1003",
           "name": "OS Credential Dumping",
-          "reference": "https://attack.mitre.org/techniques/T1003/"
+          "reference": "https://attack.mitre.org/techniques/T1003/",
+          "subtechnique": [
+            {
+              "id": "T1003.002",
+              "name": "Security Account Manager",
+              "reference": "https://attack.mitre.org/techniques/T1003/002/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 4
+  "version": 5
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_domain_backup_dpapi_private_keys.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_domain_backup_dpapi_private_keys.json
index c031fcbf464b1a..43ea1078d15836 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_domain_backup_dpapi_private_keys.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_domain_backup_dpapi_private_keys.json
@@ -48,11 +48,16 @@
               "reference": "https://attack.mitre.org/techniques/T1552/004/"
             }
           ]
+        },
+        {
+          "id": "T1555",
+          "name": "Credentials from Password Stores",
+          "reference": "https://attack.mitre.org/techniques/T1555/"
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 5
+  "version": 6
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_dump_registry_hives.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_dump_registry_hives.json
index c3868162cc8395..10c6996fa56aaa 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_dump_registry_hives.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_dump_registry_hives.json
@@ -38,12 +38,24 @@
         {
           "id": "T1003",
           "name": "OS Credential Dumping",
-          "reference": "https://attack.mitre.org/techniques/T1003/"
+          "reference": "https://attack.mitre.org/techniques/T1003/",
+          "subtechnique": [
+            {
+              "id": "T1003.002",
+              "name": "Security Account Manager",
+              "reference": "https://attack.mitre.org/techniques/T1003/002/"
+            },
+            {
+              "id": "T1003.004",
+              "name": "LSA Secrets",
+              "reference": "https://attack.mitre.org/techniques/T1003/004/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 3
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_kerberoasting_unusual_process.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_kerberoasting_unusual_process.json
index b05ddd7bcc8a23..8fc7cd7b379b89 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_kerberoasting_unusual_process.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_kerberoasting_unusual_process.json
@@ -15,7 +15,7 @@
   "language": "eql",
   "license": "Elastic License v2",
   "name": "Kerberos Traffic from Unusual Process",
-  "query": "network where event.type == \"start\" and network.direction == \"outgoing\" and\n destination.port == 88 and source.port >= 49152 and\n process.executable != \"C:\\\\Windows\\\\System32\\\\lsass.exe\" and destination.address !=\"127.0.0.1\" and destination.address !=\"::1\" and\n /* insert False Positives here */\n not process.name in (\"swi_fc.exe\", \"fsIPcam.exe\", \"IPCamera.exe\", \"MicrosoftEdgeCP.exe\", \"MicrosoftEdge.exe\", \"iexplore.exe\", \"chrome.exe\", \"msedge.exe\", \"opera.exe\", \"firefox.exe\")\n",
+  "query": "network where event.type == \"start\" and network.direction : (\"outgoing\", \"egress\") and\n destination.port == 88 and source.port >= 49152 and\n process.executable != \"C:\\\\Windows\\\\System32\\\\lsass.exe\" and destination.address !=\"127.0.0.1\" and destination.address !=\"::1\" and\n /* insert False Positives here */\n not process.name in (\"swi_fc.exe\", \"fsIPcam.exe\", \"IPCamera.exe\", \"MicrosoftEdgeCP.exe\", \"MicrosoftEdge.exe\", \"iexplore.exe\", \"chrome.exe\", \"msedge.exe\", \"opera.exe\", \"firefox.exe\")\n",
   "risk_score": 47,
   "rule_id": "897dc6b5-b39f-432a-8d75-d3730d50c782",
   "severity": "medium",
@@ -45,5 +45,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 3
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_kerberosdump_kcc.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_kerberosdump_kcc.json
index de5a9d80ed3dfd..3338895f30feb7 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_kerberosdump_kcc.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_kerberosdump_kcc.json
@@ -39,11 +39,23 @@
           "id": "T1003",
           "name": "OS Credential Dumping",
           "reference": "https://attack.mitre.org/techniques/T1003/"
+        },
+        {
+          "id": "T1558",
+          "name": "Steal or Forge Kerberos Tickets",
+          "reference": "https://attack.mitre.org/techniques/T1558/",
+          "subtechnique": [
+            {
+              "id": "T1558.003",
+              "name": "Kerberoasting",
+              "reference": "https://attack.mitre.org/techniques/T1558/003/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 3
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_lsass_memdump_file_created.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_lsass_memdump_file_created.json
index 36b614c628b192..d083fb322e8956 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_lsass_memdump_file_created.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_lsass_memdump_file_created.json
@@ -39,12 +39,19 @@
         {
           "id": "T1003",
           "name": "OS Credential Dumping",
-          "reference": "https://attack.mitre.org/techniques/T1003/"
+          "reference": "https://attack.mitre.org/techniques/T1003/",
+          "subtechnique": [
+            {
+              "id": "T1003.001",
+              "name": "LSASS Memory",
+              "reference": "https://attack.mitre.org/techniques/T1003/001/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 4
+  "version": 5
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_potential_lsa_memdump_via_mirrordump.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_potential_lsa_memdump_via_mirrordump.json
new file mode 100644
index 00000000000000..1024d7f3461f54
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_potential_lsa_memdump_via_mirrordump.json
@@ -0,0 +1,55 @@
+{
+  "author": [
+    "Elastic"
+  ],
+  "description": "Identifies suspicious access to an LSASS handle via DuplicateHandle from an unknown call trace module. This may indicate an attempt to bypass the NtOpenProcess API to evade detection and dump Lsass memory for credential access.",
+  "from": "now-9m",
+  "index": [
+    "winlogbeat-*",
+    "logs-windows.*"
+  ],
+  "language": "eql",
+  "license": "Elastic License v2",
+  "name": "Potential Credential Access via DuplicateHandle in LSASS",
+  "query": "process where event.code == \"10\" and \n\n /* LSASS requesting DuplicateHandle access right to another process */\n process.name : \"lsass.exe\" and winlog.event_data.GrantedAccess == \"0x40\" and\n\n /* call is coming from an unknown executable region */\n winlog.event_data.CallTrace : \"*UNKNOWN*\"\n",
+  "references": [
+    "https://github.com/CCob/MirrorDump"
+  ],
+  "risk_score": 47,
+  "rule_id": "02a4576a-7480-4284-9327-548a806b5e48",
+  "severity": "medium",
+  "tags": [
+    "Elastic",
+    "Host",
+    "Windows",
+    "Threat Detection",
+    "Credential Access"
+  ],
+  "threat": [
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0006",
+        "name": "Credential Access",
+        "reference": "https://attack.mitre.org/tactics/TA0006/"
+      },
+      "technique": [
+        {
+          "id": "T1003",
+          "name": "OS Credential Dumping",
+          "reference": "https://attack.mitre.org/techniques/T1003/",
+          "subtechnique": [
+            {
+              "id": "T1003.001",
+              "name": "LSASS Memory",
+              "reference": "https://attack.mitre.org/techniques/T1003/001/"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "timestamp_override": "event.ingested",
+  "type": "eql",
+  "version": 1
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_saved_creds_vaultcmd.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_saved_creds_vaultcmd.json
index bfb4e44d39b0d4..c6db4426ac8c19 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_saved_creds_vaultcmd.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_saved_creds_vaultcmd.json
@@ -40,11 +40,23 @@
           "id": "T1003",
           "name": "OS Credential Dumping",
           "reference": "https://attack.mitre.org/techniques/T1003/"
+        },
+        {
+          "id": "T1555",
+          "name": "Credentials from Password Stores",
+          "reference": "https://attack.mitre.org/techniques/T1555/",
+          "subtechnique": [
+            {
+              "id": "T1555.004",
+              "name": "Windows Credential Manager",
+              "reference": "https://attack.mitre.org/techniques/T1555/004/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 1
+  "version": 2
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_clearing_windows_event_logs.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_clearing_windows_event_logs.json
index 79e059d68a52a5..2759055b0fe5b7 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_clearing_windows_event_logs.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_clearing_windows_event_logs.json
@@ -35,12 +35,19 @@
         {
           "id": "T1070",
           "name": "Indicator Removal on Host",
-          "reference": "https://attack.mitre.org/techniques/T1070/"
+          "reference": "https://attack.mitre.org/techniques/T1070/",
+          "subtechnique": [
+            {
+              "id": "T1070.001",
+              "name": "Clear Windows Event Logs",
+              "reference": "https://attack.mitre.org/techniques/T1070/001/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 9
+  "version": 10
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_clearing_windows_security_logs.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_clearing_windows_security_logs.json
index d04c2b2a389155..eedca883e371c9 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_clearing_windows_security_logs.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_clearing_windows_security_logs.json
@@ -7,7 +7,8 @@
   "from": "now-9m",
   "index": [
     "winlogbeat-*",
-    "logs-windows.*"
+    "logs-windows.*",
+    "logs-system.*"
   ],
   "language": "kuery",
   "license": "Elastic License v2",
@@ -35,12 +36,19 @@
         {
           "id": "T1070",
           "name": "Indicator Removal on Host",
-          "reference": "https://attack.mitre.org/techniques/T1070/"
+          "reference": "https://attack.mitre.org/techniques/T1070/",
+          "subtechnique": [
+            {
+              "id": "T1070.001",
+              "name": "Clear Windows Event Logs",
+              "reference": "https://attack.mitre.org/techniques/T1070/001/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 1
+  "version": 2
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_defender_exclusion_via_powershell.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_defender_exclusion_via_powershell.json
index 000384eac660e0..716040d337c10d 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_defender_exclusion_via_powershell.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_defender_exclusion_via_powershell.json
@@ -12,7 +12,7 @@
   "language": "eql",
   "license": "Elastic License v2",
   "name": "Windows Defender Exclusions Added via PowerShell",
-  "note": "## Triage and analysis\n\nDetections should be investigated to identify if the activity corresponds to legitimate activity used to put in exceptions for Windows Defender. As this rule detects post-exploitation process activity, investigations into this should be prioritized.",
+  "note": "## Triage and analysis\n\n### Investigating Windows Defender Exclusions\n\nMicrosoft Windows Defender is an anti-virus product built-in within Microsoft Windows. Since this software product is\nused to prevent and stop malware, it's important to monitor what specific exclusions are made to the product's configuration\nsettings. These can often be signs of an adversary or malware trying to bypass Windows Defender's capabilities. One of the more\nnotable [examples](https://www.cyberbit.com/blog/endpoint-security/latest-trickbot-variant-has-new-tricks-up-its-sleeve/) was observed in 2018 where Trickbot incorporated mechanisms to disable Windows Defense to avoid detection.\n\n#### Possible investigation steps:\n- With this specific rule, it's completely possible to trigger detections on network administrative activity or benign users\nusing scripting and PowerShell to configure the different exclusions for Windows Defender. Therefore, it's important to\nidentify the source of the activity first and determine if there is any mal-intent behind the events.\n- The actual exclusion such as the process, the file or directory should be reviewed in order to determine the original\nintent behind the exclusion. Is the excluded file or process malicious in nature or is it related to software that needs\nto be legitimately whitelisted from Windows Defender?\n\n### False Positive Analysis\n- This rule has a higher chance to produce false positives based on the nature around configuring exclusions by possibly\na network administrator. In order to validate the activity further, review the specific exclusion made and determine based\non the exclusion of the original intent behind the exclusion. There are often many legitimate reasons why exclusions are made\nwith Windows Defender so it's important to gain context around the exclusion.\n\n### Related Rules\n- Windows Defender Disabled via Registry Modification\n- Disabling Windows Defender Security Settings via PowerShell\n\n### Response and Remediation\n- Since this is related to post-exploitation activity, immediate response should be taken to review, investigate and\npotentially isolate further activity\n- If further analysis showed malicious intent was behind the Defender exclusions, administrators should remove\nthe exclusion and ensure antimalware capability has not been disabled or deleted\n- Exclusion lists for antimalware capabilities should always be routinely monitored for review\n",
   "query": "process where event.type == \"start\" and\n (process.name : (\"powershell.exe\", \"pwsh.exe\") or process.pe.original_file_name : (\"powershell.exe\", \"pwsh.exe\")) and\n  process.args : (\"*Add-MpPreference*-Exclusion*\", \"*Set-MpPreference*-Exclusion*\")\n",
   "references": [
     "https://www.bitdefender.com/files/News/CaseStudies/study/400/Bitdefender-PR-Whitepaper-MosaicLoader-creat5540-en-EN.pdf"
@@ -80,5 +80,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 2
+  "version": 3
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disable_windows_firewall_rules_with_netsh.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disable_windows_firewall_rules_with_netsh.json
index 00f18df34f8640..2e18f3ba627860 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disable_windows_firewall_rules_with_netsh.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disable_windows_firewall_rules_with_netsh.json
@@ -38,9 +38,9 @@
           "reference": "https://attack.mitre.org/techniques/T1562/",
           "subtechnique": [
             {
-              "id": "T1562.001",
-              "name": "Disable or Modify Tools",
-              "reference": "https://attack.mitre.org/techniques/T1562/001/"
+              "id": "T1562.004",
+              "name": "Disable or Modify System Firewall",
+              "reference": "https://attack.mitre.org/techniques/T1562/004/"
             }
           ]
         }
@@ -49,5 +49,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 9
+  "version": 10
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disabling_windows_logs.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disabling_windows_logs.json
index d2612101a3e4cd..256d1c7d9c1351 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disabling_windows_logs.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disabling_windows_logs.json
@@ -40,12 +40,19 @@
         {
           "id": "T1070",
           "name": "Indicator Removal on Host",
-          "reference": "https://attack.mitre.org/techniques/T1070/"
+          "reference": "https://attack.mitre.org/techniques/T1070/",
+          "subtechnique": [
+            {
+              "id": "T1070.001",
+              "name": "Clear Windows Event Logs",
+              "reference": "https://attack.mitre.org/techniques/T1070/001/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 1
+  "version": 2
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_dotnet_compiler_parent_process.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_dotnet_compiler_parent_process.json
index 4588a8ab28657e..e8edb8fba6472c 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_dotnet_compiler_parent_process.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_dotnet_compiler_parent_process.json
@@ -33,14 +33,21 @@
       },
       "technique": [
         {
-          "id": "T1055",
-          "name": "Process Injection",
-          "reference": "https://attack.mitre.org/techniques/T1055/"
+          "id": "T1027",
+          "name": "Obfuscated Files or Information",
+          "reference": "https://attack.mitre.org/techniques/T1027/",
+          "subtechnique": [
+            {
+              "id": "T1027.004",
+              "name": "Compile After Delivery",
+              "reference": "https://attack.mitre.org/techniques/T1027/004/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 4
+  "version": 5
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_elasticache_security_group_creation.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_elasticache_security_group_creation.json
new file mode 100644
index 00000000000000..5685ac76b3ef9e
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_elasticache_security_group_creation.json
@@ -0,0 +1,61 @@
+{
+  "author": [
+    "Austin Songer"
+  ],
+  "description": "Identifies when an ElastiCache security group has been created.",
+  "false_positives": [
+    "A ElastiCache security group may be created by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Security group creations from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule."
+  ],
+  "from": "now-60m",
+  "index": [
+    "filebeat-*",
+    "logs-aws*"
+  ],
+  "interval": "10m",
+  "language": "kuery",
+  "license": "Elastic License v2",
+  "name": "AWS ElastiCache Security Group Created",
+  "note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
+  "query": "event.dataset:aws.cloudtrail and event.provider:elasticache.amazonaws.com and event.action:\"Create Cache Security Group\" and \nevent.outcome:success\n",
+  "references": [
+    "https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateCacheSecurityGroup.html"
+  ],
+  "risk_score": 21,
+  "rule_id": "7b3da11a-60a2-412e-8aa7-011e1eb9ed47",
+  "severity": "low",
+  "tags": [
+    "Elastic",
+    "Cloud",
+    "AWS",
+    "Continuous Monitoring",
+    "SecOps",
+    "Monitoring"
+  ],
+  "threat": [
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0005",
+        "name": "Defense Evasion",
+        "reference": "https://attack.mitre.org/tactics/TA0005/"
+      },
+      "technique": [
+        {
+          "id": "T1562",
+          "name": "Impair Defenses",
+          "reference": "https://attack.mitre.org/techniques/T1562/",
+          "subtechnique": [
+            {
+              "id": "T1562.007",
+              "name": "Disable or Modify Cloud Firewall",
+              "reference": "https://attack.mitre.org/techniques/T1562/007/"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "timestamp_override": "event.ingested",
+  "type": "query",
+  "version": 1
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_elasticache_security_group_modified_or_deleted.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_elasticache_security_group_modified_or_deleted.json
new file mode 100644
index 00000000000000..83b58c0c046e09
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_elasticache_security_group_modified_or_deleted.json
@@ -0,0 +1,61 @@
+{
+  "author": [
+    "Austin Songer"
+  ],
+  "description": "Identifies when an ElastiCache security group has been modified or deleted.",
+  "false_positives": [
+    "A ElastiCache security group deletion may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Security Group deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule."
+  ],
+  "from": "now-60m",
+  "index": [
+    "filebeat-*",
+    "logs-aws*"
+  ],
+  "interval": "10m",
+  "language": "kuery",
+  "license": "Elastic License v2",
+  "name": "AWS ElastiCache Security Group Modified or Deleted",
+  "note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
+  "query": "event.dataset:aws.cloudtrail and event.provider:elasticache.amazonaws.com and event.action:(\"Delete Cache Security Group\" or \n\"Authorize Cache Security Group Ingress\" or  \"Revoke Cache Security Group Ingress\" or \"AuthorizeCacheSecurityGroupEgress\" or \n\"RevokeCacheSecurityGroupEgress\") and event.outcome:success\n",
+  "references": [
+    "https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/Welcome.html"
+  ],
+  "risk_score": 21,
+  "rule_id": "1ba5160d-f5a2-4624-b0ff-6a1dc55d2516",
+  "severity": "low",
+  "tags": [
+    "Elastic",
+    "Cloud",
+    "AWS",
+    "Continuous Monitoring",
+    "SecOps",
+    "Monitoring"
+  ],
+  "threat": [
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0005",
+        "name": "Defense Evasion",
+        "reference": "https://attack.mitre.org/tactics/TA0005/"
+      },
+      "technique": [
+        {
+          "id": "T1562",
+          "name": "Impair Defenses",
+          "reference": "https://attack.mitre.org/techniques/T1562/",
+          "subtechnique": [
+            {
+              "id": "T1562.007",
+              "name": "Disable or Modify Cloud Firewall",
+              "reference": "https://attack.mitre.org/techniques/T1562/007/"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "timestamp_override": "event.ingested",
+  "type": "query",
+  "version": 1
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_enable_inbound_rdp_with_netsh.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_enable_inbound_rdp_with_netsh.json
index 93454122d11603..e6b53af71433a0 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_enable_inbound_rdp_with_netsh.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_enable_inbound_rdp_with_netsh.json
@@ -38,9 +38,9 @@
           "reference": "https://attack.mitre.org/techniques/T1562/",
           "subtechnique": [
             {
-              "id": "T1562.001",
-              "name": "Disable or Modify Tools",
-              "reference": "https://attack.mitre.org/techniques/T1562/001/"
+              "id": "T1562.004",
+              "name": "Disable or Modify System Firewall",
+              "reference": "https://attack.mitre.org/techniques/T1562/004/"
             }
           ]
         }
@@ -49,5 +49,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 3
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_enable_network_discovery_with_netsh.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_enable_network_discovery_with_netsh.json
index 5fcbec498a177a..bf688fd74ce148 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_enable_network_discovery_with_netsh.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_enable_network_discovery_with_netsh.json
@@ -41,9 +41,9 @@
           "reference": "https://attack.mitre.org/techniques/T1562/",
           "subtechnique": [
             {
-              "id": "T1562.001",
-              "name": "Disable or Modify Tools",
-              "reference": "https://attack.mitre.org/techniques/T1562/001/"
+              "id": "T1562.004",
+              "name": "Disable or Modify System Firewall",
+              "reference": "https://attack.mitre.org/techniques/T1562/004/"
             }
           ]
         }
@@ -52,5 +52,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 1
+  "version": 2
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_control_panel_suspicious_args.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_control_panel_suspicious_args.json
new file mode 100644
index 00000000000000..787e61cfe25c42
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_control_panel_suspicious_args.json
@@ -0,0 +1,56 @@
+{
+  "author": [
+    "Elastic"
+  ],
+  "description": "Identifies unusual instances of Control Panel with suspicious keywords or paths in the process command line value. Adversaries may abuse Control.exe to proxy execution of malicious code.",
+  "from": "now-9m",
+  "index": [
+    "logs-endpoint.events.*",
+    "winlogbeat-*",
+    "logs-windows.*"
+  ],
+  "language": "eql",
+  "license": "Elastic License v2",
+  "name": "Control Panel Process with Unusual Arguments",
+  "query": "process where event.type in (\"start\", \"process_started\") and\n process.executable : (\"?:\\\\Windows\\\\SysWOW64\\\\control.exe\", \"?:\\\\Windows\\\\System32\\\\control.exe\") and\n process.command_line :\n          (\"*.jpg*\",\n           \"*.png*\",\n           \"*.gif*\",\n           \"*.bmp*\",\n           \"*.jpeg*\",\n           \"*.TIFF*\",\n           \"*.inf*\",\n           \"*.dat*\",\n           \"*.cpl:*/*\",\n           \"*../../..*\",\n           \"*/AppData/Local/*\",\n           \"*:\\\\Users\\\\Public\\\\*\",\n           \"*\\\\AppData\\\\Local\\\\*\")\n",
+  "references": [
+    "https://www.joesandbox.com/analysis/476188/1/html"
+  ],
+  "risk_score": 73,
+  "rule_id": "416697ae-e468-4093-a93d-59661fa619ec",
+  "severity": "high",
+  "tags": [
+    "Elastic",
+    "Host",
+    "Windows",
+    "Threat Detection",
+    "Defense Evasion"
+  ],
+  "threat": [
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0005",
+        "name": "Defense Evasion",
+        "reference": "https://attack.mitre.org/tactics/TA0005/"
+      },
+      "technique": [
+        {
+          "id": "T1218",
+          "name": "Signed Binary Proxy Execution",
+          "reference": "https://attack.mitre.org/techniques/T1218/",
+          "subtechnique": [
+            {
+              "id": "T1218.002",
+              "name": "Control Panel",
+              "reference": "https://attack.mitre.org/techniques/T1218/002/"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "timestamp_override": "event.ingested",
+  "type": "eql",
+  "version": 1
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_office_app.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_office_app.json
index d56c90552d4570..0ad45f03a04994 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_office_app.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_office_app.json
@@ -41,7 +41,14 @@
         {
           "id": "T1127",
           "name": "Trusted Developer Utilities Proxy Execution",
-          "reference": "https://attack.mitre.org/techniques/T1127/"
+          "reference": "https://attack.mitre.org/techniques/T1127/",
+          "subtechnique": [
+            {
+              "id": "T1127.001",
+              "name": "MSBuild",
+              "reference": "https://attack.mitre.org/techniques/T1127/001/"
+            }
+          ]
         }
       ]
     },
@@ -57,5 +64,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 8
+  "version": 9
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_script.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_script.json
index 3b640d8757b51c..60b2a8f50c3f4d 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_script.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_script.json
@@ -38,7 +38,14 @@
         {
           "id": "T1127",
           "name": "Trusted Developer Utilities Proxy Execution",
-          "reference": "https://attack.mitre.org/techniques/T1127/"
+          "reference": "https://attack.mitre.org/techniques/T1127/",
+          "subtechnique": [
+            {
+              "id": "T1127.001",
+              "name": "MSBuild",
+              "reference": "https://attack.mitre.org/techniques/T1127/001/"
+            }
+          ]
         }
       ]
     },
@@ -54,5 +61,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 8
+  "version": 9
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_system_process.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_system_process.json
index 33094a88af313e..fdee8ee5482181 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_system_process.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_system_process.json
@@ -38,7 +38,14 @@
         {
           "id": "T1127",
           "name": "Trusted Developer Utilities Proxy Execution",
-          "reference": "https://attack.mitre.org/techniques/T1127/"
+          "reference": "https://attack.mitre.org/techniques/T1127/",
+          "subtechnique": [
+            {
+              "id": "T1127.001",
+              "name": "MSBuild",
+              "reference": "https://attack.mitre.org/techniques/T1127/001/"
+            }
+          ]
         }
       ]
     },
@@ -54,5 +61,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 8
+  "version": 9
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_renamed.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_renamed.json
index 43051cb8b27c93..a22594083bedb1 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_renamed.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_renamed.json
@@ -38,12 +38,19 @@
         {
           "id": "T1036",
           "name": "Masquerading",
-          "reference": "https://attack.mitre.org/techniques/T1036/"
+          "reference": "https://attack.mitre.org/techniques/T1036/",
+          "subtechnique": [
+            {
+              "id": "T1036.003",
+              "name": "Rename System Utilities",
+              "reference": "https://attack.mitre.org/techniques/T1036/003/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 8
+  "version": 9
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_windefend_unusual_path.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_windefend_unusual_path.json
index 7812dee8235ca6..826d55f3b18827 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_windefend_unusual_path.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_windefend_unusual_path.json
@@ -1,6 +1,7 @@
 {
   "author": [
-    "Elastic"
+    "Elastic",
+    "Dennis Perto"
   ],
   "description": "Identifies a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of one of those processes.",
   "false_positives": [
@@ -15,7 +16,7 @@
   "language": "eql",
   "license": "Elastic License v2",
   "name": "Potential DLL Side-Loading via Microsoft Antimalware Service Executable",
-  "query": "process where event.type == \"start\" and\n  (process.pe.original_file_name == \"MsMpEng.exe\" and not process.name : \"MsMpEng.exe\") or\n  (process.name : \"MsMpEng.exe\" and not\n        process.executable : (\"?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\*.exe\",\n                              \"?:\\\\Program Files\\\\Windows Defender\\\\*.exe\",\n                              \"?:\\\\Program Files (x86)\\\\Windows Defender\\\\*.exe\"))\n",
+  "query": "process where event.type == \"start\" and\n  (process.pe.original_file_name == \"MsMpEng.exe\" and not process.name : \"MsMpEng.exe\") or\n  (process.name : \"MsMpEng.exe\" and not\n        process.executable : (\"?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\*.exe\",\n                              \"?:\\\\Program Files\\\\Windows Defender\\\\*.exe\",\n                              \"?:\\\\Program Files (x86)\\\\Windows Defender\\\\*.exe\",\n                              \"?:\\\\Program Files\\\\Microsoft Security Client\\\\*.exe\",\n                              \"?:\\\\Program Files (x86)\\\\Microsoft Security Client\\\\*.exe\"))\n",
   "references": [
     "https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/"
   ],
@@ -55,5 +56,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 1
+  "version": 2
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_file_creation_mult_extension.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_file_creation_mult_extension.json
index 24cbb1e41dad62..4cbfb8bbbce6cb 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_file_creation_mult_extension.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_file_creation_mult_extension.json
@@ -45,9 +45,31 @@
           ]
         }
       ]
+    },
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0002",
+        "name": "Execution",
+        "reference": "https://attack.mitre.org/tactics/TA0002/"
+      },
+      "technique": [
+        {
+          "id": "T1204",
+          "name": "User Execution",
+          "reference": "https://attack.mitre.org/techniques/T1204/",
+          "subtechnique": [
+            {
+              "id": "T1204.002",
+              "name": "Malicious File",
+              "reference": "https://attack.mitre.org/techniques/T1204/002/"
+            }
+          ]
+        }
+      ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 2
+  "version": 3
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_frontdoor_firewall_policy_deletion.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_frontdoor_firewall_policy_deletion.json
new file mode 100644
index 00000000000000..c443d45dde4f02
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_frontdoor_firewall_policy_deletion.json
@@ -0,0 +1,60 @@
+{
+  "author": [
+    "Austin Songer"
+  ],
+  "description": "Identifies the deletion of a Frontdoor Web Application Firewall (WAF) Policy in Azure. An adversary may delete a Frontdoor Web Application Firewall (WAF) Policy in an attempt to evade defenses and/or to eliminate barriers in carrying out their initiative.",
+  "false_positives": [
+    "Azure Front Web Application Firewall (WAF) Policy deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Azure Front Web Application Firewall (WAF) Policy deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule."
+  ],
+  "from": "now-25m",
+  "index": [
+    "filebeat-*",
+    "logs-azure*"
+  ],
+  "language": "kuery",
+  "license": "Elastic License v2",
+  "name": "Azure Frontdoor Web Application Firewall (WAF) Policy Deleted",
+  "note": "## Config\n\nThe Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
+  "query": "event.dataset:azure.activitylogs and azure.activitylogs.operation_name:\"MICROSOFT.NETWORK/FRONTDOORWEBAPPLICATIONFIREWALLPOLICIES/DELETE\" and event.outcome:(Success or success)\n",
+  "references": [
+    "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#networking"
+  ],
+  "risk_score": 21,
+  "rule_id": "09d028a5-dcde-409f-8ae0-557cef1b7082",
+  "severity": "low",
+  "tags": [
+    "Elastic",
+    "Cloud",
+    "Azure",
+    "Continuous Monitoring",
+    "SecOps",
+    "Network Security"
+  ],
+  "threat": [
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0005",
+        "name": "Defense Evasion",
+        "reference": "https://attack.mitre.org/tactics/TA0005/"
+      },
+      "technique": [
+        {
+          "id": "T1562",
+          "name": "Impair Defenses",
+          "reference": "https://attack.mitre.org/techniques/T1562/",
+          "subtechnique": [
+            {
+              "id": "T1562.001",
+              "name": "Disable or Modify Tools",
+              "reference": "https://attack.mitre.org/techniques/T1562/001/"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "timestamp_override": "event.ingested",
+  "type": "query",
+  "version": 1
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_hide_encoded_executable_registry.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_hide_encoded_executable_registry.json
index 006f95054d0472..c40bbf236d668d 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_hide_encoded_executable_registry.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_hide_encoded_executable_registry.json
@@ -36,11 +36,16 @@
           "id": "T1140",
           "name": "Deobfuscate/Decode Files or Information",
           "reference": "https://attack.mitre.org/techniques/T1140/"
+        },
+        {
+          "id": "T1112",
+          "name": "Modify Registry",
+          "reference": "https://attack.mitre.org/techniques/T1112/"
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 3
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_iis_httplogging_disabled.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_iis_httplogging_disabled.json
index 16de1c9c21f970..da12646d40226e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_iis_httplogging_disabled.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_iis_httplogging_disabled.json
@@ -34,14 +34,21 @@
       },
       "technique": [
         {
-          "id": "T1070",
-          "name": "Indicator Removal on Host",
-          "reference": "https://attack.mitre.org/techniques/T1070/"
+          "id": "T1562",
+          "name": "Impair Defenses",
+          "reference": "https://attack.mitre.org/techniques/T1562/",
+          "subtechnique": [
+            {
+              "id": "T1562.002",
+              "name": "Disable Windows Event Logging",
+              "reference": "https://attack.mitre.org/techniques/T1562/002/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 5
+  "version": 6
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_installutil_beacon.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_installutil_beacon.json
index 4917cffd64ccb6..72ef939fd2c1c2 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_installutil_beacon.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_installutil_beacon.json
@@ -12,7 +12,7 @@
   "language": "eql",
   "license": "Elastic License v2",
   "name": "InstallUtil Process Making Network Connections",
-  "query": "/* the benefit of doing this as an eql sequence vs kql is this will limit to alerting only on the first network connection */\n\nsequence by process.entity_id\n  [process where event.type in (\"start\", \"process_started\") and process.name : \"installutil.exe\"]\n  [network where process.name : \"installutil.exe\" and network.direction == \"outgoing\"]\n",
+  "query": "/* the benefit of doing this as an eql sequence vs kql is this will limit to alerting only on the first network connection */\n\nsequence by process.entity_id\n  [process where event.type in (\"start\", \"process_started\") and process.name : \"installutil.exe\"]\n  [network where process.name : \"installutil.exe\" and network.direction : (\"outgoing\", \"egress\")]\n",
   "risk_score": 21,
   "rule_id": "a13167f1-eec2-4015-9631-1fee60406dcf",
   "severity": "medium",
@@ -48,5 +48,5 @@
     }
   ],
   "type": "eql",
-  "version": 3
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_renamed_autoit.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_renamed_autoit.json
index bd0a3ac9f918db..5c855207dda7db 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_renamed_autoit.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_renamed_autoit.json
@@ -35,12 +35,19 @@
         {
           "id": "T1036",
           "name": "Masquerading",
-          "reference": "https://attack.mitre.org/techniques/T1036/"
+          "reference": "https://attack.mitre.org/techniques/T1036/",
+          "subtechnique": [
+            {
+              "id": "T1036.003",
+              "name": "Rename System Utilities",
+              "reference": "https://attack.mitre.org/techniques/T1036/003/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 4
+  "version": 5
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_trusted_directory.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_trusted_directory.json
index b0d11121c1a150..7ac21a70100c09 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_trusted_directory.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_trusted_directory.json
@@ -35,12 +35,19 @@
         {
           "id": "T1036",
           "name": "Masquerading",
-          "reference": "https://attack.mitre.org/techniques/T1036/"
+          "reference": "https://attack.mitre.org/techniques/T1036/",
+          "subtechnique": [
+            {
+              "id": "T1036.005",
+              "name": "Match Legitimate Name or Location",
+              "reference": "https://attack.mitre.org/techniques/T1036/005/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 4
+  "version": 5
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_werfault.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_werfault.json
index 2733bf992838e9..a08e3040c6c95d 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_werfault.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_werfault.json
@@ -15,7 +15,7 @@
   "language": "eql",
   "license": "Elastic License v2",
   "name": "Potential Windows Error Manager Masquerading",
-  "query": "sequence by host.id, process.entity_id with maxspan = 5s\n  [process where event.type:\"start\" and process.name : (\"wermgr.exe\", \"WerFault.exe\") and process.args_count == 1]\n  [network where process.name : (\"wermgr.exe\", \"WerFault.exe\") and network.protocol != \"dns\" and\n    network.direction == \"outgoing\" and destination.ip !=\"::1\" and destination.ip !=\"127.0.0.1\"\n  ]\n",
+  "query": "sequence by host.id, process.entity_id with maxspan = 5s\n  [process where event.type:\"start\" and process.name : (\"wermgr.exe\", \"WerFault.exe\") and process.args_count == 1]\n  [network where process.name : (\"wermgr.exe\", \"WerFault.exe\") and network.protocol != \"dns\" and\n    network.direction : (\"outgoing\", \"egress\") and destination.ip !=\"::1\" and destination.ip !=\"127.0.0.1\"\n  ]\n",
   "references": [
     "https://twitter.com/SBousseaden/status/1235533224337641473",
     "https://www.hexacorn.com/blog/2019/09/20/werfault-command-line-switches-v0-1/",
@@ -49,5 +49,5 @@
     }
   ],
   "type": "eql",
-  "version": 3
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_msbuild_making_network_connections.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_msbuild_making_network_connections.json
index a2019165f93c68..6d0110c229c33a 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_msbuild_making_network_connections.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_msbuild_making_network_connections.json
@@ -35,11 +35,18 @@
         {
           "id": "T1127",
           "name": "Trusted Developer Utilities Proxy Execution",
-          "reference": "https://attack.mitre.org/techniques/T1127/"
+          "reference": "https://attack.mitre.org/techniques/T1127/",
+          "subtechnique": [
+            {
+              "id": "T1127.001",
+              "name": "MSBuild",
+              "reference": "https://attack.mitre.org/techniques/T1127/001/"
+            }
+          ]
         }
       ]
     }
   ],
   "type": "eql",
-  "version": 7
+  "version": 8
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_process_termination_followed_by_deletion.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_process_termination_followed_by_deletion.json
index b7d65b23360010..85316f7836b894 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_process_termination_followed_by_deletion.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_process_termination_followed_by_deletion.json
@@ -33,11 +33,18 @@
         {
           "id": "T1070",
           "name": "Indicator Removal on Host",
-          "reference": "https://attack.mitre.org/techniques/T1070/"
+          "reference": "https://attack.mitre.org/techniques/T1070/",
+          "subtechnique": [
+            {
+              "id": "T1070.004",
+              "name": "File Deletion",
+              "reference": "https://attack.mitre.org/techniques/T1070/004/"
+            }
+          ]
         }
       ]
     }
   ],
   "type": "eql",
-  "version": 2
+  "version": 3
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_unusual_dir_ads.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_unusual_dir_ads.json
index 196a3de9b9e6f9..f926a1ba24faff 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_unusual_dir_ads.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_unusual_dir_ads.json
@@ -35,12 +35,19 @@
         {
           "id": "T1564",
           "name": "Hide Artifacts",
-          "reference": "https://attack.mitre.org/techniques/T1564/"
+          "reference": "https://attack.mitre.org/techniques/T1564/",
+          "subtechnique": [
+            {
+              "id": "T1564.004",
+              "name": "NTFS File Attributes",
+              "reference": "https://attack.mitre.org/techniques/T1564/004/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 4
+  "version": 5
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_via_filter_manager.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_via_filter_manager.json
index 51d1789804548c..c0d171739b76d8 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_via_filter_manager.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_via_filter_manager.json
@@ -33,14 +33,21 @@
       },
       "technique": [
         {
-          "id": "T1222",
-          "name": "File and Directory Permissions Modification",
-          "reference": "https://attack.mitre.org/techniques/T1222/"
+          "id": "T1562",
+          "name": "Impair Defenses",
+          "reference": "https://attack.mitre.org/techniques/T1562/",
+          "subtechnique": [
+            {
+              "id": "T1562.001",
+              "name": "Disable or Modify Tools",
+              "reference": "https://attack.mitre.org/techniques/T1562/001/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 7
+  "version": 8
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_whitespace_padding_in_command_line.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_whitespace_padding_in_command_line.json
index fc9b480023c958..f022f0c27ff5e9 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_whitespace_padding_in_command_line.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_whitespace_padding_in_command_line.json
@@ -12,7 +12,7 @@
   "language": "eql",
   "license": "Elastic License v2",
   "name": "Whitespace Padding in Process Command Line",
-  "note": "## Triage and analysis\n\n- Analyze the command line of the process in question for evidence of malicious code execution.\n- Review the ancestry and child processes spawned by the process in question for indicators of further malicious code execution.",
+  "note": "## Triage and analysis\n\n- Analyze the command line of the process in question for evidence of malicious code execution.\n- Review the ancestor and child processes spawned by the process in question for indicators of further malicious code execution.",
   "query": "process where event.type in (\"start\", \"process_started\") and\n  process.command_line regex \".*[ ]{20,}.*\" or \n  \n  /* this will match on 3 or more separate occurrences of 5+ contiguous whitespace characters */\n  process.command_line regex \".*(.*[ ]{5,}[^ ]*){3,}.*\"\n",
   "references": [
     "https://twitter.com/JohnLaTwC/status/1419251082736201737"
@@ -40,5 +40,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 1
+  "version": 2
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_adfind_command_activity.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_adfind_command_activity.json
index 97ba7da6c5f3b0..9af3832303666b 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_adfind_command_activity.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_adfind_command_activity.json
@@ -12,7 +12,7 @@
   "language": "eql",
   "license": "Elastic License v2",
   "name": "AdFind Command Activity",
-  "note": "## Triage and analysis\n\n`AdFind.exe` is a legitimate domain query tool. Rule alerts should be investigated to identify if the user has a role that would explain using this tool and that it is being run from an expected directory and endpoint. Leverage the exception workflow in the Kibana Security App or Elasticsearch API to tune this rule to your environment.",
+  "note": "## Triage and analysis\n\n### Investigating AdFind Command Activity\n\n[AdFind](http://www.joeware.net/freetools/tools/adfind/) is a freely available command-line tool used to retrieve information from\nActivity Directory (AD). Network discovery and enumeration tools like `AdFind` are useful to adversaries in the same ways\nthey are effective for network administrators. This tool provides quick ability to scope AD person/computer objects and\nunderstand subnets and domain information. There are many [examples](https://thedfirreport.com/category/adfind/)\nobserved where this tool has been adopted by ransomware and criminal groups and used in compromises.\n\n#### Possible investigation steps:\n- `AdFind` is a legitimate Active Directory enumeration tool used by network administrators, it's important to understand\nthe source of the activity.  This could involve identifying the account using `AdFind` and determining based on the command-lines\nwhat information was retrieved, then further determining if these actions are in scope of that user's traditional responsibilities.\n- In multiple public references, `AdFind` is leveraged after initial access is achieved, review previous activity on impacted\nmachine looking for suspicious indicators such as previous anti-virus/EDR alerts, phishing emails received, or network traffic\nto suspicious infrastructure\n\n### False Positive Analysis\n- This rule has the high chance to produce false positives as it is a legitimate tool used by network administrators. One\noption could be whitelisting specific users or groups who use the tool as part of their daily responsibilities. This can\nbe done by leveraging the exception workflow in the Kibana Security App or Elasticsearch API to tune this rule to your environment\n- Malicious behavior with `AdFind` should be investigated as part of a step within an attack chain. It doesn't happen in\nisolation, so reviewing previous logs/activity from impacted machines could be very telling.\n\n### Related Rules\n- Windows Network Enumeration\n- Enumeration of Administrator Accounts\n- Enumeration Command Spawned via WMIPrvSE\n\n### Response and Remediation\n- Immediate response should be taken to validate activity, investigate and potentially isolate activity to prevent further\npost-compromise behavior\n- It's important to understand that `AdFind` is an Active Directory enumeration tool and can be used for malicious or legitimate\npurposes, so understanding the intent behind the activity will help determine the appropropriate response.\n",
   "query": "process where event.type in (\"start\", \"process_started\") and \n  (process.name : \"AdFind.exe\" or process.pe.original_file_name == \"AdFind.exe\") and \n  process.args : (\"objectcategory=computer\", \"(objectcategory=computer)\", \n                  \"objectcategory=person\", \"(objectcategory=person)\",\n                  \"objectcategory=subnet\", \"(objectcategory=subnet)\",\n                  \"objectcategory=group\", \"(objectcategory=group)\", \n                  \"objectcategory=organizationalunit\", \"(objectcategory=organizationalunit)\",\n                  \"objectcategory=attributeschema\", \"(objectcategory=attributeschema)\",\n                  \"domainlist\", \"dcmodes\", \"adinfo\", \"dclist\", \"computers_pwnotreqd\", \"trustdmp\")\n",
   "references": [
     "http://www.joeware.net/freetools/tools/adfind/",
@@ -69,11 +69,16 @@
           "id": "T1482",
           "name": "Domain Trust Discovery",
           "reference": "https://attack.mitre.org/techniques/T1482/"
+        },
+        {
+          "id": "T1018",
+          "name": "Remote System Discovery",
+          "reference": "https://attack.mitre.org/techniques/T1018/"
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 4
+  "version": 5
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_admin_recon.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_admin_recon.json
index 1a3ceebe7218fc..d5026780fdf562 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_admin_recon.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_admin_recon.json
@@ -35,7 +35,14 @@
         {
           "id": "T1069",
           "name": "Permission Groups Discovery",
-          "reference": "https://attack.mitre.org/techniques/T1069/"
+          "reference": "https://attack.mitre.org/techniques/T1069/",
+          "subtechnique": [
+            {
+              "id": "T1069.002",
+              "name": "Domain Groups",
+              "reference": "https://attack.mitre.org/techniques/T1069/002/"
+            }
+          ]
         },
         {
           "id": "T1087",
@@ -47,5 +54,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 3
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_net_command_system_account.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_net_command_system_account.json
index 87b32d14791bb8..dc855f3ed9a579 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_net_command_system_account.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_net_command_system_account.json
@@ -33,14 +33,14 @@
       },
       "technique": [
         {
-          "id": "T1087",
-          "name": "Account Discovery",
-          "reference": "https://attack.mitre.org/techniques/T1087/"
+          "id": "T1033",
+          "name": "System Owner/User Discovery",
+          "reference": "https://attack.mitre.org/techniques/T1033/"
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 7
+  "version": 8
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_security_software_wmic.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_security_software_wmic.json
index d0f26c6e417569..92731ab40e78ab 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_security_software_wmic.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_security_software_wmic.json
@@ -35,12 +35,19 @@
         {
           "id": "T1518",
           "name": "Software Discovery",
-          "reference": "https://attack.mitre.org/techniques/T1518/"
+          "reference": "https://attack.mitre.org/techniques/T1518/",
+          "subtechnique": [
+            {
+              "id": "T1518.001",
+              "name": "Security Software Discovery",
+              "reference": "https://attack.mitre.org/techniques/T1518/001/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 3
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_virtual_machine_fingerprinting_grep.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_virtual_machine_fingerprinting_grep.json
new file mode 100644
index 00000000000000..e557e37db23d6c
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_virtual_machine_fingerprinting_grep.json
@@ -0,0 +1,52 @@
+{
+  "author": [
+    "Elastic"
+  ],
+  "description": "An adversary may attempt to get detailed information about the operating system and hardware. This rule identifies common locations used to discover virtual machine hardware by a non-root user. This technique has been used by the Pupy RAT and other malware.",
+  "false_positives": [
+    "Certain tools or automated software may enumerate hardware information. These tools can be exempted via user name or process arguments to eliminate potential noise."
+  ],
+  "from": "now-9m",
+  "index": [
+    "auditbeat-*",
+    "logs-endpoint.events.*"
+  ],
+  "language": "eql",
+  "license": "Elastic License v2",
+  "name": "Virtual Machine Fingerprinting via Grep",
+  "query": "process where event.type == \"start\" and\n process.name in (\"grep\", \"egrep\") and user.id != \"0\" and\n process.args : (\"parallels*\", \"vmware*\", \"virtualbox*\") and process.args : \"Manufacturer*\" and \n not process.parent.executable in (\"/Applications/Docker.app/Contents/MacOS/Docker\", \"/usr/libexec/kcare/virt-what\")\n",
+  "references": [
+    "https://objective-see.com/blog/blog_0x4F.html"
+  ],
+  "risk_score": 47,
+  "rule_id": "c85eb82c-d2c8-485c-a36f-534f914b7663",
+  "severity": "medium",
+  "tags": [
+    "Elastic",
+    "Host",
+    "macOS",
+    "Linux",
+    "Threat Detection",
+    "Discovery"
+  ],
+  "threat": [
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0007",
+        "name": "Discovery",
+        "reference": "https://attack.mitre.org/tactics/TA0007/"
+      },
+      "technique": [
+        {
+          "id": "T1082",
+          "name": "System Information Discovery",
+          "reference": "https://attack.mitre.org/techniques/T1082/"
+        }
+      ]
+    }
+  ],
+  "timestamp_override": "event.ingested",
+  "type": "eql",
+  "version": 1
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_enumeration_via_wmiprvse.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_enumeration_via_wmiprvse.json
index 6a967d9644c47a..441e01b4a1b12d 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_enumeration_via_wmiprvse.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_enumeration_via_wmiprvse.json
@@ -38,9 +38,34 @@
           "reference": "https://attack.mitre.org/techniques/T1047/"
         }
       ]
+    },
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0007",
+        "name": "Discovery",
+        "reference": "https://attack.mitre.org/tactics/TA0007/"
+      },
+      "technique": [
+        {
+          "id": "T1518",
+          "name": "Software Discovery",
+          "reference": "https://attack.mitre.org/techniques/T1518/"
+        },
+        {
+          "id": "T1087",
+          "name": "Account Discovery",
+          "reference": "https://attack.mitre.org/techniques/T1087/"
+        },
+        {
+          "id": "T1018",
+          "name": "Remote System Discovery",
+          "reference": "https://attack.mitre.org/techniques/T1018/"
+        }
+      ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 1
+  "version": 2
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_html_help_executable_program_connecting_to_the_internet.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_html_help_executable_program_connecting_to_the_internet.json
index abc41d9f6d5c38..094b87f33ada76 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_html_help_executable_program_connecting_to_the_internet.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_html_help_executable_program_connecting_to_the_internet.json
@@ -34,7 +34,20 @@
         "name": "Execution",
         "reference": "https://attack.mitre.org/tactics/TA0002/"
       },
-      "technique": []
+      "technique": [
+        {
+          "id": "T1204",
+          "name": "User Execution",
+          "reference": "https://attack.mitre.org/techniques/T1204/",
+          "subtechnique": [
+            {
+              "id": "T1204.002",
+              "name": "Malicious File",
+              "reference": "https://attack.mitre.org/techniques/T1204/002/"
+            }
+          ]
+        }
+      ]
     },
     {
       "framework": "MITRE ATT&CK",
@@ -60,5 +73,5 @@
     }
   ],
   "type": "eql",
-  "version": 8
+  "version": 9
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_scheduled_task_powershell_source.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_scheduled_task_powershell_source.json
index 24492343e98c01..3814b003214178 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_scheduled_task_powershell_source.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_scheduled_task_powershell_source.json
@@ -41,11 +41,18 @@
         {
           "id": "T1053",
           "name": "Scheduled Task/Job",
-          "reference": "https://attack.mitre.org/techniques/T1053/"
+          "reference": "https://attack.mitre.org/techniques/T1053/",
+          "subtechnique": [
+            {
+              "id": "T1053.005",
+              "name": "Scheduled Task",
+              "reference": "https://attack.mitre.org/techniques/T1053/005/"
+            }
+          ]
         }
       ]
     }
   ],
   "type": "eql",
-  "version": 2
+  "version": 3
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_via_compiled_html_file.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_via_compiled_html_file.json
index efc3884b417fb2..73c796c4e206d7 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_via_compiled_html_file.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_via_compiled_html_file.json
@@ -34,7 +34,20 @@
         "name": "Execution",
         "reference": "https://attack.mitre.org/tactics/TA0002/"
       },
-      "technique": []
+      "technique": [
+        {
+          "id": "T1204",
+          "name": "User Execution",
+          "reference": "https://attack.mitre.org/techniques/T1204/",
+          "subtechnique": [
+            {
+              "id": "T1204.002",
+              "name": "Malicious File",
+              "reference": "https://attack.mitre.org/techniques/T1204/002/"
+            }
+          ]
+        }
+      ]
     },
     {
       "framework": "MITRE ATT&CK",
@@ -61,5 +74,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 8
+  "version": 9
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/exfiltration_rds_snapshot_export.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/exfiltration_rds_snapshot_export.json
index 430d97690b6f4d..b59adc45b4236d 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/exfiltration_rds_snapshot_export.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/exfiltration_rds_snapshot_export.json
@@ -1,6 +1,7 @@
 {
   "author": [
-    "Elastic"
+    "Elastic",
+    "Austin Songer"
   ],
   "description": "Identifies the export of an Amazon Relational Database Service (RDS) Aurora database snapshot.",
   "false_positives": [
@@ -44,5 +45,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 1
+  "version": 2
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_backup_file_deletion.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_backup_file_deletion.json
new file mode 100644
index 00000000000000..93c4c287d12cef
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_backup_file_deletion.json
@@ -0,0 +1,52 @@
+{
+  "author": [
+    "Elastic"
+  ],
+  "description": "Identifies the deletion of backup files, saved using third-party software, by a process outside of the backup suite. Adversaries may delete Backup files to ensure that recovery from a Ransomware attack is less likely.",
+  "false_positives": [
+    "Certain utilities that delete files for disk cleanup or Administrators manually removing backup files."
+  ],
+  "from": "now-9m",
+  "index": [
+    "winlogbeat-*",
+    "logs-endpoint.events.*",
+    "logs-windows.*"
+  ],
+  "language": "eql",
+  "license": "Elastic License v2",
+  "name": "Third-party Backup Files Deleted via Unexpected Process",
+  "query": "file where event.type == \"deletion\" and\n  (\n  /* Veeam Related Backup Files */\n  (file.extension : (\"VBK\", \"VIB\", \"VBM\") and\n  not process.executable : (\"?:\\\\Windows\\\\Veeam\\\\Backup\\\\*\",\n                            \"?:\\\\Program Files\\\\Veeam\\\\Backup and Replication\\\\*\",\n                            \"?:\\\\Program Files (x86)\\\\Veeam\\\\Backup and Replication\\\\*\")) or\n\n  /* Veritas Backup Exec Related Backup File */\n  (file.extension : \"BKF\" and\n  not process.executable : (\"?:\\\\Program Files\\\\Veritas\\\\Backup Exec\\\\*\",\n                            \"?:\\\\Program Files (x86)\\\\Veritas\\\\Backup Exec\\\\*\"))\n  )\n",
+  "references": [
+    "https://www.advintel.io/post/backup-removal-solutions-from-conti-ransomware-with-love"
+  ],
+  "risk_score": 47,
+  "rule_id": "11ea6bec-ebde-4d71-a8e9-784948f8e3e9",
+  "severity": "medium",
+  "tags": [
+    "Elastic",
+    "Host",
+    "Windows",
+    "Threat Detection",
+    "Impact"
+  ],
+  "threat": [
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0040",
+        "name": "Impact",
+        "reference": "https://attack.mitre.org/tactics/TA0040/"
+      },
+      "technique": [
+        {
+          "id": "T1490",
+          "name": "Inhibit System Recovery",
+          "reference": "https://attack.mitre.org/techniques/T1490/"
+        }
+      ]
+    }
+  ],
+  "timestamp_override": "event.ingested",
+  "type": "eql",
+  "version": 1
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_deleting_backup_catalogs_with_wbadmin.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_deleting_backup_catalogs_with_wbadmin.json
similarity index 66%
rename from x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_deleting_backup_catalogs_with_wbadmin.json
rename to x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_deleting_backup_catalogs_with_wbadmin.json
index 5d1233ebfcb78e..0c0c2a71b82634 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_deleting_backup_catalogs_with_wbadmin.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_deleting_backup_catalogs_with_wbadmin.json
@@ -21,33 +21,26 @@
     "Host",
     "Windows",
     "Threat Detection",
-    "Defense Evasion"
+    "Impact"
   ],
   "threat": [
     {
       "framework": "MITRE ATT&CK",
       "tactic": {
-        "id": "TA0005",
-        "name": "Defense Evasion",
-        "reference": "https://attack.mitre.org/tactics/TA0005/"
+        "id": "TA0040",
+        "name": "Impact",
+        "reference": "https://attack.mitre.org/tactics/TA0040/"
       },
       "technique": [
         {
-          "id": "T1070",
-          "name": "Indicator Removal on Host",
-          "reference": "https://attack.mitre.org/techniques/T1070/",
-          "subtechnique": [
-            {
-              "id": "T1070.004",
-              "name": "File Deletion",
-              "reference": "https://attack.mitre.org/techniques/T1070/004/"
-            }
-          ]
+          "id": "T1490",
+          "name": "Inhibit System Recovery",
+          "reference": "https://attack.mitre.org/techniques/T1490/"
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 9
+  "version": 10
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_microsoft_365_potential_ransomware_activity.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_microsoft_365_potential_ransomware_activity.json
new file mode 100644
index 00000000000000..52094400232b62
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_microsoft_365_potential_ransomware_activity.json
@@ -0,0 +1,54 @@
+{
+  "author": [
+    "Austin Songer"
+  ],
+  "description": "Identifies when Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.",
+  "false_positives": [
+    "If Cloud App Security identifies, for example, a high rate of file uploads or file deletion activities it may represent an adverse encryption process."
+  ],
+  "from": "now-30m",
+  "index": [
+    "filebeat-*",
+    "logs-o365*"
+  ],
+  "language": "kuery",
+  "license": "Elastic License v2",
+  "name": "Microsoft 365 Potential ransomware activity",
+  "note": "## Config\n\nThe Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.\n",
+  "query": "event.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.category:web and event.action:\"Potential ransomware activity\" and event.outcome:success\n",
+  "references": [
+    "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy",
+    "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference"
+  ],
+  "risk_score": 47,
+  "rule_id": "721999d0-7ab2-44bf-b328-6e63367b9b29",
+  "severity": "medium",
+  "tags": [
+    "Elastic",
+    "Cloud",
+    "Microsoft 365",
+    "Continuous Monitoring",
+    "SecOps",
+    "Configuration Audit"
+  ],
+  "threat": [
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0040",
+        "name": "Impact",
+        "reference": "https://attack.mitre.org/tactics/TA0040/"
+      },
+      "technique": [
+        {
+          "id": "T1486",
+          "name": "Data Encrypted for Impact",
+          "reference": "https://attack.mitre.org/techniques/T1486/"
+        }
+      ]
+    }
+  ],
+  "timestamp_override": "event.ingested",
+  "type": "query",
+  "version": 1
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_microsoft_365_unusual_volume_of_file_deletion.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_microsoft_365_unusual_volume_of_file_deletion.json
new file mode 100644
index 00000000000000..c3a53310781df7
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_microsoft_365_unusual_volume_of_file_deletion.json
@@ -0,0 +1,54 @@
+{
+  "author": [
+    "Austin Songer"
+  ],
+  "description": "Identifies that a user has deleted an unusually large volume of files  as reported by Microsoft Cloud App Security.",
+  "false_positives": [
+    "Users or System Administrator cleaning out folders."
+  ],
+  "from": "now-30m",
+  "index": [
+    "filebeat-*",
+    "logs-o365*"
+  ],
+  "language": "kuery",
+  "license": "Elastic License v2",
+  "name": "Microsoft 365 Unusual Volume of File Deletion",
+  "note": "## Config\n\nThe Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.\n",
+  "query": "event.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.category:web and event.action:\"Unusual volume of file deletion\" and event.outcome:success\n",
+  "references": [
+    "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy",
+    "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference"
+  ],
+  "risk_score": 47,
+  "rule_id": "b2951150-658f-4a60-832f-a00d1e6c6745",
+  "severity": "medium",
+  "tags": [
+    "Elastic",
+    "Cloud",
+    "Microsoft 365",
+    "Continuous Monitoring",
+    "SecOps",
+    "Configuration Audit"
+  ],
+  "threat": [
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0040",
+        "name": "Impact",
+        "reference": "https://attack.mitre.org/tactics/TA0040/"
+      },
+      "technique": [
+        {
+          "id": "T1485",
+          "name": "Data Destruction",
+          "reference": "https://attack.mitre.org/techniques/T1485/"
+        }
+      ]
+    }
+  ],
+  "timestamp_override": "event.ingested",
+  "type": "query",
+  "version": 1
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_modification_of_boot_config.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_modification_of_boot_config.json
similarity index 69%
rename from x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_modification_of_boot_config.json
rename to x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_modification_of_boot_config.json
index 7c58d82ec10618..91f5959bee1193 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_modification_of_boot_config.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_modification_of_boot_config.json
@@ -21,33 +21,26 @@
     "Host",
     "Windows",
     "Threat Detection",
-    "Defense Evasion"
+    "Impact"
   ],
   "threat": [
     {
       "framework": "MITRE ATT&CK",
       "tactic": {
-        "id": "TA0005",
-        "name": "Defense Evasion",
-        "reference": "https://attack.mitre.org/tactics/TA0005/"
+        "id": "TA0040",
+        "name": "Impact",
+        "reference": "https://attack.mitre.org/tactics/TA0040/"
       },
       "technique": [
         {
-          "id": "T1070",
-          "name": "Indicator Removal on Host",
-          "reference": "https://attack.mitre.org/techniques/T1070/",
-          "subtechnique": [
-            {
-              "id": "T1070.004",
-              "name": "File Deletion",
-              "reference": "https://attack.mitre.org/techniques/T1070/004/"
-            }
-          ]
+          "id": "T1490",
+          "name": "Inhibit System Recovery",
+          "reference": "https://attack.mitre.org/techniques/T1490/"
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 8
+  "version": 9
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_stop_process_service_threshold.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_stop_process_service_threshold.json
similarity index 64%
rename from x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_stop_process_service_threshold.json
rename to x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_stop_process_service_threshold.json
index 86903058b62fe2..ec361a87955389 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_stop_process_service_threshold.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_stop_process_service_threshold.json
@@ -2,7 +2,7 @@
   "author": [
     "Elastic"
   ],
-  "description": "This rule identifies a high number (10) of process terminations (stop, delete, or suspend) from the same host within a short time period. This may indicate a defense evasion attempt.",
+  "description": "This rule identifies a high number (10) of process terminations (stop, delete, or suspend) from the same host within a short time period.",
   "from": "now-9m",
   "index": [
     "winlogbeat-*",
@@ -21,28 +21,21 @@
     "Host",
     "Windows",
     "Threat Detection",
-    "Defense Evasion"
+    "Impact"
   ],
   "threat": [
     {
       "framework": "MITRE ATT&CK",
       "tactic": {
-        "id": "TA0005",
-        "name": "Defense Evasion",
-        "reference": "https://attack.mitre.org/tactics/TA0005/"
+        "id": "TA0040",
+        "name": "Impact",
+        "reference": "https://attack.mitre.org/tactics/TA0040/"
       },
       "technique": [
         {
-          "id": "T1562",
-          "name": "Impair Defenses",
-          "reference": "https://attack.mitre.org/techniques/T1562/",
-          "subtechnique": [
-            {
-              "id": "T1562.001",
-              "name": "Disable or Modify Tools",
-              "reference": "https://attack.mitre.org/techniques/T1562/001/"
-            }
-          ]
+          "id": "T1489",
+          "name": "Service Stop",
+          "reference": "https://attack.mitre.org/techniques/T1489/"
         }
       ]
     }
@@ -54,5 +47,5 @@
     "value": 10
   },
   "type": "threshold",
-  "version": 2
+  "version": 3
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_via_vssadmin.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.json
similarity index 70%
rename from x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_via_vssadmin.json
rename to x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.json
index f0ac38e98441ef..940229bf637511 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_via_vssadmin.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.json
@@ -2,7 +2,7 @@
   "author": [
     "Elastic"
   ],
-  "description": "Identifies use of vssadmin.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks.",
+  "description": "Identifies use of vssadmin.exe for shadow copy deletion or resizing on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks.",
   "from": "now-9m",
   "index": [
     "winlogbeat-*",
@@ -11,8 +11,8 @@
   ],
   "language": "eql",
   "license": "Elastic License v2",
-  "name": "Volume Shadow Copy Deletion via VssAdmin",
-  "query": "process where event.type in (\"start\", \"process_started\") and\n  (process.name : \"vssadmin.exe\" or process.pe.original_file_name == \"VSSADMIN.EXE\") and\n  process.args : \"delete\" and process.args : \"shadows\"\n",
+  "name": "Volume Shadow Copy Deleted or Resized via VssAdmin",
+  "query": "process where event.type in (\"start\", \"process_started\") and event.action == \"start\" \n  and (process.name : \"vssadmin.exe\" or process.pe.original_file_name == \"VSSADMIN.EXE\") and\n  process.args in (\"delete\", \"resize\") and process.args : \"shadows*\"\n",
   "risk_score": 73,
   "rule_id": "b5ea4bfe-a1b2-421f-9d47-22a75a6f2921",
   "severity": "high",
@@ -42,5 +42,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 9
+  "version": 10
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_via_powershell.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_via_powershell.json
new file mode 100644
index 00000000000000..43dce4acf4df89
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_via_powershell.json
@@ -0,0 +1,52 @@
+{
+  "author": [
+    "Elastic",
+    "Austin Songer"
+  ],
+  "description": "Identifies the use of the Win32_ShadowCopy class and related cmdlets to achieve shadow copy deletion. This commonly occurs in tandem with ransomware or other destructive attacks.",
+  "from": "now-9m",
+  "index": [
+    "winlogbeat-*",
+    "logs-endpoint.events.*",
+    "logs-windows.*"
+  ],
+  "language": "eql",
+  "license": "Elastic License v2",
+  "name": "Volume Shadow Copy Deletion via PowerShell",
+  "query": "process where event.type in (\"start\", \"process_started\") and\n  process.name : (\"powershell.exe\", \"pwsh.exe\") and \n  process.args : (\"*Get-WmiObject*\", \"*gwmi*\", \"*Get-CimInstance*\", \"*gcim*\") and\n  process.args : (\"*Win32_ShadowCopy*\") and\n  process.args : (\"*.Delete()*\", \"*Remove-WmiObject*\", \"*rwmi*\", \"*Remove-CimInstance*\", \"*rcim*\")\n",
+  "references": [
+    "https://docs.microsoft.com/en-us/previous-versions/windows/desktop/vsswmi/win32-shadowcopy",
+    "https://powershell.one/wmi/root/cimv2/win32_shadowcopy",
+    "https://www.fortinet.com/blog/threat-research/stomping-shadow-copies-a-second-look-into-deletion-methods"
+  ],
+  "risk_score": 73,
+  "rule_id": "d99a037b-c8e2-47a5-97b9-170d076827c4",
+  "severity": "high",
+  "tags": [
+    "Elastic",
+    "Host",
+    "Windows",
+    "Threat Detection",
+    "Impact"
+  ],
+  "threat": [
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0040",
+        "name": "Impact",
+        "reference": "https://attack.mitre.org/tactics/TA0040/"
+      },
+      "technique": [
+        {
+          "id": "T1490",
+          "name": "Inhibit System Recovery",
+          "reference": "https://attack.mitre.org/techniques/T1490/"
+        }
+      ]
+    }
+  ],
+  "timestamp_override": "event.ingested",
+  "type": "eql",
+  "version": 1
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_volume_shadow_copy_deletion_via_wmic.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_via_wmic.json
similarity index 66%
rename from x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_volume_shadow_copy_deletion_via_wmic.json
rename to x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_via_wmic.json
index e519b23a32b0d9..f4f530362a5b87 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_volume_shadow_copy_deletion_via_wmic.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_via_wmic.json
@@ -21,33 +21,26 @@
     "Host",
     "Windows",
     "Threat Detection",
-    "Defense Evasion"
+    "Impact"
   ],
   "threat": [
     {
       "framework": "MITRE ATT&CK",
       "tactic": {
-        "id": "TA0005",
-        "name": "Defense Evasion",
-        "reference": "https://attack.mitre.org/tactics/TA0005/"
+        "id": "TA0040",
+        "name": "Impact",
+        "reference": "https://attack.mitre.org/tactics/TA0040/"
       },
       "technique": [
         {
-          "id": "T1070",
-          "name": "Indicator Removal on Host",
-          "reference": "https://attack.mitre.org/techniques/T1070/",
-          "subtechnique": [
-            {
-              "id": "T1070.004",
-              "name": "File Deletion",
-              "reference": "https://attack.mitre.org/techniques/T1070/004/"
-            }
-          ]
+          "id": "T1490",
+          "name": "Inhibit System Recovery",
+          "reference": "https://attack.mitre.org/techniques/T1490/"
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 9
+  "version": 10
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/index.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/index.ts
index 093d5c806c2828..1c5006f5e6f48b 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/index.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/index.ts
@@ -41,38 +41,38 @@ import rule28 from './command_and_control_vnc_virtual_network_computing_to_the_i
 import rule29 from './defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.json';
 import rule30 from './defense_evasion_clearing_windows_event_logs.json';
 import rule31 from './defense_evasion_delete_volume_usn_journal_with_fsutil.json';
-import rule32 from './defense_evasion_deleting_backup_catalogs_with_wbadmin.json';
-import rule33 from './defense_evasion_disable_windows_firewall_rules_with_netsh.json';
-import rule34 from './defense_evasion_misc_lolbin_connecting_to_the_internet.json';
-import rule35 from './defense_evasion_msbuild_making_network_connections.json';
-import rule36 from './defense_evasion_suspicious_certutil_commands.json';
-import rule37 from './defense_evasion_unusual_network_connection_via_rundll32.json';
-import rule38 from './defense_evasion_unusual_process_network_connection.json';
-import rule39 from './defense_evasion_via_filter_manager.json';
-import rule40 from './defense_evasion_volume_shadow_copy_deletion_via_wmic.json';
-import rule41 from './discovery_whoami_command_activity.json';
-import rule42 from './endgame_adversary_behavior_detected.json';
-import rule43 from './endgame_cred_dumping_detected.json';
-import rule44 from './endgame_cred_dumping_prevented.json';
-import rule45 from './endgame_cred_manipulation_detected.json';
-import rule46 from './endgame_cred_manipulation_prevented.json';
-import rule47 from './endgame_exploit_detected.json';
-import rule48 from './endgame_exploit_prevented.json';
-import rule49 from './endgame_malware_detected.json';
-import rule50 from './endgame_malware_prevented.json';
-import rule51 from './endgame_permission_theft_detected.json';
-import rule52 from './endgame_permission_theft_prevented.json';
-import rule53 from './endgame_process_injection_detected.json';
-import rule54 from './endgame_process_injection_prevented.json';
-import rule55 from './endgame_ransomware_detected.json';
-import rule56 from './endgame_ransomware_prevented.json';
-import rule57 from './execution_command_prompt_connecting_to_the_internet.json';
-import rule58 from './execution_command_shell_started_by_svchost.json';
-import rule59 from './execution_html_help_executable_program_connecting_to_the_internet.json';
-import rule60 from './execution_psexec_lateral_movement_command.json';
-import rule61 from './execution_register_server_program_connecting_to_the_internet.json';
-import rule62 from './execution_via_compiled_html_file.json';
-import rule63 from './impact_volume_shadow_copy_deletion_via_vssadmin.json';
+import rule32 from './defense_evasion_disable_windows_firewall_rules_with_netsh.json';
+import rule33 from './defense_evasion_misc_lolbin_connecting_to_the_internet.json';
+import rule34 from './defense_evasion_msbuild_making_network_connections.json';
+import rule35 from './defense_evasion_suspicious_certutil_commands.json';
+import rule36 from './defense_evasion_unusual_network_connection_via_rundll32.json';
+import rule37 from './defense_evasion_unusual_process_network_connection.json';
+import rule38 from './defense_evasion_via_filter_manager.json';
+import rule39 from './discovery_whoami_command_activity.json';
+import rule40 from './endgame_adversary_behavior_detected.json';
+import rule41 from './endgame_cred_dumping_detected.json';
+import rule42 from './endgame_cred_dumping_prevented.json';
+import rule43 from './endgame_cred_manipulation_detected.json';
+import rule44 from './endgame_cred_manipulation_prevented.json';
+import rule45 from './endgame_exploit_detected.json';
+import rule46 from './endgame_exploit_prevented.json';
+import rule47 from './endgame_malware_detected.json';
+import rule48 from './endgame_malware_prevented.json';
+import rule49 from './endgame_permission_theft_detected.json';
+import rule50 from './endgame_permission_theft_prevented.json';
+import rule51 from './endgame_process_injection_detected.json';
+import rule52 from './endgame_process_injection_prevented.json';
+import rule53 from './endgame_ransomware_detected.json';
+import rule54 from './endgame_ransomware_prevented.json';
+import rule55 from './execution_command_prompt_connecting_to_the_internet.json';
+import rule56 from './execution_command_shell_started_by_svchost.json';
+import rule57 from './execution_html_help_executable_program_connecting_to_the_internet.json';
+import rule58 from './execution_psexec_lateral_movement_command.json';
+import rule59 from './execution_register_server_program_connecting_to_the_internet.json';
+import rule60 from './execution_via_compiled_html_file.json';
+import rule61 from './impact_deleting_backup_catalogs_with_wbadmin.json';
+import rule62 from './impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.json';
+import rule63 from './impact_volume_shadow_copy_deletion_via_wmic.json';
 import rule64 from './initial_access_rpc_remote_procedure_call_from_the_internet.json';
 import rule65 from './initial_access_rpc_remote_procedure_call_to_the_internet.json';
 import rule66 from './initial_access_script_executing_powershell.json';
@@ -95,7 +95,7 @@ import rule82 from './persistence_system_shells_via_services.json';
 import rule83 from './persistence_user_account_creation.json';
 import rule84 from './persistence_via_application_shimming.json';
 import rule85 from './privilege_escalation_unusual_parentchild_relationship.json';
-import rule86 from './defense_evasion_modification_of_boot_config.json';
+import rule86 from './impact_modification_of_boot_config.json';
 import rule87 from './privilege_escalation_uac_bypass_event_viewer.json';
 import rule88 from './defense_evasion_msxsl_network.json';
 import rule89 from './discovery_net_command_system_account.json';
@@ -328,7 +328,7 @@ import rule315 from './command_and_control_cobalt_strike_default_teamserver_cert
 import rule316 from './defense_evasion_enable_inbound_rdp_with_netsh.json';
 import rule317 from './defense_evasion_execution_lolbas_wuauclt.json';
 import rule318 from './privilege_escalation_unusual_svchost_childproc_childless.json';
-import rule319 from './lateral_movement_rdp_tunnel_plink.json';
+import rule319 from './command_and_control_rdp_tunnel_plink.json';
 import rule320 from './privilege_escalation_uac_bypass_winfw_mmc_hijack.json';
 import rule321 from './persistence_ms_office_addins_file.json';
 import rule322 from './discovery_adfind_command_activity.json';
@@ -428,8 +428,8 @@ import rule415 from './credential_access_copy_ntds_sam_volshadowcp_cmdline.json'
 import rule416 from './credential_access_lsass_memdump_file_created.json';
 import rule417 from './lateral_movement_incoming_winrm_shell_execution.json';
 import rule418 from './lateral_movement_powershell_remoting_target.json';
-import rule419 from './defense_evasion_hide_encoded_executable_registry.json';
-import rule420 from './defense_evasion_port_forwarding_added_registry.json';
+import rule419 from './command_and_control_port_forwarding_added_registry.json';
+import rule420 from './defense_evasion_hide_encoded_executable_registry.json';
 import rule421 from './lateral_movement_rdp_enabled_registry.json';
 import rule422 from './privilege_escalation_printspooler_registry_copyfiles.json';
 import rule423 from './privilege_escalation_rogue_windir_environment_var.json';
@@ -443,7 +443,7 @@ import rule430 from './credential_access_microsoft_365_brute_force_user_account_
 import rule431 from './microsoft_365_teams_custom_app_interaction_allowed.json';
 import rule432 from './persistence_microsoft_365_teams_external_access_enabled.json';
 import rule433 from './credential_access_microsoft_365_potential_password_spraying_attack.json';
-import rule434 from './defense_evasion_stop_process_service_threshold.json';
+import rule434 from './impact_stop_process_service_threshold.json';
 import rule435 from './collection_winrar_encryption.json';
 import rule436 from './defense_evasion_unusual_dir_ads.json';
 import rule437 from './discovery_admin_recon.json';
@@ -466,8 +466,8 @@ import rule453 from './execution_apt_solarwinds_backdoor_child_cmd_powershell.js
 import rule454 from './execution_apt_solarwinds_backdoor_unusual_child_processes.json';
 import rule455 from './initial_access_azure_active_directory_powershell_signin.json';
 import rule456 from './collection_email_powershell_exchange_mailbox.json';
-import rule457 from './collection_persistence_powershell_exch_mailbox_activesync_add_device.json';
-import rule458 from './execution_scheduled_task_powershell_source.json';
+import rule457 from './execution_scheduled_task_powershell_source.json';
+import rule458 from './persistence_powershell_exch_mailbox_activesync_add_device.json';
 import rule459 from './persistence_docker_shortcuts_plist_modification.json';
 import rule460 from './persistence_evasion_hidden_local_account_creation.json';
 import rule461 from './persistence_finder_sync_plugin_pluginkit.json';
@@ -551,36 +551,54 @@ import rule538 from './persistence_ec2_security_group_configuration_change_detec
 import rule539 from './defense_evasion_disabling_windows_logs.json';
 import rule540 from './persistence_route_53_domain_transfer_lock_disabled.json';
 import rule541 from './persistence_route_53_domain_transferred_to_another_account.json';
-import rule542 from './credential_access_user_excessive_sso_logon_errors.json';
-import rule543 from './defense_evasion_suspicious_execution_from_mounted_device.json';
-import rule544 from './defense_evasion_unusual_network_connection_via_dllhost.json';
-import rule545 from './defense_evasion_amsienable_key_mod.json';
-import rule546 from './impact_rds_group_deletion.json';
-import rule547 from './persistence_rds_group_creation.json';
-import rule548 from './exfiltration_rds_snapshot_export.json';
-import rule549 from './persistence_rds_instance_creation.json';
-import rule550 from './ml_auth_rare_hour_for_a_user_to_logon.json';
-import rule551 from './ml_auth_rare_source_ip_for_a_user.json';
-import rule552 from './ml_auth_rare_user_logon.json';
-import rule553 from './ml_auth_spike_in_failed_logon_events.json';
-import rule554 from './ml_auth_spike_in_logon_events.json';
-import rule555 from './ml_auth_spike_in_logon_events_from_a_source_ip.json';
-import rule556 from './privilege_escalation_cyberarkpas_error_audit_event_promotion.json';
-import rule557 from './privilege_escalation_cyberarkpas_recommended_events_to_monitor_promotion.json';
-import rule558 from './privilege_escalation_printspooler_malicious_driver_file_changes.json';
-import rule559 from './privilege_escalation_printspooler_malicious_registry_modification.json';
-import rule560 from './privilege_escalation_printspooler_suspicious_file_deletion.json';
-import rule561 from './privilege_escalation_unusual_printspooler_childprocess.json';
-import rule562 from './defense_evasion_disabling_windows_defender_powershell.json';
-import rule563 from './defense_evasion_enable_network_discovery_with_netsh.json';
-import rule564 from './defense_evasion_execution_windefend_unusual_path.json';
-import rule565 from './defense_evasion_agent_spoofing_mismatched_id.json';
-import rule566 from './defense_evasion_agent_spoofing_multiple_hosts.json';
-import rule567 from './defense_evasion_parent_process_pid_spoofing.json';
-import rule568 from './defense_evasion_defender_exclusion_via_powershell.json';
-import rule569 from './defense_evasion_whitespace_padding_in_command_line.json';
-import rule570 from './persistence_webshell_detection.json';
-import rule571 from './persistence_via_bits_job_notify_command.json';
+import rule542 from './initial_access_okta_user_attempted_unauthorized_access.json';
+import rule543 from './credential_access_user_excessive_sso_logon_errors.json';
+import rule544 from './persistence_exchange_suspicious_mailbox_right_delegation.json';
+import rule545 from './privilege_escalation_new_or_modified_federation_domain.json';
+import rule546 from './privilege_escalation_sts_getsessiontoken_abuse.json';
+import rule547 from './defense_evasion_suspicious_execution_from_mounted_device.json';
+import rule548 from './defense_evasion_unusual_network_connection_via_dllhost.json';
+import rule549 from './defense_evasion_amsienable_key_mod.json';
+import rule550 from './impact_rds_group_deletion.json';
+import rule551 from './persistence_rds_group_creation.json';
+import rule552 from './persistence_route_table_modified_or_deleted.json';
+import rule553 from './exfiltration_rds_snapshot_export.json';
+import rule554 from './persistence_rds_instance_creation.json';
+import rule555 from './ml_auth_rare_hour_for_a_user_to_logon.json';
+import rule556 from './ml_auth_rare_source_ip_for_a_user.json';
+import rule557 from './ml_auth_rare_user_logon.json';
+import rule558 from './ml_auth_spike_in_failed_logon_events.json';
+import rule559 from './ml_auth_spike_in_logon_events.json';
+import rule560 from './ml_auth_spike_in_logon_events_from_a_source_ip.json';
+import rule561 from './privilege_escalation_cyberarkpas_error_audit_event_promotion.json';
+import rule562 from './privilege_escalation_cyberarkpas_recommended_events_to_monitor_promotion.json';
+import rule563 from './privilege_escalation_printspooler_malicious_driver_file_changes.json';
+import rule564 from './privilege_escalation_printspooler_malicious_registry_modification.json';
+import rule565 from './privilege_escalation_printspooler_suspicious_file_deletion.json';
+import rule566 from './privilege_escalation_unusual_printspooler_childprocess.json';
+import rule567 from './defense_evasion_disabling_windows_defender_powershell.json';
+import rule568 from './defense_evasion_enable_network_discovery_with_netsh.json';
+import rule569 from './defense_evasion_execution_windefend_unusual_path.json';
+import rule570 from './defense_evasion_agent_spoofing_mismatched_id.json';
+import rule571 from './defense_evasion_agent_spoofing_multiple_hosts.json';
+import rule572 from './defense_evasion_parent_process_pid_spoofing.json';
+import rule573 from './impact_microsoft_365_potential_ransomware_activity.json';
+import rule574 from './impact_microsoft_365_unusual_volume_of_file_deletion.json';
+import rule575 from './initial_access_microsoft_365_user_restricted_from_sending_email.json';
+import rule576 from './defense_evasion_elasticache_security_group_creation.json';
+import rule577 from './defense_evasion_elasticache_security_group_modified_or_deleted.json';
+import rule578 from './impact_volume_shadow_copy_deletion_via_powershell.json';
+import rule579 from './defense_evasion_defender_exclusion_via_powershell.json';
+import rule580 from './defense_evasion_whitespace_padding_in_command_line.json';
+import rule581 from './defense_evasion_frontdoor_firewall_policy_deletion.json';
+import rule582 from './persistence_webshell_detection.json';
+import rule583 from './defense_evasion_execution_control_panel_suspicious_args.json';
+import rule584 from './credential_access_potential_lsa_memdump_via_mirrordump.json';
+import rule585 from './discovery_virtual_machine_fingerprinting_grep.json';
+import rule586 from './impact_backup_file_deletion.json';
+import rule587 from './persistence_screensaver_engine_unexpected_child_process.json';
+import rule588 from './persistence_screensaver_plist_file_modification.json';
+import rule589 from './persistence_via_bits_job_notify_command.json';
 
 export const rawRules = [
   rule1,
@@ -1154,4 +1172,22 @@ export const rawRules = [
   rule569,
   rule570,
   rule571,
+  rule572,
+  rule573,
+  rule574,
+  rule575,
+  rule576,
+  rule577,
+  rule578,
+  rule579,
+  rule580,
+  rule581,
+  rule582,
+  rule583,
+  rule584,
+  rule585,
+  rule586,
+  rule587,
+  rule588,
+  rule589,
 ];
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_microsoft_365_user_restricted_from_sending_email.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_microsoft_365_user_restricted_from_sending_email.json
new file mode 100644
index 00000000000000..31950fc345c0e0
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_microsoft_365_user_restricted_from_sending_email.json
@@ -0,0 +1,54 @@
+{
+  "author": [
+    "Austin Songer"
+  ],
+  "description": "Identifies when a user has been restricted from sending email due to exceeding sending limits of the service policies per the Security Compliance Center.",
+  "false_positives": [
+    "A user sending emails using personal distribution folders may trigger the event."
+  ],
+  "from": "now-30m",
+  "index": [
+    "filebeat-*",
+    "logs-o365*"
+  ],
+  "language": "kuery",
+  "license": "Elastic License v2",
+  "name": "Microsoft 365 User Restricted from Sending Email",
+  "note": "## Config\n\nThe Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.\n",
+  "query": "event.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.category:web and event.action:\"User restricted from sending email\" and event.outcome:success\n",
+  "references": [
+    "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy",
+    "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference"
+  ],
+  "risk_score": 47,
+  "rule_id": "0136b315-b566-482f-866c-1d8e2477ba16",
+  "severity": "medium",
+  "tags": [
+    "Elastic",
+    "Cloud",
+    "Microsoft 365",
+    "Continuous Monitoring",
+    "SecOps",
+    "Configuration Audit"
+  ],
+  "threat": [
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0001",
+        "name": "Initial Access",
+        "reference": "https://attack.mitre.org/tactics/TA0001/"
+      },
+      "technique": [
+        {
+          "id": "T1078",
+          "name": "Valid Accounts",
+          "reference": "https://attack.mitre.org/techniques/T1078/"
+        }
+      ]
+    }
+  ],
+  "timestamp_override": "event.ingested",
+  "type": "query",
+  "version": 1
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_okta_user_attempted_unauthorized_access.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_okta_user_attempted_unauthorized_access.json
new file mode 100644
index 00000000000000..222d30723bc9ef
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_okta_user_attempted_unauthorized_access.json
@@ -0,0 +1,74 @@
+{
+  "author": [
+    "Elastic",
+    "Austin Songer"
+  ],
+  "description": "Identifies when an unauthorized access attempt is made by a user for an Okta application.",
+  "index": [
+    "filebeat-*",
+    "logs-okta*"
+  ],
+  "language": "kuery",
+  "license": "Elastic License v2",
+  "name": "Unauthorized Access to an Okta Application",
+  "note": "## Config\n\nThe Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
+  "query": "event.dataset:okta.system and event.action:app.generic.unauth_app_access_attempt\n",
+  "risk_score": 21,
+  "rule_id": "4edd3e1a-3aa0-499b-8147-4d2ea43b1613",
+  "severity": "low",
+  "tags": [
+    "Elastic",
+    "Identity",
+    "Okta",
+    "Continuous Monitoring",
+    "SecOps",
+    "Identity and Access"
+  ],
+  "threat": [
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0001",
+        "name": "Initial Access",
+        "reference": "https://attack.mitre.org/tactics/TA0001/"
+      },
+      "technique": [
+        {
+          "id": "T1078",
+          "name": "Valid Accounts",
+          "reference": "https://attack.mitre.org/techniques/T1078/"
+        }
+      ]
+    },
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0005",
+        "name": "Defense Evasion",
+        "reference": "https://attack.mitre.org/tactics/TA0005/"
+      },
+      "technique": []
+    },
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0003",
+        "name": "Persistence",
+        "reference": "https://attack.mitre.org/tactics/TA0003/"
+      },
+      "technique": []
+    },
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0004",
+        "name": "Privilege Escalation",
+        "reference": "https://attack.mitre.org/tactics/TA0004/"
+      },
+      "technique": []
+    }
+  ],
+  "timestamp_override": "event.ingested",
+  "type": "query",
+  "version": 1
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_office_child_process.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_office_child_process.json
index 16486590cb0939..17e9195181f3db 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_office_child_process.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_office_child_process.json
@@ -12,7 +12,7 @@
   "language": "eql",
   "license": "Elastic License v2",
   "name": "Suspicious MS Office Child Process",
-  "query": "process where event.type in (\"start\", \"process_started\") and\n  process.parent.name : (\"eqnedt32.exe\", \"excel.exe\", \"fltldr.exe\", \"msaccess.exe\", \"mspub.exe\", \"powerpnt.exe\", \"winword.exe\") and\n  process.name : (\"Microsoft.Workflow.Compiler.exe\", \"arp.exe\", \"atbroker.exe\", \"bginfo.exe\", \"bitsadmin.exe\", \"cdb.exe\", \"certutil.exe\",\n                \"cmd.exe\", \"cmstp.exe\", \"cscript.exe\", \"csi.exe\", \"dnx.exe\", \"dsget.exe\", \"dsquery.exe\", \"forfiles.exe\", \"fsi.exe\",\n                \"ftp.exe\", \"gpresult.exe\", \"hostname.exe\", \"ieexec.exe\", \"iexpress.exe\", \"installutil.exe\", \"ipconfig.exe\", \"mshta.exe\",\n                \"msxsl.exe\", \"nbtstat.exe\", \"net.exe\", \"net1.exe\", \"netsh.exe\", \"netstat.exe\", \"nltest.exe\", \"odbcconf.exe\", \"ping.exe\",\n                \"powershell.exe\", \"pwsh.exe\", \"qprocess.exe\", \"quser.exe\", \"qwinsta.exe\", \"rcsi.exe\", \"reg.exe\", \"regasm.exe\", \"regsvcs.exe\",\n                \"regsvr32.exe\", \"sc.exe\", \"schtasks.exe\", \"systeminfo.exe\", \"tasklist.exe\", \"tracert.exe\", \"whoami.exe\",\n                \"wmic.exe\", \"wscript.exe\", \"xwizard.exe\", \"explorer.exe\", \"rundll32.exe\", \"hh.exe\")\n",
+  "query": "process where event.type in (\"start\", \"process_started\") and\n  process.parent.name : (\"eqnedt32.exe\", \"excel.exe\", \"fltldr.exe\", \"msaccess.exe\", \"mspub.exe\", \"powerpnt.exe\", \"winword.exe\") and\n  process.name : (\"Microsoft.Workflow.Compiler.exe\", \"arp.exe\", \"atbroker.exe\", \"bginfo.exe\", \"bitsadmin.exe\", \"cdb.exe\", \"certutil.exe\",\n                \"cmd.exe\", \"cmstp.exe\", \"control.exe\", \"cscript.exe\", \"csi.exe\", \"dnx.exe\", \"dsget.exe\", \"dsquery.exe\", \"forfiles.exe\", \n                \"fsi.exe\", \"ftp.exe\", \"gpresult.exe\", \"hostname.exe\", \"ieexec.exe\", \"iexpress.exe\", \"installutil.exe\", \"ipconfig.exe\", \n                \"mshta.exe\", \"msxsl.exe\", \"nbtstat.exe\", \"net.exe\", \"net1.exe\", \"netsh.exe\", \"netstat.exe\", \"nltest.exe\", \"odbcconf.exe\", \n                \"ping.exe\", \"powershell.exe\", \"pwsh.exe\", \"qprocess.exe\", \"quser.exe\", \"qwinsta.exe\", \"rcsi.exe\", \"reg.exe\", \"regasm.exe\", \n                \"regsvcs.exe\", \"regsvr32.exe\", \"sc.exe\", \"schtasks.exe\", \"systeminfo.exe\", \"tasklist.exe\", \"tracert.exe\", \"whoami.exe\",\n                \"wmic.exe\", \"wscript.exe\", \"xwizard.exe\", \"explorer.exe\", \"rundll32.exe\", \"hh.exe\")\n",
   "risk_score": 47,
   "rule_id": "a624863f-a70d-417f-a7d2-7a404638d47f",
   "severity": "medium",
@@ -49,5 +49,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 8
+  "version": 9
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_credential_access_kerberos_bifrostconsole.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_credential_access_kerberos_bifrostconsole.json
index 82fa9d8d72a928..0fd10fc8078468 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_credential_access_kerberos_bifrostconsole.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_credential_access_kerberos_bifrostconsole.json
@@ -60,12 +60,19 @@
         {
           "id": "T1558",
           "name": "Steal or Forge Kerberos Tickets",
-          "reference": "https://attack.mitre.org/techniques/T1558/"
+          "reference": "https://attack.mitre.org/techniques/T1558/",
+          "subtechnique": [
+            {
+              "id": "T1558.003",
+              "name": "Kerberoasting",
+              "reference": "https://attack.mitre.org/techniques/T1558/003/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 1
+  "version": 2
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dcom_hta.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dcom_hta.json
index 707596aa333d04..f832eb51336f81 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dcom_hta.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dcom_hta.json
@@ -12,7 +12,7 @@
   "language": "eql",
   "license": "Elastic License v2",
   "name": "Incoming DCOM Lateral Movement via MSHTA",
-  "query": "sequence with maxspan=1m\n  [process where event.type in (\"start\", \"process_started\") and\n     process.name : \"mshta.exe\" and process.args : \"-Embedding\"\n  ] by host.id, process.entity_id\n  [network where event.type == \"start\" and process.name : \"mshta.exe\" and \n     network.direction == \"incoming\" and network.transport == \"tcp\" and\n     source.port > 49151 and destination.port > 49151 and not source.address in (\"127.0.0.1\", \"::1\")\n  ] by host.id, process.entity_id\n",
+  "query": "sequence with maxspan=1m\n  [process where event.type in (\"start\", \"process_started\") and\n     process.name : \"mshta.exe\" and process.args : \"-Embedding\"\n  ] by host.id, process.entity_id\n  [network where event.type == \"start\" and process.name : \"mshta.exe\" and \n     network.direction : (\"incoming\", \"ingress\") and network.transport == \"tcp\" and\n     source.port > 49151 and destination.port > 49151 and not source.address in (\"127.0.0.1\", \"::1\")\n  ] by host.id, process.entity_id\n",
   "references": [
     "https://codewhitesec.blogspot.com/2018/07/lethalhta.html"
   ],
@@ -38,11 +38,40 @@
         {
           "id": "T1021",
           "name": "Remote Services",
-          "reference": "https://attack.mitre.org/techniques/T1021/"
+          "reference": "https://attack.mitre.org/techniques/T1021/",
+          "subtechnique": [
+            {
+              "id": "T1021.003",
+              "name": "Distributed Component Object Model",
+              "reference": "https://attack.mitre.org/techniques/T1021/003/"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0005",
+        "name": "Defense Evasion",
+        "reference": "https://attack.mitre.org/tactics/TA0005/"
+      },
+      "technique": [
+        {
+          "id": "T1218",
+          "name": "Signed Binary Proxy Execution",
+          "reference": "https://attack.mitre.org/techniques/T1218/",
+          "subtechnique": [
+            {
+              "id": "T1218.005",
+              "name": "Mshta",
+              "reference": "https://attack.mitre.org/techniques/T1218/005/"
+            }
+          ]
         }
       ]
     }
   ],
   "type": "eql",
-  "version": 2
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dcom_mmc20.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dcom_mmc20.json
index c78343223a10fe..8cb2e2c3690e64 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dcom_mmc20.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dcom_mmc20.json
@@ -12,7 +12,7 @@
   "language": "eql",
   "license": "Elastic License v2",
   "name": "Incoming DCOM Lateral Movement with MMC",
-  "query": "sequence by host.id with maxspan=1m\n [network where event.type == \"start\" and process.name : \"mmc.exe\" and\n  source.port >= 49152 and destination.port >= 49152 and source.address not in (\"127.0.0.1\", \"::1\") and\n  network.direction == \"incoming\" and network.transport == \"tcp\"\n ] by process.entity_id\n [process where event.type in (\"start\", \"process_started\") and process.parent.name : \"mmc.exe\"\n ] by process.parent.entity_id\n",
+  "query": "sequence by host.id with maxspan=1m\n [network where event.type == \"start\" and process.name : \"mmc.exe\" and\n  source.port >= 49152 and destination.port >= 49152 and source.address not in (\"127.0.0.1\", \"::1\") and\n  network.direction : (\"incoming\", \"ingress\") and network.transport == \"tcp\"\n ] by process.entity_id\n [process where event.type in (\"start\", \"process_started\") and process.parent.name : \"mmc.exe\"\n ] by process.parent.entity_id\n",
   "references": [
     "https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/"
   ],
@@ -38,11 +38,18 @@
         {
           "id": "T1021",
           "name": "Remote Services",
-          "reference": "https://attack.mitre.org/techniques/T1021/"
+          "reference": "https://attack.mitre.org/techniques/T1021/",
+          "subtechnique": [
+            {
+              "id": "T1021.003",
+              "name": "Distributed Component Object Model",
+              "reference": "https://attack.mitre.org/techniques/T1021/003/"
+            }
+          ]
         }
       ]
     }
   ],
   "type": "eql",
-  "version": 2
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dcom_shellwindow_shellbrowserwindow.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dcom_shellwindow_shellbrowserwindow.json
index 617cbc2fab05ed..9ca759cc2facde 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dcom_shellwindow_shellbrowserwindow.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dcom_shellwindow_shellbrowserwindow.json
@@ -12,7 +12,7 @@
   "language": "eql",
   "license": "Elastic License v2",
   "name": "Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows",
-  "query": "sequence by host.id with maxspan=5s\n [network where event.type == \"start\" and process.name : \"explorer.exe\" and\n  network.direction == \"incoming\" and network.transport == \"tcp\" and\n  source.port > 49151 and destination.port > 49151 and not source.address in (\"127.0.0.1\", \"::1\")\n ] by process.entity_id\n [process where event.type in (\"start\", \"process_started\") and\n  process.parent.name : \"explorer.exe\"\n ] by process.parent.entity_id\n",
+  "query": "sequence by host.id with maxspan=5s\n [network where event.type == \"start\" and process.name : \"explorer.exe\" and\n  network.direction : (\"incoming\", \"ingress\") and network.transport == \"tcp\" and\n  source.port > 49151 and destination.port > 49151 and not source.address in (\"127.0.0.1\", \"::1\")\n ] by process.entity_id\n [process where event.type in (\"start\", \"process_started\") and\n  process.parent.name : \"explorer.exe\"\n ] by process.parent.entity_id\n",
   "references": [
     "https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/"
   ],
@@ -38,11 +38,18 @@
         {
           "id": "T1021",
           "name": "Remote Services",
-          "reference": "https://attack.mitre.org/techniques/T1021/"
+          "reference": "https://attack.mitre.org/techniques/T1021/",
+          "subtechnique": [
+            {
+              "id": "T1021.003",
+              "name": "Distributed Component Object Model",
+              "reference": "https://attack.mitre.org/techniques/T1021/003/"
+            }
+          ]
         }
       ]
     }
   ],
   "type": "eql",
-  "version": 2
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_direct_outbound_smb_connection.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_direct_outbound_smb_connection.json
index b4534c48d0fa2d..c9983d2ba186eb 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_direct_outbound_smb_connection.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_direct_outbound_smb_connection.json
@@ -33,13 +33,20 @@
       },
       "technique": [
         {
-          "id": "T1210",
-          "name": "Exploitation of Remote Services",
-          "reference": "https://attack.mitre.org/techniques/T1210/"
+          "id": "T1021",
+          "name": "Remote Services",
+          "reference": "https://attack.mitre.org/techniques/T1021/",
+          "subtechnique": [
+            {
+              "id": "T1021.002",
+              "name": "SMB/Windows Admin Shares",
+              "reference": "https://attack.mitre.org/techniques/T1021/002/"
+            }
+          ]
         }
       ]
     }
   ],
   "type": "eql",
-  "version": 6
+  "version": 7
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dns_server_overflow.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dns_server_overflow.json
index b34badc7c86113..6e11258e23d007 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dns_server_overflow.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dns_server_overflow.json
@@ -13,7 +13,7 @@
   "language": "kuery",
   "license": "Elastic License v2",
   "name": "Abnormally Large DNS Response",
-  "note": "## Triage and analysis\n\n### Investigating Large DNS Responses\nDetection alerts from this rule indicate an attempt was made to exploit CVE-2020-1350 (SigRed) through the use of large DNS responses on a Windows DNS server. Here are some possible avenues of investigation:\n- Investigate any corresponding Intrusion Detection Signatures (IDS) alerts that can validate this detection alert.\n- Examine the `dns.question_type` network fieldset with a protocol analyzer, such as Zeek, Packetbeat, or Suricata, for `SIG` or `RRSIG` data.\n- Validate the patch level and OS of the targeted DNS server to validate the observed activity was not large-scale Internet vulnerability scanning.\n- Validate that the source of the network activity was not from an authorized vulnerability scan or compromise assessment.",
+  "note": "## Triage and analysis\n\n### Investigating Large DNS Responses\nDetection alerts from this rule indicate possible anomalous activity around large byte DNS responses from a Windows DNS\nserver. This detection rule was created based on activity represented in exploitation of vulnerability (CVE-2020-1350)\nalso known as [SigRed](https://www.elastic.co/blog/detection-rules-for-sigred-vulnerability) during July 2020.\n\n#### Possible investigation steps:\n- This specific rule is sourced from network log activity such as DNS or network level data. It's important to validate\nthe source of the incoming traffic and determine if this activity has been observed previously within an environment.\n- Activity can be further investigated and validated by reviewing available corresponding Intrusion Detection Signatures (IDS) alerts associated with activity.\n- Further examination can be made by reviewing the `dns.question_type` network fieldset with a protocol analyzer, such as Zeek, Packetbeat, or Suricata, for `SIG` or `RRSIG` data.\n- Validate the patch level and OS of the targeted DNS server to validate the observed activity was not large-scale Internet vulnerability scanning.\n- Validate that the source of the network activity was not from an authorized vulnerability scan or compromise assessment.\n\n#### False Positive Analysis\n- Based on this rule which looks for a threshold of 60k bytes, it is possible for activity to be generated under 65k bytes\nand related to legitimate behavior.  In packet capture files received by the [SANS Internet Storm Center](https://isc.sans.edu/forums/diary/PATCH+NOW+SIGRed+CVE20201350+Microsoft+DNS+Server+Vulnerability/26356/), byte responses\nwere all observed as greater than 65k bytes.\n- This activity has the ability to be triggered from compliance/vulnerability scanning or compromise assessment, it's\nimportant to determine the source of the activity and potential whitelist the source host\n\n\n### Related Rules\n- Unusual Child Process of dns.exe\n- Unusual File Modification by dns.exe\n\n### Response and Remediation\n- Review and implement the above detection logic within your environment using technology such as Endpoint security, Winlogbeat, Packetbeat, or network security monitoring (NSM) platforms such as Zeek or Suricata.\n- Ensure that you have deployed the latest Microsoft [Security Update](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350) (Monthly Rollup or Security Only) and restart the\npatched machines. If unable to patch immediately: Microsoft [released](https://support.microsoft.com/en-us/help/4569509/windows-dns-server-remote-code-execution-vulnerability) a registry-based workaround that doesn\u2019t require a\nrestart. This can be used as a temporary solution before the patch is applied.\n- Maintain backups of your critical systems to aid in quick recovery.\n- Perform routine vulnerability scans of your systems, monitor [CISA advisories](https://us-cert.cisa.gov/ncas/current-activity) and patch identified vulnerabilities.\n- If observed true positive activity, implement a remediation plan and monitor host-based artifacts for additional post-exploitation behavior.\n",
   "query": "event.category:(network or network_traffic) and destination.port:53 and\n  (event.dataset:zeek.dns or type:dns or event.type:connection) and network.bytes > 60000\n",
   "references": [
     "https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/",
@@ -48,5 +48,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 4
+  "version": 5
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_executable_tool_transfer_smb.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_executable_tool_transfer_smb.json
index 8173ddc6f10032..5fe9d066bc76d1 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_executable_tool_transfer_smb.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_executable_tool_transfer_smb.json
@@ -12,7 +12,7 @@
   "language": "eql",
   "license": "Elastic License v2",
   "name": "Lateral Tool Transfer",
-  "query": "sequence by host.id with maxspan=30s\n  [network where event.type == \"start\" and process.pid == 4 and destination.port == 445 and\n   network.direction == \"incoming\" and network.transport == \"tcp\" and\n   source.address != \"127.0.0.1\" and source.address != \"::1\"\n  ] by process.entity_id\n  /* add more executable extensions here if they are not noisy in your environment */\n  [file where event.type in (\"creation\", \"change\") and process.pid == 4 and file.extension : (\"exe\", \"dll\", \"bat\", \"cmd\")] by process.entity_id\n",
+  "query": "sequence by host.id with maxspan=30s\n  [network where event.type == \"start\" and process.pid == 4 and destination.port == 445 and\n   network.direction : (\"incoming\", \"ingress\") and network.transport == \"tcp\" and\n   source.address != \"127.0.0.1\" and source.address != \"::1\"\n  ] by process.entity_id\n  /* add more executable extensions here if they are not noisy in your environment */\n  [file where event.type in (\"creation\", \"change\") and process.pid == 4 and file.extension : (\"exe\", \"dll\", \"bat\", \"cmd\")] by process.entity_id\n",
   "risk_score": 47,
   "rule_id": "58bc134c-e8d2-4291-a552-b4b3e537c60b",
   "severity": "medium",
@@ -41,5 +41,5 @@
     }
   ],
   "type": "eql",
-  "version": 2
+  "version": 3
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_incoming_winrm_shell_execution.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_incoming_winrm_shell_execution.json
index 062013549e1da1..04a60f99556f46 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_incoming_winrm_shell_execution.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_incoming_winrm_shell_execution.json
@@ -15,7 +15,7 @@
   "language": "eql",
   "license": "Elastic License v2",
   "name": "Incoming Execution via WinRM Remote Shell",
-  "query": "sequence by host.id with maxspan=30s\n   [network where process.pid == 4 and network.direction == \"incoming\" and\n    destination.port in (5985, 5986) and network.protocol == \"http\" and not source.address in (\"::1\", \"127.0.0.1\")\n   ]\n   [process where event.type == \"start\" and process.parent.name : \"winrshost.exe\" and not process.name : \"conhost.exe\"]\n",
+  "query": "sequence by host.id with maxspan=30s\n   [network where process.pid == 4 and network.direction : (\"incoming\", \"ingress\") and\n    destination.port in (5985, 5986) and network.protocol == \"http\" and not source.address in (\"::1\", \"127.0.0.1\")\n   ]\n   [process where event.type == \"start\" and process.parent.name : \"winrshost.exe\" and not process.name : \"conhost.exe\"]\n",
   "risk_score": 47,
   "rule_id": "1cd01db9-be24-4bef-8e7c-e923f0ff78ab",
   "severity": "medium",
@@ -44,5 +44,5 @@
     }
   ],
   "type": "eql",
-  "version": 2
+  "version": 3
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_incoming_wmi.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_incoming_wmi.json
index 901a19d896ff32..9b13ade43812f5 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_incoming_wmi.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_incoming_wmi.json
@@ -12,7 +12,7 @@
   "language": "eql",
   "license": "Elastic License v2",
   "name": "WMI Incoming Lateral Movement",
-  "query": "sequence by host.id with maxspan = 2s\n\n /* Accepted Incoming RPC connection by Winmgmt service */\n\n  [network where process.name : \"svchost.exe\" and network.direction == \"incoming\" and\n   source.address != \"127.0.0.1\" and source.address != \"::1\" and \n   source.port >= 49152 and destination.port >= 49152\n  ]\n\n  /* Excluding Common FPs Nessus and SCCM */\n\n  [process where event.type in (\"start\", \"process_started\") and process.parent.name : \"WmiPrvSE.exe\" and\n   not process.args : (\"C:\\\\windows\\\\temp\\\\nessus_*.txt\", \n                       \"C:\\\\windows\\\\TEMP\\\\nessus_*.TMP\", \n                       \"C:\\\\Windows\\\\CCM\\\\SystemTemp\\\\*\", \n                       \"C:\\\\Windows\\\\CCMCache\\\\*\", \n                       \"C:\\\\CCM\\\\Cache\\\\*\")\n   ]\n",
+  "query": "sequence by host.id with maxspan = 2s\n\n /* Accepted Incoming RPC connection by Winmgmt service */\n\n  [network where process.name : \"svchost.exe\" and network.direction : (\"incoming\", \"ingress\") and\n   source.address != \"127.0.0.1\" and source.address != \"::1\" and \n   source.port >= 49152 and destination.port >= 49152\n  ]\n\n  /* Excluding Common FPs Nessus and SCCM */\n\n  [process where event.type in (\"start\", \"process_started\") and process.parent.name : \"WmiPrvSE.exe\" and\n   not process.args : (\"C:\\\\windows\\\\temp\\\\nessus_*.txt\", \n                       \"C:\\\\windows\\\\TEMP\\\\nessus_*.TMP\", \n                       \"C:\\\\Windows\\\\CCM\\\\SystemTemp\\\\*\", \n                       \"C:\\\\Windows\\\\CCMCache\\\\*\", \n                       \"C:\\\\CCM\\\\Cache\\\\*\")\n   ]\n",
   "risk_score": 47,
   "rule_id": "f3475224-b179-4f78-8877-c2bd64c26b88",
   "severity": "medium",
@@ -50,5 +50,5 @@
     }
   ],
   "type": "eql",
-  "version": 2
+  "version": 3
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_powershell_remoting_target.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_powershell_remoting_target.json
index 33b5ef7c0dacb3..94708f90d20bb8 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_powershell_remoting_target.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_powershell_remoting_target.json
@@ -15,7 +15,7 @@
   "language": "eql",
   "license": "Elastic License v2",
   "name": "Incoming Execution via PowerShell Remoting",
-  "query": "sequence by host.id with maxspan = 30s\n   [network where network.direction == \"incoming\" and destination.port in (5985, 5986) and\n    network.protocol == \"http\" and source.address != \"127.0.0.1\" and source.address != \"::1\"\n   ]\n   [process where event.type == \"start\" and process.parent.name : \"wsmprovhost.exe\" and not process.name : \"conhost.exe\"]\n",
+  "query": "sequence by host.id with maxspan = 30s\n   [network where network.direction : (\"incoming\", \"ingress\") and destination.port in (5985, 5986) and\n    network.protocol == \"http\" and source.address != \"127.0.0.1\" and source.address != \"::1\"\n   ]\n   [process where event.type == \"start\" and process.parent.name : \"wsmprovhost.exe\" and not process.name : \"conhost.exe\"]\n",
   "references": [
     "https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/running-remote-commands?view=powershell-7.1"
   ],
@@ -47,5 +47,5 @@
     }
   ],
   "type": "eql",
-  "version": 2
+  "version": 3
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_rdp_enabled_registry.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_rdp_enabled_registry.json
index 6b2f782e488c41..584f24cfb30f32 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_rdp_enabled_registry.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_rdp_enabled_registry.json
@@ -35,12 +35,19 @@
         {
           "id": "T1021",
           "name": "Remote Services",
-          "reference": "https://attack.mitre.org/techniques/T1021/"
+          "reference": "https://attack.mitre.org/techniques/T1021/",
+          "subtechnique": [
+            {
+              "id": "T1021.001",
+              "name": "Remote Desktop Protocol",
+              "reference": "https://attack.mitre.org/techniques/T1021/001/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 3
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_rdp_sharprdp_target.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_rdp_sharprdp_target.json
index 0318883e374d39..0e5b7e7bc90010 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_rdp_sharprdp_target.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_rdp_sharprdp_target.json
@@ -12,7 +12,7 @@
   "language": "eql",
   "license": "Elastic License v2",
   "name": "Potential SharpRDP Behavior",
-  "query": "/* Incoming RDP followed by a new RunMRU string value set to cmd, powershell, taskmgr or tsclient, followed by process execution within 1m */\n\nsequence by host.id with maxspan=1m\n  [network where event.type == \"start\" and process.name : \"svchost.exe\" and destination.port == 3389 and \n   network.direction == \"incoming\" and network.transport == \"tcp\" and\n   source.address != \"127.0.0.1\" and source.address != \"::1\"\n  ]\n\n  [registry where process.name : \"explorer.exe\" and \n   registry.path : (\"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\RunMRU\\\\*\") and\n   registry.data.strings : (\"cmd.exe*\", \"powershell.exe*\", \"taskmgr*\", \"\\\\\\\\tsclient\\\\*.exe\\\\*\")\n  ]\n  \n  [process where event.type in (\"start\", \"process_started\") and\n   (process.parent.name : (\"cmd.exe\", \"powershell.exe\", \"taskmgr.exe\") or process.args : (\"\\\\\\\\tsclient\\\\*.exe\")) and \n   not process.name : \"conhost.exe\"\n   ]\n",
+  "query": "/* Incoming RDP followed by a new RunMRU string value set to cmd, powershell, taskmgr or tsclient, followed by process execution within 1m */\n\nsequence by host.id with maxspan=1m\n  [network where event.type == \"start\" and process.name : \"svchost.exe\" and destination.port == 3389 and \n   network.direction : (\"incoming\", \"ingress\") and network.transport == \"tcp\" and\n   source.address != \"127.0.0.1\" and source.address != \"::1\"\n  ]\n\n  [registry where process.name : \"explorer.exe\" and \n   registry.path : (\"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\RunMRU\\\\*\") and\n   registry.data.strings : (\"cmd.exe*\", \"powershell.exe*\", \"taskmgr*\", \"\\\\\\\\tsclient\\\\*.exe\\\\*\")\n  ]\n  \n  [process where event.type in (\"start\", \"process_started\") and\n   (process.parent.name : (\"cmd.exe\", \"powershell.exe\", \"taskmgr.exe\") or process.args : (\"\\\\\\\\tsclient\\\\*.exe\")) and \n   not process.name : \"conhost.exe\"\n   ]\n",
   "references": [
     "https://posts.specterops.io/revisiting-remote-desktop-lateral-movement-8fb905cb46c3",
     "https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Lateral%20Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx"
@@ -39,11 +39,18 @@
         {
           "id": "T1021",
           "name": "Remote Services",
-          "reference": "https://attack.mitre.org/techniques/T1021/"
+          "reference": "https://attack.mitre.org/techniques/T1021/",
+          "subtechnique": [
+            {
+              "id": "T1021.001",
+              "name": "Remote Desktop Protocol",
+              "reference": "https://attack.mitre.org/techniques/T1021/001/"
+            }
+          ]
         }
       ]
     }
   ],
   "type": "eql",
-  "version": 2
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_remote_services.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_remote_services.json
index 88f5e0e63a0524..5220506d37f588 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_remote_services.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_remote_services.json
@@ -12,7 +12,7 @@
   "language": "eql",
   "license": "Elastic License v2",
   "name": "Remotely Started Services via RPC",
-  "query": "sequence with maxspan=1s\n   [network where process.name : \"services.exe\" and\n      network.direction == \"incoming\" and network.transport == \"tcp\" and \n      source.port >= 49152 and destination.port >= 49152 and source.address not in (\"127.0.0.1\", \"::1\")\n   ] by host.id, process.entity_id\n\n   [process where event.type in (\"start\", \"process_started\") and process.parent.name : \"services.exe\" and \n       not (process.name : \"svchost.exe\" and process.args : \"tiledatamodelsvc\") and \n       not (process.name : \"msiexec.exe\" and process.args : \"/V\")\n   \n    /* uncomment if psexec is noisy in your environment */\n    /* and not process.name : \"PSEXESVC.exe\" */\n   ] by host.id, process.parent.entity_id\n",
+  "query": "sequence with maxspan=1s\n   [network where process.name : \"services.exe\" and\n      network.direction : (\"incoming\", \"ingress\") and network.transport == \"tcp\" and \n      source.port >= 49152 and destination.port >= 49152 and source.address not in (\"127.0.0.1\", \"::1\")\n   ] by host.id, process.entity_id\n\n   [process where event.type in (\"start\", \"process_started\") and process.parent.name : \"services.exe\" and \n       not (process.name : \"svchost.exe\" and process.args : \"tiledatamodelsvc\") and \n       not (process.name : \"msiexec.exe\" and process.args : \"/V\")\n   \n    /* uncomment if psexec is noisy in your environment */\n    /* and not process.name : \"PSEXESVC.exe\" */\n   ] by host.id, process.parent.entity_id\n",
   "risk_score": 47,
   "rule_id": "aa9a274d-6b53-424d-ac5e-cb8ca4251650",
   "severity": "medium",
@@ -41,5 +41,5 @@
     }
   ],
   "type": "eql",
-  "version": 2
+  "version": 3
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_scheduled_task_target.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_scheduled_task_target.json
index b66b5a94fe27f8..b60717e61765a5 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_scheduled_task_target.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_scheduled_task_target.json
@@ -12,8 +12,8 @@
   "language": "eql",
   "license": "Elastic License v2",
   "name": "Remote Scheduled Task Creation",
-  "note": "## Triage and analysis\n\nDecode the base64 encoded tasks actions registry value to investigate the task configured action.",
-  "query": "/* Task Scheduler service incoming connection followed by TaskCache registry modification  */\n\nsequence by host.id, process.entity_id with maxspan = 1m\n   [network where process.name : \"svchost.exe\" and\n   network.direction == \"incoming\" and source.port >= 49152 and destination.port >= 49152 and\n   source.address != \"127.0.0.1\" and source.address != \"::1\"\n   ]\n   [registry where registry.path : \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Schedule\\\\TaskCache\\\\Tasks\\\\*\\\\Actions\"]\n",
+  "note": "## Triage and analysis\n\n### Investigating Creation of Remote Scheduled Tasks\n\n[Scheduled tasks](https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler) are a great mechanism used for persistence and executing programs. These features can\nbe used remotely for a variety of legitimate reasons, but at the same time used by malware and adversaries.\nWhen investigating scheduled tasks that have been set-up remotely, one of the first methods should be determining the\noriginal intent behind the configuration and verify if the activity is tied to benign behavior such as software installations or any kind\nof network administrator work. One objective for these alerts is to understand the configured action within the scheduled\ntask, this is captured within the registry event data for this rule and can be base64 decoded to view the value.\n\n#### Possible investigation steps:\n- Review the base64 encoded tasks actions registry value to investigate the task configured action.\n- Determine if task is related to legitimate or benign behavior based on the corresponding process or program tied to the\nscheduled task.\n- Further examination should include both the source and target machines where host-based artifacts and network logs\nshould be reviewed further around the time window of the creation of the scheduled task.\n\n### False Positive Analysis\n- There is a high possibility of benign activity tied to the creation of remote scheduled tasks as it is a general feature\nwithin Windows and used for legitimate purposes for a wide range of activity. Any kind of context should be found to\nfurther understand the source of the activity and determine the intent based on the scheduled task contents.\n\n### Related Rules\n- Service Command Lateral Movement\n- Remotely Started Services via RPC\n\n### Response and Remediation\n- This behavior represents post-exploitation actions such as persistence or lateral movement, immediate response should\nbe taken to review and investigate the activity and potentially isolate involved machines to prevent further post-compromise\nbehavior.\n- Remove scheduled task and any other related artifacts to the activity.\n- Review privileged account management and user account management settings such as implementing GPO policies to further\nrestrict activity or configure settings that only allow Administrators to create remote scheduled tasks.\n",
+  "query": "/* Task Scheduler service incoming connection followed by TaskCache registry modification  */\n\nsequence by host.id, process.entity_id with maxspan = 1m\n   [network where process.name : \"svchost.exe\" and\n   network.direction : (\"incoming\", \"ingress\") and source.port >= 49152 and destination.port >= 49152 and\n   source.address != \"127.0.0.1\" and source.address != \"::1\"\n   ]\n   [registry where registry.path : \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Schedule\\\\TaskCache\\\\Tasks\\\\*\\\\Actions\"]\n",
   "risk_score": 47,
   "rule_id": "954ee7c8-5437-49ae-b2d6-2960883898e9",
   "severity": "medium",
@@ -51,11 +51,18 @@
         {
           "id": "T1053",
           "name": "Scheduled Task/Job",
-          "reference": "https://attack.mitre.org/techniques/T1053/"
+          "reference": "https://attack.mitre.org/techniques/T1053/",
+          "subtechnique": [
+            {
+              "id": "T1053.005",
+              "name": "Scheduled Task",
+              "reference": "https://attack.mitre.org/techniques/T1053/005/"
+            }
+          ]
         }
       ]
     }
   ],
   "type": "eql",
-  "version": 3
+  "version": 5
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_auth_rare_user_logon.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_auth_rare_user_logon.json
index 2f0a60b3efba94..d5d055bfa1658a 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_auth_rare_user_logon.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_auth_rare_user_logon.json
@@ -3,7 +3,7 @@
   "author": [
     "Elastic"
   ],
-  "description": "A machine learning job found an unusual user name in the authentication logs. An unusual user name is one way of detecting credentialed access by means of a new or dormant user account. A user account that is normally inactive (because the user has left the organization) that becomes active may be due to credentialed access using a compromised account password. Threat actors will sometimes also create new users as a means of persisting in a compromised web application.",
+  "description": "A machine learning job found an unusual user name in the authentication logs. An unusual user name is one way of detecting credentialed access by means of a new or dormant user account. An inactive user account (because the user has left the organization) that becomes active may be due to credentialed access using a compromised account password. Threat actors will sometimes also create new users as a means of persisting in a compromised web application.",
   "false_positives": [
     "User accounts that are rarely active, such as a site reliability engineer (SRE) or developer logging into a production server for troubleshooting, may trigger this alert. Under some conditions, a newly created user account may briefly trigger this alert while the model is learning."
   ],
@@ -25,5 +25,5 @@
     "ML"
   ],
   "type": "machine_learning",
-  "version": 2
+  "version": 3
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_auth_spike_in_logon_events_from_a_source_ip.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_auth_spike_in_logon_events_from_a_source_ip.json
index 8e007c96c37fbb..ee9acc43ac8d7e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_auth_spike_in_logon_events_from_a_source_ip.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_auth_spike_in_logon_events_from_a_source_ip.json
@@ -3,7 +3,7 @@
   "author": [
     "Elastic"
   ],
-  "description": "A machine learning job found an unusually large spike in successful authentication events events from a particular source IP address. This can be due to password spraying, user enumeration or brute force activity.",
+  "description": "A machine learning job found an unusually large spike in successful authentication events from a particular source IP address. This can be due to password spraying, user enumeration or brute force activity.",
   "false_positives": [
     "Build servers and CI systems can sometimes trigger this alert. Security test cycles that include brute force or password spraying activities may trigger this alert."
   ],
@@ -25,5 +25,5 @@
     "ML"
   ],
   "type": "machine_learning",
-  "version": 1
+  "version": 2
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_error_message_spike.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_error_message_spike.json
index e9ebbf2470b53e..1b64f1d85301a5 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_error_message_spike.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_error_message_spike.json
@@ -12,7 +12,7 @@
   "license": "Elastic License v2",
   "machine_learning_job_id": "high_distinct_count_error_message",
   "name": "Spike in AWS Error Messages",
-  "note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.\n\n## Triage and analysis\n\n### Investigating Spikes in CloudTrail Errors\nDetection alerts from this rule indicate a large spike in the number of CloudTrail log messages that contain a particular error message. The error message in question was associated with the response to an AWS API command or method call. Here are some possible avenues of investigation:\n- Examine the history of the error. Has it manifested before? If the error, which is visible in the `aws.cloudtrail.error_message` field, only manifested recently, it might be related to recent changes in an automation module or script.\n- Examine the request parameters. These may provide indications as to the nature of the task being performed when the error occurred. Is the error related to unsuccessful attempts to enumerate or access objects, data, or secrets? If so, this can sometimes be a byproduct of discovery, privilege escalation or lateral movement attempts.\n- Consider the user as identified by the user.name field. Is this activity part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key id in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?",
+  "note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.\n\n## Triage and analysis\n\n### Investigating Spikes in CloudTrail Errors\n\nCloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding\nwhat is considered normal behavior within an organization, suspicious or malicious activity can be spotted when deviations\nare observed. This example rule triggers from a large spike in the number of CloudTrail log messages that contain a\nparticular error message. The error message in question was associated with the response to an AWS API command or method call,\nthis has the potential to uncover unknown threats or activity.\n\n#### Possible investigation steps:\n- Examine the history of the error. Has it manifested before? If the error, which is visible in the `aws.cloudtrail.error_message` field, only manifested recently, it might be related to recent changes in an automation module or script.\n- Examine the request parameters. These may provide indications as to the nature of the task being performed when the error occurred. Is the error related to unsuccessful attempts to enumerate or access objects, data, or secrets? If so, this can sometimes be a byproduct of discovery, privilege escalation or lateral movement attempts.\n- Consider the user as identified by the `user.name field`. Is this activity part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance that's not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?\n\n### False Positive Analysis\n- This rule has the possibility to produce false positives based on unexpected activity occurring such as bugs or recent\nchanges to automation modules or scripting.\n- Adoption of new services or implementing new functionality to scripts may generate false positives\n\n### Related Rules\n- Unusual AWS Command for a User\n- Rare AWS Error Code\n\n### Response and Remediation\n- If activity is observed as suspicious or malicious, immediate response should be looked into rotating and deleting AWS IAM access keys\n- Validate if any unauthorized new users were created, remove these accounts and request password resets for other IAM users\n- Look into enabling multi-factor authentication for users\n- Follow security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS\n",
   "references": [
     "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
   ],
@@ -26,5 +26,5 @@
     "ML"
   ],
   "type": "machine_learning",
-  "version": 6
+  "version": 7
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_rare_error_code.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_rare_error_code.json
index ac7a867f5cd6e4..d9e2b3e3587609 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_rare_error_code.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_rare_error_code.json
@@ -12,7 +12,7 @@
   "license": "Elastic License v2",
   "machine_learning_job_id": "rare_error_code",
   "name": "Rare AWS Error Code",
-  "note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.\n\n## Triage and analysis\n\nInvestigating Unusual CloudTrail Error Activity ###\nDetection alerts from this rule indicate a rare and unusual error code that was associated with the response to an AWS API command or method call. Here are some possible avenues of investigation:\n- Examine the history of the error. Has it manifested before? If the error, which is visible in the `aws.cloudtrail.error_code field`, only manifested recently, it might be related to recent changes in an automation module or script.\n- Examine the request parameters. These may provide indications as to the nature of the task being performed when the error occurred. Is the error related to unsuccessful attempts to enumerate or access objects, data, or secrets? If so, this can sometimes be a byproduct of discovery, privilege escalation, or lateral movement attempts.\n- Consider the user as identified by the `user.name` field. Is this activity part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key id in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?",
+  "note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.\n\n## Triage and analysis\n\nInvestigating Unusual CloudTrail Error Activity ###\nDetection alerts from this rule indicate a rare and unusual error code that was associated with the response to an AWS API command or method call. Here are some possible avenues of investigation:\n- Examine the history of the error. Has it manifested before? If the error, which is visible in the `aws.cloudtrail.error_code field`, only manifested recently, it might be related to recent changes in an automation module or script.\n- Examine the request parameters. These may provide indications as to the nature of the task being performed when the error occurred. Is the error related to unsuccessful attempts to enumerate or access objects, data, or secrets? If so, this can sometimes be a byproduct of discovery, privilege escalation, or lateral movement attempts.\n- Consider the user as identified by the `user.name` field. Is this activity part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance that's not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?",
   "references": [
     "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
   ],
@@ -26,5 +26,5 @@
     "ML"
   ],
   "type": "machine_learning",
-  "version": 6
+  "version": 7
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_rare_method_by_city.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_rare_method_by_city.json
index 2a31ce8c065d8a..a3d6208eb9f058 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_rare_method_by_city.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_rare_method_by_city.json
@@ -12,7 +12,7 @@
   "license": "Elastic License v2",
   "machine_learning_job_id": "rare_method_for_a_city",
   "name": "Unusual City For an AWS Command",
-  "note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.\n\n## Triage and analysis\n\n### Investigating an Unusual CloudTrail Event\nDetection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the geolocation of the source IP address. Here are some possible avenues of investigation:\n- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?\n- Consider the user as identified by the `user.name` field. Is this command part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key id in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day?\n- Examine the history of the command. If the command, which is visible in the `event.action field`, only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, if it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process.\n- Examine the request parameters. These may provide indications as to the source of the program or the nature of the tasks it is performing.",
+  "note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.\n\n## Triage and analysis\n\n### Investigating an Unusual CloudTrail Event\nDetection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the geolocation of the source IP address. Here are some possible avenues of investigation:\n- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance that's not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?\n- Consider the user as identified by the `user.name` field. Is this command part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day?\n- Examine the history of the command. If the command, which is visible in the `event.action field`, only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, if it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process.\n- Examine the request parameters. These may provide indications as to the source of the program or the nature of the tasks it is performing.",
   "references": [
     "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
   ],
@@ -26,5 +26,5 @@
     "ML"
   ],
   "type": "machine_learning",
-  "version": 6
+  "version": 7
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_rare_method_by_country.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_rare_method_by_country.json
index ebe7971e94289a..4576b080e1ea62 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_rare_method_by_country.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_rare_method_by_country.json
@@ -12,7 +12,7 @@
   "license": "Elastic License v2",
   "machine_learning_job_id": "rare_method_for_a_country",
   "name": "Unusual Country For an AWS Command",
-  "note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.\n\n## Triage and analysis\n\n### Investigating an Unusual CloudTrail Event\nDetection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the geolocation of the source IP address. Here are some possible avenues of investigation:\n- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?\n- Consider the user as identified by the `user.name` field. Is this command part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key id in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day?\n- Examine the history of the command. If the command, which is visible in the `event.action field`, only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, if it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process.\n- Examine the request parameters. These may provide indications as to the source of the program or the nature of the tasks it is performing.",
+  "note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.\n\n## Triage and analysis\n\n### Investigating an Unusual Country For an AWS Command\n\nCloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding\nwhat is considered normal behavior within an organization, suspicious or malicious activity can be spotted when deviations\nare observed. This example rule focuses on AWS command activity where the country from the source of the activity has been\nconsidered unusual based on previous history.\n\n#### Possible investigation steps:\n- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance that's not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?\n- Consider the user as identified by the `user.name` field. Is this command part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day?\n- Examine the history of the command. If the command, which is visible in the `event.action field`, only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, if it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process.\n- Examine the request parameters. These may provide indications as to the source of the program or the nature of the tasks it is performing.\n\n### False Positive Analysis\n- False positives can occur if activity is coming from new employees based in a country with no previous history in AWS,\ntherefore it's important to validate the activity listed in the investigation steps above.\n\n### Related Rules\n- Unusual City For an AWS Command\n- Unusual AWS Command for a User\n- Rare AWS Error Code\n\n### Response and Remediation\n- If activity is observed as suspicious or malicious, immediate response should be looked into rotating and deleting AWS IAM access keys\n- Validate if any unauthorized new users were created, remove these accounts and request password resets for other IAM users\n- Look into enabling multi-factor authentication for users\n- Follow security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS\n",
   "references": [
     "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
   ],
@@ -26,5 +26,5 @@
     "ML"
   ],
   "type": "machine_learning",
-  "version": 6
+  "version": 7
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_rare_method_by_user.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_rare_method_by_user.json
index ab9364c453423e..53f9fab8d1b489 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_rare_method_by_user.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_rare_method_by_user.json
@@ -12,7 +12,7 @@
   "license": "Elastic License v2",
   "machine_learning_job_id": "rare_method_for_a_username",
   "name": "Unusual AWS Command for a User",
-  "note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.\n\n## Triage and analysis\n\n### Investigating an Unusual CloudTrail Event\n\nDetection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the calling IAM user. Here are some possible avenues of investigation:\n- Consider the user as identified by the `user.name` field. Is this command part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key id in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?\n- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day?\n- Examine the history of the command. If the command, which is visible in the `event.action field`, only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, if it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process.\n- Examine the request parameters. These may provide indications as to the source of the program or the nature of the tasks it is performing.",
+  "note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.\n\n## Triage and analysis\n\n### Investigating an Unusual CloudTrail Event\n\nDetection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the calling IAM user. Here are some possible avenues of investigation:\n- Consider the user as identified by the `user.name` field. Is this command part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance that's not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?\n- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day?\n- Examine the history of the command. If the command, which is visible in the `event.action field`, only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, if it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process.\n- Examine the request parameters. These may provide indications as to the source of the program or the nature of the tasks it is performing.",
   "references": [
     "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
   ],
@@ -26,5 +26,5 @@
     "ML"
   ],
   "type": "machine_learning",
-  "version": 6
+  "version": 7
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_rare_process_by_host_windows.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_rare_process_by_host_windows.json
index 8729de9a8689d9..d8bf26884b16f1 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_rare_process_by_host_windows.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_rare_process_by_host_windows.json
@@ -15,7 +15,7 @@
     "v2_rare_process_by_host_windows_ecs"
   ],
   "name": "Unusual Process For a Windows Host",
-  "note": "## Triage and analysis\n\n### Investigating an Unusual Windows Process\nDetection alerts from this rule indicate the presence of a Windows process that is rare and unusual for the host it ran on. Here are some possible avenues of investigation:\n- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host?\n- Examine the history of execution. If this process only manifested recently, it might be part of a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business process.\n- Examine the process metadata like the values of the Company, Description and Product fields which may indicate whether the program is associated with an expected software vendor or package.\n- Examine arguments and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.\n- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.\n- If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools. ",
+  "note": "## Triage and analysis\n\n###  Investigating an Unusual Windows Process\n\nSearching for abnormal Windows processes is a good methodology to find potentially malicious activity within a network.\nBy understanding what is commonly run within an environment and developing baselines for legitimate activity can help\nuncover potential malware and suspicious behaviors.\n\n#### Possible investigation steps:\n- Consider the user as identified by the `user.name` field. Is this program part of an expected workflow for the user who ran this program on this host?\n- Examine the history of execution. If this process only manifested recently, it might be part of a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business process.\n- Examine the process metadata like the values of the Company, Description and Product fields which may indicate whether the program is associated with an expected software vendor or package.\n- Examine arguments and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.\n- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.\n- If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools.\n\n### False Positive Analysis\n- Validate the unusual Windows process is not related to new benign software installation activity. If related to\nlegitimate software, this can be done by leveraging the exception workflow in the Kibana Security App or Elasticsearch\nAPI to tune this rule to your environment\n- Try to understand the context of the execution by thinking about the user, machine, or business purpose.  It's possible that a small number of endpoints\nsuch as servers that have very unique software that might appear to be unusual, but satisfy a specific business need.\n\n### Related Rules\n- Anomalous Windows Process Creation\n- Unusual Windows Path Activity\n- Unusual Windows Process Calling the Metadata Service\n\n### Response and Remediation\n- This rule is related to process execution events and should be immediately reviewed and investigated to determine if malicious\n- Based on validation and if malicious, the impacted machine should be isolated and analyzed to determine other post-compromise\nbehavior such as setting up persistence or performing lateral movement.\n- Look into preventive measures such as Windows Defender Application Control and AppLocker to gain better control on\nwhat is allowed to run on Windows infrastructure.\n",
   "references": [
     "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
   ],
@@ -30,5 +30,5 @@
     "ML"
   ],
   "type": "machine_learning",
-  "version": 7
+  "version": 8
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_ec2_security_group_configuration_change_detection.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_ec2_security_group_configuration_change_detection.json
index a3468f4a689487..b7421934ba8e84 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_ec2_security_group_configuration_change_detection.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_ec2_security_group_configuration_change_detection.json
@@ -3,7 +3,7 @@
     "Elastic",
     "Austin Songer"
   ],
-  "description": "Identifies a change to an AWS Security Group Configuration. A security group is like a virtul firewall and modifying configurations may allow unauthorized access. Threat actors may abuse this to establish persistence, exfiltrate data, or pivot in a AWS environment.",
+  "description": "Identifies a change to an AWS Security Group Configuration. A security group is like a virtual firewall, and modifying configurations may allow unauthorized access. Threat actors may abuse this to establish persistence, exfiltrate data, or pivot in an AWS environment.",
   "false_positives": [
     "A security group may be created by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Security group creations from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule."
   ],
@@ -49,10 +49,23 @@
         "name": "Defense Evasion",
         "reference": "https://attack.mitre.org/tactics/TA0005/"
       },
-      "technique": []
+      "technique": [
+        {
+          "id": "T1562",
+          "name": "Impair Defenses",
+          "reference": "https://attack.mitre.org/techniques/T1562/",
+          "subtechnique": [
+            {
+              "id": "T1562.007",
+              "name": "Disable or Modify Cloud Firewall",
+              "reference": "https://attack.mitre.org/techniques/T1562/007/"
+            }
+          ]
+        }
+      ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 1
+  "version": 2
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_evasion_hidden_local_account_creation.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_evasion_hidden_local_account_creation.json
index 8edaef5dc72fdb..24f0f3d4d95b1e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_evasion_hidden_local_account_creation.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_evasion_hidden_local_account_creation.json
@@ -39,12 +39,19 @@
         {
           "id": "T1136",
           "name": "Create Account",
-          "reference": "https://attack.mitre.org/techniques/T1136/"
+          "reference": "https://attack.mitre.org/techniques/T1136/",
+          "subtechnique": [
+            {
+              "id": "T1136.001",
+              "name": "Local Account",
+              "reference": "https://attack.mitre.org/techniques/T1136/001/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 1
+  "version": 2
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_evasion_registry_startup_shell_folder_modified.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_evasion_registry_startup_shell_folder_modified.json
index 947c1c748af69f..21ad9c51615413 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_evasion_registry_startup_shell_folder_modified.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_evasion_registry_startup_shell_folder_modified.json
@@ -12,7 +12,7 @@
   "language": "eql",
   "license": "Elastic License v2",
   "name": "Suspicious Startup Shell Folder Modification",
-  "note": "## Triage and analysis\n\nVerify file creation events in the new Windows Startup folder location.",
+  "note": "## Triage and analysis\n\n### Investigating Suspicious Startup Shell Activity\n\nTechniques used within malware and by adversaries often leverage the Windows registry to store malicious programs for\npersistence. Startup shell folders are often targeted as they are not as prevalent as normal Startup folder paths so this\nbehavior may evade existing AV/EDR solutions. Another preference is that these programs might run with higher privileges\nwhich can be ideal for an attacker.\n\n#### Possible investigation steps:\n- Review the source process and related file tied to the Windows Registry entry\n- Validate the activity is not related to planned patches, updates, network administrator activity or legitimate software\ninstallations\n- Determine if activity is unique by validating if other machines in same organization have similar entry\n\n### False Positive Analysis\n- There is a high possibility of benign legitimate programs being added to Shell folders. This activity could be based\non new software installations, patches, or any kind of network administrator related activity. Before entering further\ninvestigation, this activity should be validated that is it not related to benign activity\n\n### Related Rules\n- Startup or Run Key Registry Modification\n- Persistent Scripts in the Startup Directory\n\n### Response and Remediation\n- Activity should first be validated as a true positive event if so then immediate response should be taken to review,\ninvestigate and potentially isolate activity to prevent further post-compromise behavior\n- The respective binary or program tied to this persistence method should be further analyzed and reviewed to understand\nit's behavior and capabilities\n- Since this activity is considered post-exploitation behavior, it's important to understand how the behavior was first\ninitialized such as through a macro-enabled document that was attached in a phishing email. By understanding the source\nof the attack, this information can then be used to search for similar indicators on other machines in the same environment.\n",
   "query": "registry where\n registry.path : (\n     \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\\\\Common Startup\",\n     \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\\\Common Startup\",\n     \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\\\\Startup\",\n     \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\\\Startup\"\n     ) and\n  registry.data.strings != null and\n  /* Normal Startup Folder Paths */\n  not registry.data.strings : (\n           \"C:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\",\n           \"%ProgramData%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\",\n           \"%USERPROFILE%\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\",\n           \"C:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\"\n           )\n",
   "risk_score": 73,
   "rule_id": "c8b150f0-0164-475b-a75e-74b47800a9ff",
@@ -50,5 +50,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 1
+  "version": 2
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_exchange_suspicious_mailbox_right_delegation.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_exchange_suspicious_mailbox_right_delegation.json
new file mode 100644
index 00000000000000..e950569f19878b
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_exchange_suspicious_mailbox_right_delegation.json
@@ -0,0 +1,57 @@
+{
+  "author": [
+    "Elastic",
+    "Austin Songer"
+  ],
+  "description": "Identifies the assignment of rights to accesss content from another mailbox. An adversary may use the compromised account to send messages to other accounts in the network of the target business while creating inbox rules, so messages can evade spam/phishing detection mechanisms.",
+  "false_positives": [
+    "Assignment of rights to a service account."
+  ],
+  "index": [
+    "filebeat-*",
+    "logs-o365*"
+  ],
+  "language": "kuery",
+  "license": "Elastic License v2",
+  "name": "O365 Exchange Suspicious Mailbox Right Delegation",
+  "note": "## Config\n\nThe Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
+  "query": "event.dataset:o365.audit and event.provider:Exchange and event.action:Add-MailboxPermission and \no365.audit.Parameters.AccessRights:(FullAccess or SendAs or SendOnBehalf) and event.outcome:success\n",
+  "risk_score": 21,
+  "rule_id": "0ce6487d-8069-4888-9ddd-61b52490cebc",
+  "severity": "low",
+  "tags": [
+    "Elastic",
+    "Cloud",
+    "Microsoft 365",
+    "Continuous Monitoring",
+    "SecOps",
+    "Configuration Audit"
+  ],
+  "threat": [
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0003",
+        "name": "Persistence",
+        "reference": "https://attack.mitre.org/tactics/TA0003/"
+      },
+      "technique": [
+        {
+          "id": "T1098",
+          "name": "Account Manipulation",
+          "reference": "https://attack.mitre.org/techniques/T1098/",
+          "subtechnique": [
+            {
+              "id": "T1098.002",
+              "name": "Exchange Email Delegate Permissions",
+              "reference": "https://attack.mitre.org/techniques/T1098/002/"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "timestamp_override": "event.ingested",
+  "type": "query",
+  "version": 1
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_gpo_schtask_service_creation.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_gpo_schtask_service_creation.json
index 86b1cd3e71eaf4..ebbe2448c75df7 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_gpo_schtask_service_creation.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_gpo_schtask_service_creation.json
@@ -35,12 +35,19 @@
         {
           "id": "T1053",
           "name": "Scheduled Task/Job",
-          "reference": "https://attack.mitre.org/techniques/T1053/"
+          "reference": "https://attack.mitre.org/techniques/T1053/",
+          "subtechnique": [
+            {
+              "id": "T1053.005",
+              "name": "Scheduled Task",
+              "reference": "https://attack.mitre.org/techniques/T1053/005/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 5
+  "version": 6
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_local_scheduled_job_creation.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_local_scheduled_job_creation.json
index 6e656209fd055e..60afcad90333c3 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_local_scheduled_job_creation.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_local_scheduled_job_creation.json
@@ -38,12 +38,19 @@
         {
           "id": "T1053",
           "name": "Scheduled Task/Job",
-          "reference": "https://attack.mitre.org/techniques/T1053/"
+          "reference": "https://attack.mitre.org/techniques/T1053/",
+          "subtechnique": [
+            {
+              "id": "T1053.005",
+              "name": "Scheduled Task",
+              "reference": "https://attack.mitre.org/techniques/T1053/005/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 1
+  "version": 2
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_local_scheduled_task_scripting.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_local_scheduled_task_scripting.json
index 712e98d4ac941b..128fdd9de5575e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_local_scheduled_task_scripting.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_local_scheduled_task_scripting.json
@@ -39,11 +39,18 @@
         {
           "id": "T1053",
           "name": "Scheduled Task/Job",
-          "reference": "https://attack.mitre.org/techniques/T1053/"
+          "reference": "https://attack.mitre.org/techniques/T1053/",
+          "subtechnique": [
+            {
+              "id": "T1053.005",
+              "name": "Scheduled Task",
+              "reference": "https://attack.mitre.org/techniques/T1053/005/"
+            }
+          ]
         }
       ]
     }
   ],
   "type": "eql",
-  "version": 3
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_persistence_powershell_exch_mailbox_activesync_add_device.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_powershell_exch_mailbox_activesync_add_device.json
similarity index 72%
rename from x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_persistence_powershell_exch_mailbox_activesync_add_device.json
rename to x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_powershell_exch_mailbox_activesync_add_device.json
index 9a494a13fa2971..75044e20ca5fd6 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_persistence_powershell_exch_mailbox_activesync_add_device.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_powershell_exch_mailbox_activesync_add_device.json
@@ -28,31 +28,33 @@
     "Host",
     "Windows",
     "Threat Detection",
-    "Collection"
+    "Persistence"
   ],
   "threat": [
     {
       "framework": "MITRE ATT&CK",
       "tactic": {
-        "id": "TA0009",
-        "name": "Collection",
-        "reference": "https://attack.mitre.org/tactics/TA0009/"
+        "id": "TA0003",
+        "name": "Persistence",
+        "reference": "https://attack.mitre.org/tactics/TA0003/"
       },
       "technique": [
         {
-          "id": "T1114",
-          "name": "Email Collection",
-          "reference": "https://attack.mitre.org/techniques/T1114/"
-        },
-        {
-          "id": "T1005",
-          "name": "Data from Local System",
-          "reference": "https://attack.mitre.org/techniques/T1005/"
+          "id": "T1098",
+          "name": "Account Manipulation",
+          "reference": "https://attack.mitre.org/techniques/T1098/",
+          "subtechnique": [
+            {
+              "id": "T1098.002",
+              "name": "Exchange Email Delegate Permissions",
+              "reference": "https://attack.mitre.org/techniques/T1098/002/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 4
+  "version": 5
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_rds_instance_creation.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_rds_instance_creation.json
index aa2c946d3a0013..4ea6631025c118 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_rds_instance_creation.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_rds_instance_creation.json
@@ -1,6 +1,7 @@
 {
   "author": [
-    "Elastic"
+    "Elastic",
+    "Austin Songer"
   ],
   "description": "Identifies the creation of an Amazon Relational Database Service (RDS) Aurora database instance.",
   "false_positives": [
@@ -44,5 +45,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 1
+  "version": 2
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_registry_uncommon.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_registry_uncommon.json
index 7629ee4b821da2..2b94ded55e7d4e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_registry_uncommon.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_registry_uncommon.json
@@ -34,7 +34,20 @@
         "name": "Persistence",
         "reference": "https://attack.mitre.org/tactics/TA0003/"
       },
-      "technique": []
+      "technique": [
+        {
+          "id": "T1547",
+          "name": "Boot or Logon Autostart Execution",
+          "reference": "https://attack.mitre.org/techniques/T1547/",
+          "subtechnique": [
+            {
+              "id": "T1547.001",
+              "name": "Registry Run Keys / Startup Folder",
+              "reference": "https://attack.mitre.org/techniques/T1547/001/"
+            }
+          ]
+        }
+      ]
     },
     {
       "framework": "MITRE ATT&CK",
@@ -54,5 +67,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 3
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_route_table_modified_or_deleted.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_route_table_modified_or_deleted.json
new file mode 100644
index 00000000000000..54180a3a59a548
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_route_table_modified_or_deleted.json
@@ -0,0 +1,55 @@
+{
+  "author": [
+    "Elastic",
+    "Austin Songer"
+  ],
+  "description": "Identifies when an AWS Route Table has been modified or deleted.",
+  "false_positives": [
+    "Route Table could be modified or deleted by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Route Table being modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.  Also automated processes that uses Terraform may lead to false positives."
+  ],
+  "from": "now-60m",
+  "index": [
+    "filebeat-*",
+    "logs-aws*"
+  ],
+  "interval": "10m",
+  "language": "kuery",
+  "license": "Elastic License v2",
+  "name": "AWS Route Table Modified or Deleted",
+  "note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
+  "query": "event.dataset:aws.cloudtrail and event.provider:cloudtrail.amazonaws.com and event.action:(ReplaceRoute or ReplaceRouteTableAssociation or\nDeleteRouteTable or DeleteRoute or DisassociateRouteTable) and event.outcome:success\n",
+  "references": [
+    "https://github.com/easttimor/aws-incident-response#network-routing",
+    "https://docs.datadoghq.com/security_platform/default_rules/cloudtrail-aws-route-table-modified",
+    "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceRoute.html",
+    "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceRouteTableAssociation",
+    "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteRouteTable.html",
+    "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteRoute.html",
+    "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateRouteTable.html"
+  ],
+  "risk_score": 21,
+  "rule_id": "e7cd5982-17c8-4959-874c-633acde7d426",
+  "severity": "low",
+  "tags": [
+    "Elastic",
+    "Cloud",
+    "AWS",
+    "Continuous Monitoring",
+    "SecOps",
+    "Network Security"
+  ],
+  "threat": [
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0003",
+        "name": "Persistence",
+        "reference": "https://attack.mitre.org/tactics/TA0003/"
+      },
+      "technique": []
+    }
+  ],
+  "timestamp_override": "event.ingested",
+  "type": "query",
+  "version": 1
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_screensaver_engine_unexpected_child_process.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_screensaver_engine_unexpected_child_process.json
new file mode 100644
index 00000000000000..544049d2c2df11
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_screensaver_engine_unexpected_child_process.json
@@ -0,0 +1,50 @@
+{
+  "author": [
+    "Elastic"
+  ],
+  "description": "Identifies when a child process is spawned by the screensaver engine process, which is consistent with an attacker's malicious payload being executed after the screensaver activated on the endpoint. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated.",
+  "from": "now-9m",
+  "index": [
+    "auditbeat-*",
+    "logs-endpoint.events.*"
+  ],
+  "language": "eql",
+  "license": "Elastic License v2",
+  "name": "Unexpected Child Process of macOS Screensaver Engine",
+  "note": "## Triage and analysis\n\n- Analyze the descendant processes of the ScreenSaverEngine process for malicious code and suspicious behavior such\nas downloading a payload from a server\n- Review the installed and activated screensaver on the host. Triage the screensaver (.saver) file that was triggered to\nidentify whether the file is malicious or not.\n",
+  "query": "process where event.type == \"start\" and process.parent.name == \"ScreenSaverEngine\"\n",
+  "references": [
+    "https://posts.specterops.io/saving-your-access-d562bf5bf90b",
+    "https://github.com/D00MFist/PersistentJXA"
+  ],
+  "risk_score": 47,
+  "rule_id": "48d7f54d-c29e-4430-93a9-9db6b5892270",
+  "severity": "medium",
+  "tags": [
+    "Elastic",
+    "Host",
+    "macOS",
+    "Threat Detection",
+    "Persistence"
+  ],
+  "threat": [
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0003",
+        "name": "Persistence",
+        "reference": "https://attack.mitre.org/tactics/TA0003/"
+      },
+      "technique": [
+        {
+          "id": "T1546",
+          "name": "Event Triggered Execution",
+          "reference": "https://attack.mitre.org/techniques/T1546/"
+        }
+      ]
+    }
+  ],
+  "timestamp_override": "event.ingested",
+  "type": "eql",
+  "version": 1
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_screensaver_plist_file_modification.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_screensaver_plist_file_modification.json
new file mode 100644
index 00000000000000..dcd7427d7cbcda
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_screensaver_plist_file_modification.json
@@ -0,0 +1,50 @@
+{
+  "author": [
+    "Elastic"
+  ],
+  "description": "Identifies when a screensaver plist file is modified by an unexpected process. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated.",
+  "from": "now-9m",
+  "index": [
+    "auditbeat-*",
+    "logs-endpoint.events.*"
+  ],
+  "language": "eql",
+  "license": "Elastic License v2",
+  "name": "Screensaver Plist File Modified by Unexpected Process",
+  "note": "## Triage and analysis\n\n- Analyze the plist file modification event to identify whether the change was expected or not\n- Investigate the process that modified the plist file for malicious code or other suspicious behavior\n- Identify if any suspicious or known malicious screensaver (.saver) files were recently written to or modified on the host",
+  "query": "file where event.type != \"deletion\" and\n  file.name: \"com.apple.screensaver.*.plist\" and\n  file.path : (\n    \"/Users/*/Library/Preferences/ByHost/*\",\n    \"/Library/Managed Preferences/*\",\n    \"/System/Library/Preferences/*\"\n    ) and\n  /* Filter OS processes modifying screensaver plist files */\n  not process.executable : (\n    \"/usr/sbin/cfprefsd\",\n    \"/usr/libexec/xpcproxy\",\n    \"/System/Library/CoreServices/ManagedClient.app/Contents/Resources/MCXCompositor\",\n    \"/System/Library/CoreServices/ManagedClient.app/Contents/MacOS/ManagedClient\"\n    )\n",
+  "references": [
+    "https://posts.specterops.io/saving-your-access-d562bf5bf90b",
+    "https://github.com/D00MFist/PersistentJXA"
+  ],
+  "risk_score": 47,
+  "rule_id": "e6e8912f-283f-4d0d-8442-e0dcaf49944b",
+  "severity": "medium",
+  "tags": [
+    "Elastic",
+    "Host",
+    "macOS",
+    "Threat Detection",
+    "Persistence"
+  ],
+  "threat": [
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0003",
+        "name": "Persistence",
+        "reference": "https://attack.mitre.org/tactics/TA0003/"
+      },
+      "technique": [
+        {
+          "id": "T1546",
+          "name": "Event Triggered Execution",
+          "reference": "https://attack.mitre.org/techniques/T1546/"
+        }
+      ]
+    }
+  ],
+  "timestamp_override": "event.ingested",
+  "type": "eql",
+  "version": 1
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_suspicious_scheduled_task_runtime.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_suspicious_scheduled_task_runtime.json
index ea5917a246afe6..812c35350677f8 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_suspicious_scheduled_task_runtime.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_suspicious_scheduled_task_runtime.json
@@ -38,12 +38,19 @@
         {
           "id": "T1053",
           "name": "Scheduled Task/Job",
-          "reference": "https://attack.mitre.org/techniques/T1053/"
+          "reference": "https://attack.mitre.org/techniques/T1053/",
+          "subtechnique": [
+            {
+              "id": "T1053.005",
+              "name": "Scheduled Task",
+              "reference": "https://attack.mitre.org/techniques/T1053/005/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 3
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_user_account_added_to_privileged_group_ad.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_user_account_added_to_privileged_group_ad.json
index c63d96b106a019..1e55f014806f30 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_user_account_added_to_privileged_group_ad.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_user_account_added_to_privileged_group_ad.json
@@ -36,21 +36,14 @@
       },
       "technique": [
         {
-          "id": "T1136",
-          "name": "Create Account",
-          "reference": "https://attack.mitre.org/techniques/T1136/",
-          "subtechnique": [
-            {
-              "id": "T1136.001",
-              "name": "Local Account",
-              "reference": "https://attack.mitre.org/techniques/T1136/001/"
-            }
-          ]
+          "id": "T1098",
+          "name": "Account Manipulation",
+          "reference": "https://attack.mitre.org/techniques/T1098/"
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 2
+  "version": 3
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_user_account_creation.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_user_account_creation.json
index 0e2b01a1967d28..0777dfccab4bfe 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_user_account_creation.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_user_account_creation.json
@@ -35,12 +35,19 @@
         {
           "id": "T1136",
           "name": "Create Account",
-          "reference": "https://attack.mitre.org/techniques/T1136/"
+          "reference": "https://attack.mitre.org/techniques/T1136/",
+          "subtechnique": [
+            {
+              "id": "T1136.001",
+              "name": "Local Account",
+              "reference": "https://attack.mitre.org/techniques/T1136/001/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 8
+  "version": 9
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_telemetrycontroller_scheduledtask_hijack.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_telemetrycontroller_scheduledtask_hijack.json
index dca20728b40fa7..0d9cd0cb4020a4 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_telemetrycontroller_scheduledtask_hijack.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_telemetrycontroller_scheduledtask_hijack.json
@@ -38,12 +38,19 @@
         {
           "id": "T1053",
           "name": "Scheduled Task/Job",
-          "reference": "https://attack.mitre.org/techniques/T1053/"
+          "reference": "https://attack.mitre.org/techniques/T1053/",
+          "subtechnique": [
+            {
+              "id": "T1053.005",
+              "name": "Scheduled Task",
+              "reference": "https://attack.mitre.org/techniques/T1053/005/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 5
+  "version": 6
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_windows_management_instrumentation_event_subscription.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_windows_management_instrumentation_event_subscription.json
index fc3d94498d0cba..79e887a548bcb1 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_windows_management_instrumentation_event_subscription.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_windows_management_instrumentation_event_subscription.json
@@ -35,12 +35,19 @@
         {
           "id": "T1546",
           "name": "Event Triggered Execution",
-          "reference": "https://attack.mitre.org/techniques/T1546/"
+          "reference": "https://attack.mitre.org/techniques/T1546/",
+          "subtechnique": [
+            {
+              "id": "T1546.003",
+              "name": "Windows Management Instrumentation Event Subscription",
+              "reference": "https://attack.mitre.org/techniques/T1546/003/"
+            }
+          ]
         }
       ]
     }
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 3
+  "version": 4
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_webshell_detection.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_webshell_detection.json
index 26248009f5a49e..8da3be0b69d910 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_webshell_detection.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_webshell_detection.json
@@ -4,7 +4,7 @@
   ],
   "description": "Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access.",
   "false_positives": [
-    "Security audits, maintenance and network administrative scripts may trigger this alert when run under web processes."
+    "Security audits, maintenance, and network administrative scripts may trigger this alert when run under web processes."
   ],
   "from": "now-9m",
   "index": [
@@ -71,5 +71,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 1
+  "version": 2
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_new_or_modified_federation_domain.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_new_or_modified_federation_domain.json
new file mode 100644
index 00000000000000..2a1231e96d8a57
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_new_or_modified_federation_domain.json
@@ -0,0 +1,61 @@
+{
+  "author": [
+    "Austin Songer"
+  ],
+  "description": "Identifies a new or modified federation domain, which can be used to create a trust between O365 and an external identity provider.",
+  "index": [
+    "filebeat-*",
+    "logs-o365*"
+  ],
+  "language": "kuery",
+  "license": "Elastic License v2",
+  "name": "New or Modified Federation Domain",
+  "note": "## Config\n\nThe Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
+  "query": "event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:(\"Set-AcceptedDomain\" or \n\"Set-MsolDomainFederationSettings\" or \"Add-FederatedDomain\" or \"New-AcceptedDomain\" or \"Remove-AcceptedDomain\" or \"Remove-FederatedDomain\") and \nevent.outcome:success\n",
+  "references": [
+    "https://docs.microsoft.com/en-us/powershell/module/exchange/remove-accepteddomain?view=exchange-ps",
+    "https://docs.microsoft.com/en-us/powershell/module/exchange/remove-federateddomain?view=exchange-ps",
+    "https://docs.microsoft.com/en-us/powershell/module/exchange/new-accepteddomain?view=exchange-ps",
+    "https://docs.microsoft.com/en-us/powershell/module/exchange/add-federateddomain?view=exchange-ps",
+    "https://docs.microsoft.com/en-us/powershell/module/exchange/set-accepteddomain?view=exchange-ps",
+    "https://docs.microsoft.com/en-us/powershell/module/msonline/set-msoldomainfederationsettings?view=azureadps-1.0"
+  ],
+  "risk_score": 21,
+  "rule_id": "684554fc-0777-47ce-8c9b-3d01f198d7f8",
+  "severity": "low",
+  "tags": [
+    "Elastic",
+    "Cloud",
+    "Microsoft 365",
+    "Continuous Monitoring",
+    "SecOps",
+    "Identity and Access"
+  ],
+  "threat": [
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0004",
+        "name": "Privilege Escalation",
+        "reference": "https://attack.mitre.org/tactics/TA0004/"
+      },
+      "technique": [
+        {
+          "id": "T1484",
+          "name": "Domain Policy Modification",
+          "reference": "https://attack.mitre.org/techniques/T1484/",
+          "subtechnique": [
+            {
+              "id": "T1484.002",
+              "name": "Domain Trust Modification",
+              "reference": "https://attack.mitre.org/techniques/T1484/002/"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "timestamp_override": "event.ingested",
+  "type": "query",
+  "version": 1
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_sts_getsessiontoken_abuse.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_sts_getsessiontoken_abuse.json
new file mode 100644
index 00000000000000..c5e2669c1faded
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_sts_getsessiontoken_abuse.json
@@ -0,0 +1,74 @@
+{
+  "author": [
+    "Austin Songer"
+  ],
+  "description": "Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.",
+  "false_positives": [
+    "GetSessionToken may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. GetSessionToken from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule."
+  ],
+  "index": [
+    "filebeat-*",
+    "logs-aws*"
+  ],
+  "language": "kuery",
+  "license": "Elastic License v2",
+  "name": "AWS STS GetSessionToken Abuse",
+  "note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
+  "query": "event.dataset:aws.cloudtrail and event.provider:sts.amazonaws.com and event.action:GetSessionToken and \naws.cloudtrail.user_identity.type:IAMUser and event.outcome:success\n",
+  "references": [
+    "https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html"
+  ],
+  "risk_score": 21,
+  "rule_id": "b45ab1d2-712f-4f01-a751-df3826969807",
+  "severity": "low",
+  "tags": [
+    "Elastic",
+    "Cloud",
+    "AWS",
+    "Continuous Monitoring",
+    "SecOps",
+    "Identity and Access"
+  ],
+  "threat": [
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0004",
+        "name": "Privilege Escalation",
+        "reference": "https://attack.mitre.org/tactics/TA0004/"
+      },
+      "technique": [
+        {
+          "id": "T1548",
+          "name": "Abuse Elevation Control Mechanism",
+          "reference": "https://attack.mitre.org/techniques/T1548/"
+        }
+      ]
+    },
+    {
+      "framework": "MITRE ATT&CK",
+      "tactic": {
+        "id": "TA0008",
+        "name": "Lateral Movement",
+        "reference": "https://attack.mitre.org/tactics/TA0008/"
+      },
+      "technique": [
+        {
+          "id": "T1550",
+          "name": "Use Alternate Authentication Material",
+          "reference": "https://attack.mitre.org/techniques/T1550/",
+          "subtechnique": [
+            {
+              "id": "T1550.001",
+              "name": "Application Access Token",
+              "reference": "https://attack.mitre.org/techniques/T1550/001/"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "timestamp_override": "event.ingested",
+  "type": "query",
+  "version": 1
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_unusual_parentchild_relationship.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_unusual_parentchild_relationship.json
index 9cdf474efb4504..d9b7280392f389 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_unusual_parentchild_relationship.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_unusual_parentchild_relationship.json
@@ -14,7 +14,7 @@
   "name": "Unusual Parent-Child Relationship",
   "query": "process where event.type in (\"start\", \"process_started\") and\nprocess.parent.name != null and\n (\n   /* suspicious parent processes */\n   (process.name:\"autochk.exe\" and not process.parent.name:\"smss.exe\") or\n   (process.name:(\"fontdrvhost.exe\", \"dwm.exe\") and not process.parent.name:(\"wininit.exe\", \"winlogon.exe\")) or\n   (process.name:(\"consent.exe\", \"RuntimeBroker.exe\", \"TiWorker.exe\") and not process.parent.name:\"svchost.exe\") or\n   (process.name:\"SearchIndexer.exe\" and not process.parent.name:\"services.exe\") or\n   (process.name:\"SearchProtocolHost.exe\" and not process.parent.name:(\"SearchIndexer.exe\", \"dllhost.exe\")) or\n   (process.name:\"dllhost.exe\" and not process.parent.name:(\"services.exe\", \"svchost.exe\")) or\n   (process.name:\"smss.exe\" and not process.parent.name:(\"System\", \"smss.exe\")) or\n   (process.name:\"csrss.exe\" and not process.parent.name:(\"smss.exe\", \"svchost.exe\")) or\n   (process.name:\"wininit.exe\" and not process.parent.name:\"smss.exe\") or\n   (process.name:\"winlogon.exe\" and not process.parent.name:\"smss.exe\") or\n   (process.name:(\"lsass.exe\", \"LsaIso.exe\") and not process.parent.name:\"wininit.exe\") or\n   (process.name:\"LogonUI.exe\" and not process.parent.name:(\"wininit.exe\", \"winlogon.exe\")) or\n   (process.name:\"services.exe\" and not process.parent.name:\"wininit.exe\") or\n   (process.name:\"svchost.exe\" and not process.parent.name:(\"MsMpEng.exe\", \"services.exe\")) or\n   (process.name:\"spoolsv.exe\" and not process.parent.name:\"services.exe\") or\n   (process.name:\"taskhost.exe\" and not process.parent.name:(\"services.exe\", \"svchost.exe\")) or\n   (process.name:\"taskhostw.exe\" and not process.parent.name:(\"services.exe\", \"svchost.exe\")) or\n   (process.name:\"userinit.exe\" and not process.parent.name:(\"dwm.exe\", \"winlogon.exe\")) or\n   (process.name:(\"wmiprvse.exe\", \"wsmprovhost.exe\", \"winrshost.exe\") and not process.parent.name:\"svchost.exe\") or\n   /* suspicious child processes */\n   (process.parent.name:(\"SearchProtocolHost.exe\", \"taskhost.exe\", \"csrss.exe\") and not process.name:(\"werfault.exe\", \"wermgr.exe\", \"WerFaultSecure.exe\")) or\n   (process.parent.name:\"autochk.exe\" and not process.name:(\"chkdsk.exe\", \"doskey.exe\", \"WerFault.exe\")) or\n   (process.parent.name:\"smss.exe\" and not process.name:(\"autochk.exe\", \"smss.exe\", \"csrss.exe\", \"wininit.exe\", \"winlogon.exe\", \"setupcl.exe\", \"WerFault.exe\")) or\n   (process.parent.name:\"wermgr.exe\" and not process.name:(\"WerFaultSecure.exe\", \"wermgr.exe\", \"WerFault.exe\")) or\n   (process.parent.name:\"conhost.exe\" and not process.name:(\"mscorsvw.exe\", \"wermgr.exe\", \"WerFault.exe\", \"WerFaultSecure.exe\"))\n  )\n",
   "references": [
-    "https://github.com/sbousseaden/Slides/blob/master/Hunting MindMaps/PNG/Windows Processes%20TH.map.png",
+    "https://github.com/sbousseaden/Slides/blob/master/Hunting%20MindMaps/PNG/Windows%20Processes%20TH.map.png",
     "https://www.andreafortuna.org/2017/06/15/standard-windows-processes-a-brief-reference/"
   ],
   "risk_score": 47,
@@ -53,5 +53,5 @@
   ],
   "timestamp_override": "event.ingested",
   "type": "eql",
-  "version": 9
+  "version": 10
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/threat_intel_module_match.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/threat_intel_module_match.json
index f582eba053d646..e4b1309c426442 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/threat_intel_module_match.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/threat_intel_module_match.json
@@ -16,7 +16,7 @@
   "language": "kuery",
   "license": "Elastic License v2",
   "name": "Threat Intel Filebeat Module Indicator Match",
-  "note": "## Triage and Analysis\n\nIf an indicator matches a local observation, the following enriched fields will be generated to identify the indicator, field, and type matched.\n\n- `threatintel.indicator.matched.atomic` - this identifies the atomic indicator that matched the local observation\n- `threatintel.indicator.matched.field` - this identifies the indicator field that matched the local observation\n- `threatintel.indicator.matched.type` - this identifies the indicator type that matched the local observation\n",
+  "note": "## Triage and Analysis\n\n### Investigating Threat Intel Indicator Matches\n\nThreat Intel indicator match rules allow matching from a local observation such as an endpoint event that records a file\nhash with an entry of a file hash stored within the Threat Intel Filebeat module. Other examples of matches can occur on\nan IP address, registry path, URL and imphash.\n\nThe matches will be based on the incoming feed data so it's important to validate the data and review the results by\ninvestigating the associated activity to determine if it requires further investigation.\n\nIf an indicator matches a local observation, the following enriched fields will be generated to identify the indicator, field, and type matched.\n\n- `threatintel.indicator.matched.atomic` - this identifies the atomic indicator that matched the local observation\n- `threatintel.indicator.matched.field` - this identifies the indicator field that matched the local observation\n- `threatintel.indicator.matched.type` - this identifies the indicator type that matched the local observation\n\n#### Possible investigation steps:\n- Investigation should be validated and reviewed based on the data (file hash, registry path, URL, imphash) that was matched\nand viewing the source of that activity.\n- Consider the history of the indicator that was matched. Has it happened before? Is it happening on multiple machines?\nThese kinds of questions can help understand if the activity is related to legitimate behavior.\n- Consider the user and their role within the company, is this something related to their job or work function?\n\n### False Positive Analysis\n- For any matches found, it's important to consider the initial release date of that indicator. Threat intelligence can\nbe a great tool for augmenting existing security processes, while at the same time it should be understood that threat\nintelligence can represent a specific set of activity observed at a point in time. For example, an IP address\nmay have hosted malware observed in a Dridex campaign six months ago, but it's possible that IP has been remediated and\nno longer represents any threat.\n- Adversaries often use legitimate tools as network administrators such as `PsExec` or `AdFind`, these tools often find their\nway into indicator lists creating the potential for false positives.\n- It's possible after large and publicly written campaigns, curious employees might end up going directly to attacker infrastructure and generating these rules\n\n### Response and Remediation\n- If suspicious or malicious behavior is observed, immediate response should be taken to isolate activity to prevent further\npost-compromise behavior.\n- One example of a response if a machine matched a command and control IP address would be to add an entry to a network\ndevice such as a firewall or proxy appliance to prevent any outbound activity from leaving that machine.\n- Another example of a response with a malicious file hash match would involve validating if the file was properly quarantined,\nreview current running processes looking for any abnormal activity, and investigating for any other follow-up actions such as persistence or lateral movement\n",
   "query": "file.hash.*:* or file.pe.imphash:* or source.ip:* or destination.ip:* or url.full:* or registry.path:*\n",
   "references": [
     "https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html"
@@ -190,9 +190,9 @@
       ]
     }
   ],
-  "threat_query": "event.module:threatintel and (threatintel.indicator.file.hash.*:* or threatintel.indicator.file.pe.imphash:* or threatintel.indicator.ip:* or threatintel.indicator.registry.path:* or threatintel.indicator.url.full:*)",
+  "threat_query": "@timestamp >= \"now-30d\" and event.module:threatintel and (threatintel.indicator.file.hash.*:* or threatintel.indicator.file.pe.imphash:* or threatintel.indicator.ip:* or threatintel.indicator.registry.path:* or threatintel.indicator.url.full:*)",
   "timeline_id": "495ad7a7-316e-4544-8a0f-9c098daee76e",
   "timeline_title": "Generic Threat Match Timeline",
   "type": "threat_match",
-  "version": 1
+  "version": 2
 }

From b64604ac890f5bedd4ec68c27e84f32c3fa35510 Mon Sep 17 00:00:00 2001
From: Dmitry Shevchenko <dmshevch@gmail.com>
Date: Thu, 14 Oct 2021 10:09:45 +0200
Subject: [PATCH 41/71] Implement hybrid approach to writing rule execution
 event logs (#114852)

---
 .../event_log_adapter/event_log_adapter.ts    | 56 ++++++++++++-------
 .../rule_execution_log_client.ts              |  2 +-
 2 files changed, 37 insertions(+), 21 deletions(-)

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/event_log_adapter/event_log_adapter.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/event_log_adapter/event_log_adapter.ts
index 6b1a0cd5b18d0c..086cc12788a40a 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/event_log_adapter/event_log_adapter.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/event_log_adapter/event_log_adapter.ts
@@ -5,7 +5,10 @@
  * 2.0.
  */
 
+import { sum } from 'lodash';
+import { SavedObjectsClientContract } from '../../../../../../../../src/core/server';
 import { IEventLogService } from '../../../../../../event_log/server';
+import { SavedObjectsAdapter } from '../saved_objects_adapter/saved_objects_adapter';
 import {
   FindBulkExecutionLogArgs,
   FindExecutionLogArgs,
@@ -18,21 +21,32 @@ import { EventLogClient } from './event_log_client';
 
 export class EventLogAdapter implements IRuleExecutionLogClient {
   private eventLogClient: EventLogClient;
+  /**
+   * @deprecated Saved objects adapter is used during the transition period while the event log doesn't support all features needed to implement the execution log.
+   * We use savedObjectsAdapter to write/read the latest rule execution status and eventLogClient to read/write historical execution data.
+   * We can remove savedObjectsAdapter as soon as the event log supports all methods that we need (find, findBulk).
+   */
+  private savedObjectsAdapter: IRuleExecutionLogClient;
 
-  constructor(eventLogService: IEventLogService) {
+  constructor(eventLogService: IEventLogService, savedObjectsClient: SavedObjectsClientContract) {
     this.eventLogClient = new EventLogClient(eventLogService);
+    this.savedObjectsAdapter = new SavedObjectsAdapter(savedObjectsClient);
   }
 
-  public async find({ ruleId, logsCount = 1, spaceId }: FindExecutionLogArgs) {
-    return []; // TODO Implement
+  public async find(args: FindExecutionLogArgs) {
+    return this.savedObjectsAdapter.find(args);
   }
 
-  public async findBulk({ ruleIds, logsCount = 1, spaceId }: FindBulkExecutionLogArgs) {
-    return {}; // TODO Implement
+  public async findBulk(args: FindBulkExecutionLogArgs) {
+    return this.savedObjectsAdapter.findBulk(args);
   }
 
-  public async update({ attributes, spaceId, ruleName, ruleType }: UpdateExecutionLogArgs) {
-    // execution events are immutable, so we just log a status change istead of updating previous
+  public async update(args: UpdateExecutionLogArgs) {
+    const { attributes, spaceId, ruleName, ruleType } = args;
+
+    await this.savedObjectsAdapter.update(args);
+
+    // EventLog execution events are immutable, so we just log a status change istead of updating previous
     if (attributes.status) {
       this.eventLogClient.logStatusChange({
         ruleName,
@@ -45,16 +59,15 @@ export class EventLogAdapter implements IRuleExecutionLogClient {
   }
 
   public async delete(id: string) {
-    // execution events are immutable, nothing to do here
+    await this.savedObjectsAdapter.delete(id);
+
+    // EventLog execution events are immutable, nothing to do here
   }
 
-  public async logExecutionMetrics({
-    ruleId,
-    spaceId,
-    ruleType,
-    ruleName,
-    metrics,
-  }: LogExecutionMetricsArgs) {
+  public async logExecutionMetrics(args: LogExecutionMetricsArgs) {
+    const { ruleId, spaceId, ruleType, ruleName, metrics } = args;
+    await this.savedObjectsAdapter.logExecutionMetrics(args);
+
     this.eventLogClient.logExecutionMetrics({
       ruleId,
       ruleName,
@@ -62,16 +75,19 @@ export class EventLogAdapter implements IRuleExecutionLogClient {
       spaceId,
       metrics: {
         executionGapDuration: metrics.executionGap?.asSeconds(),
-        totalIndexingDuration: metrics.indexingDurations?.reduce(
-          (acc, cur) => acc + Number(cur),
-          0
-        ),
-        totalSearchDuration: metrics.searchDurations?.reduce((acc, cur) => acc + Number(cur), 0),
+        totalIndexingDuration: metrics.indexingDurations
+          ? sum(metrics.indexingDurations.map(Number))
+          : undefined,
+        totalSearchDuration: metrics.searchDurations
+          ? sum(metrics.searchDurations.map(Number))
+          : undefined,
       },
     });
   }
 
   public async logStatusChange(args: LogStatusChangeArgs) {
+    await this.savedObjectsAdapter.logStatusChange(args);
+
     if (args.metrics) {
       this.logExecutionMetrics({
         ruleId: args.ruleId,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/rule_execution_log_client.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/rule_execution_log_client.ts
index 87a3b00cf4ed3e..2d773fc35cce00 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/rule_execution_log_client.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/rule_execution_log_client.ts
@@ -38,7 +38,7 @@ export class RuleExecutionLogClient implements IRuleExecutionLogClient {
         this.client = new SavedObjectsAdapter(savedObjectsClient);
         break;
       case UnderlyingLogClient.eventLog:
-        this.client = new EventLogAdapter(eventLogService);
+        this.client = new EventLogAdapter(eventLogService, savedObjectsClient);
         break;
     }
   }

From 32f650f9f705cc2f466a1d39f2830e9d9a800807 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ester=20Mart=C3=AD=20Vilaseca?=
 <ester.martivilaseca@elastic.co>
Date: Thu, 14 Oct 2021 10:48:36 +0200
Subject: [PATCH 42/71] [Stack monitoring] Fix logstash functional tests for
 react (#114819)

* update logstash pipelines test subject

* Add sorting to table options for pipelines table

* fix sorting in logstash node pipelines table

* remove commented code
---
 .../public/application/pages/logstash/node_pipelines.tsx  | 4 +---
 .../public/application/pages/logstash/pipelines.tsx       | 8 +++-----
 x-pack/test/functional/apps/monitoring/index.js           | 4 ----
 3 files changed, 4 insertions(+), 12 deletions(-)

diff --git a/x-pack/plugins/monitoring/public/application/pages/logstash/node_pipelines.tsx b/x-pack/plugins/monitoring/public/application/pages/logstash/node_pipelines.tsx
index e09850eaad5c9f..740202da57d24b 100644
--- a/x-pack/plugins/monitoring/public/application/pages/logstash/node_pipelines.tsx
+++ b/x-pack/plugins/monitoring/public/application/pages/logstash/node_pipelines.tsx
@@ -58,7 +58,6 @@ export const LogStashNodePipelinesPage: React.FC<ComponentProps> = ({ clusters }
 
   const getPageData = useCallback(async () => {
     const bounds = services.data?.query.timefilter.timefilter.getBounds();
-    const options: any = getPaginationRouteOptions();
     const url = `../api/monitoring/v1/clusters/${clusterUuid}/logstash/node/${match.params.uuid}/pipelines`;
     const response = await services.http?.fetch(url, {
       method: 'POST',
@@ -68,8 +67,7 @@ export const LogStashNodePipelinesPage: React.FC<ComponentProps> = ({ clusters }
           min: bounds.min.toISOString(),
           max: bounds.max.toISOString(),
         },
-        pagination: options.pagination,
-        queryText: options.queryText,
+        ...getPaginationRouteOptions(),
       }),
     });
 
diff --git a/x-pack/plugins/monitoring/public/application/pages/logstash/pipelines.tsx b/x-pack/plugins/monitoring/public/application/pages/logstash/pipelines.tsx
index ac750ff81ddaad..c2dfe1c0dae7da 100644
--- a/x-pack/plugins/monitoring/public/application/pages/logstash/pipelines.tsx
+++ b/x-pack/plugins/monitoring/public/application/pages/logstash/pipelines.tsx
@@ -46,7 +46,6 @@ export const LogStashPipelinesPage: React.FC<ComponentProps> = ({ clusters }) =>
     const bounds = services.data?.query.timefilter.timefilter.getBounds();
     const url = `../api/monitoring/v1/clusters/${clusterUuid}/logstash/pipelines`;
 
-    const options: any = getPaginationRouteOptions();
     const response = await services.http?.fetch(url, {
       method: 'POST',
       body: JSON.stringify({
@@ -55,8 +54,7 @@ export const LogStashPipelinesPage: React.FC<ComponentProps> = ({ clusters }) =>
           min: bounds.min.toISOString(),
           max: bounds.max.toISOString(),
         },
-        pagination: options.pagination,
-        queryText: options.queryText,
+        ...getPaginationRouteOptions(),
       }),
     });
 
@@ -96,10 +94,10 @@ export const LogStashPipelinesPage: React.FC<ComponentProps> = ({ clusters }) =>
       title={title}
       pageTitle={pageTitle}
       getPageData={getPageData}
-      data-test-subj="elasticsearchOverviewPage"
+      data-test-subj="logstashPipelinesListing"
       cluster={cluster}
     >
-      <div data-test-subj="elasticsearchOverviewPage">{renderOverview(data)}</div>
+      <div data-test-subj="logstashPipelinesListing">{renderOverview(data)}</div>
     </LogstashTemplate>
   );
 };
diff --git a/x-pack/test/functional/apps/monitoring/index.js b/x-pack/test/functional/apps/monitoring/index.js
index 213007c7b71df4..6a5b6ea8131711 100644
--- a/x-pack/test/functional/apps/monitoring/index.js
+++ b/x-pack/test/functional/apps/monitoring/index.js
@@ -34,10 +34,6 @@ export default function ({ loadTestFile }) {
     loadTestFile(require.resolve('./kibana/instance'));
     loadTestFile(require.resolve('./kibana/instance_mb'));
 
-    // loadTestFile(require.resolve('./logstash/overview'));
-    // loadTestFile(require.resolve('./logstash/nodes'));
-    // loadTestFile(require.resolve('./logstash/node'));
-
     loadTestFile(require.resolve('./logstash/pipelines'));
     loadTestFile(require.resolve('./logstash/pipelines_mb'));
 

From f2f6bb52951f08227fb451d361f2d00b976852ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Yulia=20=C4=8Cech?=
 <6585477+yuliacech@users.noreply.github.com>
Date: Thu, 14 Oct 2021 10:50:26 +0200
Subject: [PATCH 43/71] [Index Management] Added `data-test-subj` values to the
 index context menu buttons (#114900)

---
 .../__jest__/components/index_table.test.js   | 53 ++++++++++---------
 .../index_actions_context_menu.js             | 19 +++++--
 2 files changed, 44 insertions(+), 28 deletions(-)

diff --git a/x-pack/plugins/index_management/__jest__/components/index_table.test.js b/x-pack/plugins/index_management/__jest__/components/index_table.test.js
index ba07db10d22d89..808c44ddecce09 100644
--- a/x-pack/plugins/index_management/__jest__/components/index_table.test.js
+++ b/x-pack/plugins/index_management/__jest__/components/index_table.test.js
@@ -88,7 +88,7 @@ const snapshot = (rendered) => {
   expect(rendered).toMatchSnapshot();
 };
 
-const openMenuAndClickButton = (rendered, rowIndex, buttonIndex) => {
+const openMenuAndClickButton = (rendered, rowIndex, buttonSelector) => {
   // Select a row.
   const checkboxes = findTestSubject(rendered, 'indexTableRowCheckbox');
   checkboxes.at(rowIndex).simulate('change', { target: { checked: true } });
@@ -100,18 +100,18 @@ const openMenuAndClickButton = (rendered, rowIndex, buttonIndex) => {
   rendered.update();
 
   // Click an action in the context menu.
-  const contextMenuButtons = findTestSubject(rendered, 'indexTableContextMenuButton');
-  contextMenuButtons.at(buttonIndex).simulate('click');
+  const contextMenuButton = findTestSubject(rendered, buttonSelector);
+  contextMenuButton.simulate('click');
   rendered.update();
 };
 
-const testEditor = (rendered, buttonIndex, rowIndex = 0) => {
-  openMenuAndClickButton(rendered, rowIndex, buttonIndex);
+const testEditor = (rendered, buttonSelector, rowIndex = 0) => {
+  openMenuAndClickButton(rendered, rowIndex, buttonSelector);
   rendered.update();
   snapshot(findTestSubject(rendered, 'detailPanelTabSelected').text());
 };
 
-const testAction = (rendered, buttonIndex, rowIndex = 0) => {
+const testAction = (rendered, buttonSelector, rowIndex = 0) => {
   // This is leaking some implementation details about how Redux works. Not sure exactly what's going on
   // but it looks like we're aware of how many Redux actions are dispatched in response to user interaction,
   // so we "time" our assertion based on how many Redux actions we observe. This is brittle because it
@@ -127,7 +127,7 @@ const testAction = (rendered, buttonIndex, rowIndex = 0) => {
     dispatchedActionsCount++;
   });
 
-  openMenuAndClickButton(rendered, rowIndex, buttonIndex);
+  openMenuAndClickButton(rendered, rowIndex, buttonSelector);
   // take snapshot of initial state.
   snapshot(status(rendered, rowIndex));
 };
@@ -140,6 +140,11 @@ const namesText = (rendered) => {
   return names(rendered).map((button) => button.text());
 };
 
+const getActionMenuButtons = (rendered) => {
+  return findTestSubject(rendered, 'indexContextMenu')
+    .find('button')
+    .map((span) => span.text());
+};
 describe('index table', () => {
   beforeEach(() => {
     // Mock initialization of services
@@ -232,7 +237,7 @@ describe('index table', () => {
     await runAllPromises();
     rendered.update();
 
-    let button = findTestSubject(rendered, 'indexTableContextMenuButton');
+    let button = findTestSubject(rendered, 'indexActionsContextMenuButton');
     expect(button.length).toEqual(0);
 
     const checkboxes = findTestSubject(rendered, 'indexTableRowCheckbox');
@@ -247,7 +252,7 @@ describe('index table', () => {
     await runAllPromises();
     rendered.update();
 
-    let button = findTestSubject(rendered, 'indexTableContextMenuButton');
+    let button = findTestSubject(rendered, 'indexActionsContextMenuButton');
     expect(button.length).toEqual(0);
 
     const checkboxes = findTestSubject(rendered, 'indexTableRowCheckbox');
@@ -353,7 +358,7 @@ describe('index table', () => {
     const actionButton = findTestSubject(rendered, 'indexActionsContextMenuButton');
     actionButton.simulate('click');
     rendered.update();
-    snapshot(findTestSubject(rendered, 'indexTableContextMenuButton').map((span) => span.text()));
+    snapshot(getActionMenuButtons(rendered));
   });
 
   test('should show the right context menu options when one index is selected and closed', async () => {
@@ -367,7 +372,7 @@ describe('index table', () => {
     const actionButton = findTestSubject(rendered, 'indexActionsContextMenuButton');
     actionButton.simulate('click');
     rendered.update();
-    snapshot(findTestSubject(rendered, 'indexTableContextMenuButton').map((span) => span.text()));
+    snapshot(getActionMenuButtons(rendered));
   });
 
   test('should show the right context menu options when one open and one closed index is selected', async () => {
@@ -382,7 +387,7 @@ describe('index table', () => {
     const actionButton = findTestSubject(rendered, 'indexActionsContextMenuButton');
     actionButton.simulate('click');
     rendered.update();
-    snapshot(findTestSubject(rendered, 'indexTableContextMenuButton').map((span) => span.text()));
+    snapshot(getActionMenuButtons(rendered));
   });
 
   test('should show the right context menu options when more than one open index is selected', async () => {
@@ -397,7 +402,7 @@ describe('index table', () => {
     const actionButton = findTestSubject(rendered, 'indexActionsContextMenuButton');
     actionButton.simulate('click');
     rendered.update();
-    snapshot(findTestSubject(rendered, 'indexTableContextMenuButton').map((span) => span.text()));
+    snapshot(getActionMenuButtons(rendered));
   });
 
   test('should show the right context menu options when more than one closed index is selected', async () => {
@@ -412,28 +417,28 @@ describe('index table', () => {
     const actionButton = findTestSubject(rendered, 'indexActionsContextMenuButton');
     actionButton.simulate('click');
     rendered.update();
-    snapshot(findTestSubject(rendered, 'indexTableContextMenuButton').map((span) => span.text()));
+    snapshot(getActionMenuButtons(rendered));
   });
 
   test('flush button works from context menu', async () => {
     const rendered = mountWithIntl(component);
     await runAllPromises();
     rendered.update();
-    testAction(rendered, 8);
+    testAction(rendered, 'flushIndexMenuButton');
   });
 
   test('clear cache button works from context menu', async () => {
     const rendered = mountWithIntl(component);
     await runAllPromises();
     rendered.update();
-    testAction(rendered, 7);
+    testAction(rendered, 'clearCacheIndexMenuButton');
   });
 
   test('refresh button works from context menu', async () => {
     const rendered = mountWithIntl(component);
     await runAllPromises();
     rendered.update();
-    testAction(rendered, 6);
+    testAction(rendered, 'refreshIndexMenuButton');
   });
 
   test('force merge button works from context menu', async () => {
@@ -442,7 +447,7 @@ describe('index table', () => {
     rendered.update();
 
     const rowIndex = 0;
-    openMenuAndClickButton(rendered, rowIndex, 5);
+    openMenuAndClickButton(rendered, rowIndex, 'forcemergeIndexMenuButton');
     snapshot(status(rendered, rowIndex));
     expect(rendered.find('.euiModal').length).toBe(1);
 
@@ -478,7 +483,7 @@ describe('index table', () => {
       JSON.stringify(modifiedIndices),
     ]);
 
-    testAction(rendered, 4);
+    testAction(rendered, 'closeIndexMenuButton');
   });
 
   test('open index button works from context menu', async () => {
@@ -499,34 +504,34 @@ describe('index table', () => {
       JSON.stringify(modifiedIndices),
     ]);
 
-    testAction(rendered, 3, 1);
+    testAction(rendered, 'openIndexMenuButton', 1);
   });
 
   test('show settings button works from context menu', async () => {
     const rendered = mountWithIntl(component);
     await runAllPromises();
     rendered.update();
-    testEditor(rendered, 0);
+    testEditor(rendered, 'showSettingsIndexMenuButton');
   });
 
   test('show mappings button works from context menu', async () => {
     const rendered = mountWithIntl(component);
     await runAllPromises();
     rendered.update();
-    testEditor(rendered, 1);
+    testEditor(rendered, 'showMappingsIndexMenuButton');
   });
 
   test('show stats button works from context menu', async () => {
     const rendered = mountWithIntl(component);
     await runAllPromises();
     rendered.update();
-    testEditor(rendered, 2);
+    testEditor(rendered, 'showStatsIndexMenuButton');
   });
 
   test('edit index button works from context menu', async () => {
     const rendered = mountWithIntl(component);
     await runAllPromises();
     rendered.update();
-    testEditor(rendered, 3);
+    testEditor(rendered, 'editIndexMenuButton');
   });
 });
diff --git a/x-pack/plugins/index_management/public/application/sections/home/index_list/index_actions_context_menu/index_actions_context_menu.js b/x-pack/plugins/index_management/public/application/sections/home/index_list/index_actions_context_menu/index_actions_context_menu.js
index a97d5b11161b13..c5bd62feff8264 100644
--- a/x-pack/plugins/index_management/public/application/sections/home/index_list/index_actions_context_menu/index_actions_context_menu.js
+++ b/x-pack/plugins/index_management/public/application/sections/home/index_list/index_actions_context_menu/index_actions_context_menu.js
@@ -75,6 +75,7 @@ export class IndexActionsContextMenu extends Component {
     const items = [];
     if (!detailPanel && selectedIndexCount === 1) {
       items.push({
+        'data-test-subj': 'showSettingsIndexMenuButton',
         name: i18n.translate('xpack.idxMgmt.indexActionsMenu.showIndexSettingsLabel', {
           defaultMessage:
             'Show {selectedIndexCount, plural, one {index} other {indices} } settings',
@@ -85,6 +86,7 @@ export class IndexActionsContextMenu extends Component {
         },
       });
       items.push({
+        'data-test-subj': 'showMappingsIndexMenuButton',
         name: i18n.translate('xpack.idxMgmt.indexActionsMenu.showIndexMappingLabel', {
           defaultMessage: 'Show {selectedIndexCount, plural, one {index} other {indices} } mapping',
           values: { selectedIndexCount },
@@ -95,6 +97,7 @@ export class IndexActionsContextMenu extends Component {
       });
       if (allOpen) {
         items.push({
+          'data-test-subj': 'showStatsIndexMenuButton',
           name: i18n.translate('xpack.idxMgmt.indexActionsMenu.showIndexStatsLabel', {
             defaultMessage: 'Show {selectedIndexCount, plural, one {index} other {indices} } stats',
             values: { selectedIndexCount },
@@ -105,6 +108,7 @@ export class IndexActionsContextMenu extends Component {
         });
       }
       items.push({
+        'data-test-subj': 'editIndexMenuButton',
         name: i18n.translate('xpack.idxMgmt.indexActionsMenu.editIndexSettingsLabel', {
           defaultMessage:
             'Edit {selectedIndexCount, plural, one {index} other {indices} } settings',
@@ -117,6 +121,7 @@ export class IndexActionsContextMenu extends Component {
     }
     if (allOpen) {
       items.push({
+        'data-test-subj': 'closeIndexMenuButton',
         name: i18n.translate('xpack.idxMgmt.indexActionsMenu.closeIndexLabel', {
           defaultMessage: 'Close {selectedIndexCount, plural, one {index} other {indices} }',
           values: { selectedIndexCount },
@@ -131,6 +136,7 @@ export class IndexActionsContextMenu extends Component {
         },
       });
       items.push({
+        'data-test-subj': 'forcemergeIndexMenuButton',
         name: i18n.translate('xpack.idxMgmt.indexActionsMenu.forceMergeIndexLabel', {
           defaultMessage: 'Force merge {selectedIndexCount, plural, one {index} other {indices} }',
           values: { selectedIndexCount },
@@ -141,6 +147,7 @@ export class IndexActionsContextMenu extends Component {
         },
       });
       items.push({
+        'data-test-subj': 'refreshIndexMenuButton',
         name: i18n.translate('xpack.idxMgmt.indexActionsMenu.refreshIndexLabel', {
           defaultMessage: 'Refresh {selectedIndexCount, plural, one {index} other {indices} }',
           values: { selectedIndexCount },
@@ -150,6 +157,7 @@ export class IndexActionsContextMenu extends Component {
         },
       });
       items.push({
+        'data-test-subj': 'clearCacheIndexMenuButton',
         name: i18n.translate('xpack.idxMgmt.indexActionsMenu.clearIndexCacheLabel', {
           defaultMessage: 'Clear {selectedIndexCount, plural, one {index} other {indices} } cache',
           values: { selectedIndexCount },
@@ -159,6 +167,7 @@ export class IndexActionsContextMenu extends Component {
         },
       });
       items.push({
+        'data-test-subj': 'flushIndexMenuButton',
         name: i18n.translate('xpack.idxMgmt.indexActionsMenu.flushIndexLabel', {
           defaultMessage: 'Flush {selectedIndexCount, plural, one {index} other {indices} }',
           values: { selectedIndexCount },
@@ -191,6 +200,7 @@ export class IndexActionsContextMenu extends Component {
       }
     } else {
       items.push({
+        'data-test-subj': 'openIndexMenuButton',
         name: i18n.translate('xpack.idxMgmt.indexActionsMenu.openIndexLabel', {
           defaultMessage: 'Open {selectedIndexCount, plural, one {index} other {indices} }',
           values: { selectedIndexCount },
@@ -239,9 +249,6 @@ export class IndexActionsContextMenu extends Component {
         }
       }
     });
-    items.forEach((item) => {
-      item['data-test-subj'] = 'indexTableContextMenuButton';
-    });
     const panelTree = {
       id: 0,
       title: i18n.translate('xpack.idxMgmt.indexActionsMenu.panelTitle', {
@@ -732,7 +739,11 @@ export class IndexActionsContextMenu extends Component {
                 anchorPosition={anchorPosition}
                 repositionOnScroll
               >
-                <EuiContextMenu initialPanelId={0} panels={panels} />
+                <EuiContextMenu
+                  initialPanelId={0}
+                  panels={panels}
+                  data-test-subj="indexContextMenu"
+                />
               </EuiPopover>
             </div>
           );

From b0daf935cf01ffe4377063a115648a2fdfbe081d Mon Sep 17 00:00:00 2001
From: Walter Rafelsberger <walter@elastic.co>
Date: Thu, 14 Oct 2021 11:07:26 +0200
Subject: [PATCH 44/71] [ML] APM Correlations: Round duration values to be used
 in range aggregations. (#114833)

A change in the ES range agg no longer accepts numbers with decimals if the underlying field is typed as long. This fixes the issue by rounding the values we pass on to the range agg.
---
 .../queries/query_histogram_range_steps.test.ts               | 4 ++--
 .../search_strategies/queries/query_histogram_range_steps.ts  | 3 ++-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/x-pack/plugins/apm/server/lib/search_strategies/queries/query_histogram_range_steps.test.ts b/x-pack/plugins/apm/server/lib/search_strategies/queries/query_histogram_range_steps.test.ts
index 25ce39cbcf17b2..ffc86c7ef6c32f 100644
--- a/x-pack/plugins/apm/server/lib/search_strategies/queries/query_histogram_range_steps.test.ts
+++ b/x-pack/plugins/apm/server/lib/search_strategies/queries/query_histogram_range_steps.test.ts
@@ -106,8 +106,8 @@ describe('query_histogram_range_steps', () => {
       );
 
       expect(resp.length).toEqual(100);
-      expect(resp[0]).toEqual(9.260965422132594);
-      expect(resp[99]).toEqual(18521.930844265193);
+      expect(resp[0]).toEqual(9);
+      expect(resp[99]).toEqual(18522);
       expect(esClientSearchMock).toHaveBeenCalledTimes(1);
     });
   });
diff --git a/x-pack/plugins/apm/server/lib/search_strategies/queries/query_histogram_range_steps.ts b/x-pack/plugins/apm/server/lib/search_strategies/queries/query_histogram_range_steps.ts
index 973787833577c3..790919d1930283 100644
--- a/x-pack/plugins/apm/server/lib/search_strategies/queries/query_histogram_range_steps.ts
+++ b/x-pack/plugins/apm/server/lib/search_strategies/queries/query_histogram_range_steps.ts
@@ -19,10 +19,11 @@ import { getRequestBase } from './get_request_base';
 
 const getHistogramRangeSteps = (min: number, max: number, steps: number) => {
   // A d3 based scale function as a helper to get equally distributed bins on a log scale.
+  // We round the final values because the ES range agg we use won't accept numbers with decimals for `transaction.duration.us`.
   const logFn = scaleLog().domain([min, max]).range([1, steps]);
   return [...Array(steps).keys()]
     .map(logFn.invert)
-    .map((d) => (isNaN(d) ? 0 : d));
+    .map((d) => (isNaN(d) ? 0 : Math.round(d)));
 };
 
 export const getHistogramIntervalRequest = (

From 1d3c8b7dc70f2ba260cca330fdad0b973ffbccb9 Mon Sep 17 00:00:00 2001
From: Esteban Beltran <academo@users.noreply.github.com>
Date: Thu, 14 Oct 2021 11:26:49 +0200
Subject: [PATCH 45/71] [Security Solution] Edit host isolation exception IP UI
 (#114279)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../pages/event_filters/store/middleware.ts   |   2 +-
 .../host_isolation_exceptions/service.ts      |  24 +++
 .../host_isolation_exceptions/store/action.ts |  21 ++-
 .../store/middleware.test.ts                  | 107 +++++++++++-
 .../store/middleware.ts                       |  88 +++++++++-
 .../store/reducer.ts                          |   9 +
 .../store/selector.ts                         |  16 ++
 .../pages/host_isolation_exceptions/types.ts  |   5 +-
 .../view/components/delete_modal.test.tsx     |   2 +-
 .../view/components/form.test.tsx             |  53 +++++-
 .../view/components/form.tsx                  |  16 +-
 .../view/components/form_flyout.test.tsx      | 117 ++++++++++++-
 .../view/components/form_flyout.tsx           | 163 +++++++++++++-----
 .../view/components/translations.ts           |  65 +++++++
 .../view/host_isolation_exceptions_list.tsx   |  22 ++-
 .../pages/trusted_apps/store/middleware.ts    |   2 +-
 16 files changed, 633 insertions(+), 79 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/management/pages/event_filters/store/middleware.ts b/x-pack/plugins/security_solution/public/management/pages/event_filters/store/middleware.ts
index 0c90e21b495301..c77494aad2de22 100644
--- a/x-pack/plugins/security_solution/public/management/pages/event_filters/store/middleware.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/event_filters/store/middleware.ts
@@ -231,8 +231,8 @@ const refreshListDataIfNeeded: MiddlewareActionHandler = async (store, eventFilt
     dispatch({
       type: 'eventFiltersListPageDataChanged',
       payload: {
-        type: 'LoadingResourceState',
         // @ts-expect-error-next-line will be fixed with when AsyncResourceState is refactored (#830)
+        type: 'LoadingResourceState',
         previousState: getCurrentListPageDataState(state),
       },
     });
diff --git a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/service.ts b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/service.ts
index 8af353a3c9531e..b58c2d901c2cc3 100644
--- a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/service.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/service.ts
@@ -9,6 +9,7 @@ import {
   CreateExceptionListItemSchema,
   ExceptionListItemSchema,
   FoundExceptionListItemSchema,
+  UpdateExceptionListItemSchema,
 } from '@kbn/securitysolution-io-ts-list-types';
 import { ENDPOINT_HOST_ISOLATION_EXCEPTIONS_LIST_ID } from '@kbn/securitysolution-list-constants';
 import { HttpStart } from 'kibana/public';
@@ -88,3 +89,26 @@ export async function deleteHostIsolationExceptionItems(http: HttpStart, id: str
     },
   });
 }
+
+export async function getOneHostIsolationExceptionItem(
+  http: HttpStart,
+  id: string
+): Promise<UpdateExceptionListItemSchema> {
+  await ensureHostIsolationExceptionsListExists(http);
+  return http.get<ExceptionListItemSchema>(EXCEPTION_LIST_ITEM_URL, {
+    query: {
+      id,
+      namespace_type: 'agnostic',
+    },
+  });
+}
+
+export async function updateOneHostIsolationExceptionItem(
+  http: HttpStart,
+  exception: UpdateExceptionListItemSchema
+): Promise<ExceptionListItemSchema> {
+  await ensureHostIsolationExceptionsListExists(http);
+  return http.put<ExceptionListItemSchema>(EXCEPTION_LIST_ITEM_URL, {
+    body: JSON.stringify(exception),
+  });
+}
diff --git a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/store/action.ts b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/store/action.ts
index a5fae36486f98e..237868ad18c502 100644
--- a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/store/action.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/store/action.ts
@@ -5,7 +5,10 @@
  * 2.0.
  */
 
-import { ExceptionListItemSchema } from '@kbn/securitysolution-io-ts-list-types';
+import {
+  ExceptionListItemSchema,
+  UpdateExceptionListItemSchema,
+} from '@kbn/securitysolution-io-ts-list-types';
 import { Action } from 'redux';
 import { HostIsolationExceptionsPageState } from '../types';
 
@@ -38,10 +41,24 @@ export type HostIsolationExceptionsDeleteStatusChanged =
   Action<'hostIsolationExceptionsDeleteStatusChanged'> & {
     payload: HostIsolationExceptionsPageState['deletion']['status'];
   };
+
+export type HostIsolationExceptionsMarkToEdit = Action<'hostIsolationExceptionsMarkToEdit'> & {
+  payload: {
+    id: string;
+  };
+};
+
+export type HostIsolationExceptionsSubmitEdit = Action<'hostIsolationExceptionsSubmitEdit'> & {
+  payload: UpdateExceptionListItemSchema;
+};
+
 export type HostIsolationExceptionsPageAction =
   | HostIsolationExceptionsPageDataChanged
   | HostIsolationExceptionsCreateEntry
   | HostIsolationExceptionsFormStateChanged
   | HostIsolationExceptionsDeleteItem
   | HostIsolationExceptionsSubmitDelete
-  | HostIsolationExceptionsDeleteStatusChanged;
+  | HostIsolationExceptionsDeleteStatusChanged
+  | HostIsolationExceptionsFormEntryChanged
+  | HostIsolationExceptionsMarkToEdit
+  | HostIsolationExceptionsSubmitEdit;
diff --git a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/store/middleware.test.ts b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/store/middleware.test.ts
index 266853fdab5e2a..878c17a1a2757e 100644
--- a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/store/middleware.test.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/store/middleware.test.ts
@@ -5,7 +5,10 @@
  * 2.0.
  */
 
-import { CreateExceptionListItemSchema } from '@kbn/securitysolution-io-ts-list-types';
+import {
+  CreateExceptionListItemSchema,
+  UpdateEndpointListItemSchema,
+} from '@kbn/securitysolution-io-ts-list-types';
 import { applyMiddleware, createStore, Store } from 'redux';
 import { coreMock } from '../../../../../../../../src/core/public/mocks';
 import { getFoundExceptionListItemSchemaMock } from '../../../../../../lists/common/schemas/response/found_exception_list_item_schema.mock';
@@ -24,6 +27,8 @@ import {
   createHostIsolationExceptionItem,
   deleteHostIsolationExceptionItems,
   getHostIsolationExceptionItems,
+  getOneHostIsolationExceptionItem,
+  updateOneHostIsolationExceptionItem,
 } from '../service';
 import { HostIsolationExceptionsPageState } from '../types';
 import { createEmptyHostIsolationException } from '../utils';
@@ -36,6 +41,8 @@ jest.mock('../service');
 const getHostIsolationExceptionItemsMock = getHostIsolationExceptionItems as jest.Mock;
 const deleteHostIsolationExceptionItemsMock = deleteHostIsolationExceptionItems as jest.Mock;
 const createHostIsolationExceptionItemMock = createHostIsolationExceptionItem as jest.Mock;
+const getOneHostIsolationExceptionItemMock = getOneHostIsolationExceptionItem as jest.Mock;
+const updateOneHostIsolationExceptionItemMock = updateOneHostIsolationExceptionItem as jest.Mock;
 
 const fakeCoreStart = coreMock.createStart({ basePath: '/mock' });
 
@@ -170,6 +177,7 @@ describe('Host isolation exceptions middleware', () => {
         ],
       };
     });
+
     it('should dispatch a form loading state when an entry is submited', async () => {
       const waiter = spyMiddleware.waitForAction('hostIsolationExceptionsFormStateChanged', {
         validate({ payload }) {
@@ -182,6 +190,7 @@ describe('Host isolation exceptions middleware', () => {
       });
       await waiter;
     });
+
     it('should dispatch a form success state when an entry is confirmed by the API', async () => {
       const waiter = spyMiddleware.waitForAction('hostIsolationExceptionsFormStateChanged', {
         validate({ payload }) {
@@ -198,6 +207,7 @@ describe('Host isolation exceptions middleware', () => {
         exception: entry,
       });
     });
+
     it('should dispatch a form failure state when an entry is rejected by the API', async () => {
       createHostIsolationExceptionItemMock.mockRejectedValue({
         body: { message: 'error message', statusCode: 500, error: 'Not today' },
@@ -215,6 +225,101 @@ describe('Host isolation exceptions middleware', () => {
     });
   });
 
+  describe('When updating an item from host isolation exceptions', () => {
+    const fakeId = 'dc5d1d00-2766-11ec-981f-7f84cfc8764f';
+    let fakeException: UpdateEndpointListItemSchema;
+    beforeEach(() => {
+      fakeException = {
+        ...createEmptyHostIsolationException(),
+        name: 'name edit me',
+        description: 'initial description',
+        id: fakeId,
+        item_id: fakeId,
+        entries: [
+          {
+            field: 'destination.ip',
+            operator: 'included',
+            type: 'match',
+            value: '10.0.0.5',
+          },
+        ],
+      };
+      getOneHostIsolationExceptionItemMock.mockReset();
+      getOneHostIsolationExceptionItemMock.mockImplementation(async () => {
+        return fakeException;
+      });
+    });
+
+    it('should load data from an entry when an exception is marked to edit', async () => {
+      const waiter = spyMiddleware.waitForAction('hostIsolationExceptionsFormEntryChanged');
+      store.dispatch({
+        type: 'hostIsolationExceptionsMarkToEdit',
+        payload: {
+          id: fakeId,
+        },
+      });
+      await waiter;
+      expect(getOneHostIsolationExceptionItemMock).toHaveBeenCalledWith(fakeCoreStart.http, fakeId);
+    });
+
+    it('should call the update API when an item edit is submitted', async () => {
+      const waiter = Promise.all([
+        // loading status
+        spyMiddleware.waitForAction('hostIsolationExceptionsFormStateChanged', {
+          validate: ({ payload }) => {
+            return isLoadingResourceState(payload);
+          },
+        }),
+        // loaded status
+        spyMiddleware.waitForAction('hostIsolationExceptionsFormStateChanged', {
+          validate({ payload }) {
+            return isLoadedResourceState(payload);
+          },
+        }),
+      ]);
+      store.dispatch({
+        type: 'hostIsolationExceptionsSubmitEdit',
+        payload: fakeException,
+      });
+      expect(updateOneHostIsolationExceptionItemMock).toHaveBeenCalledWith(fakeCoreStart.http, {
+        name: 'name edit me',
+        description: 'initial description',
+        id: fakeId,
+        item_id: fakeId,
+        entries: [
+          {
+            field: 'destination.ip',
+            operator: 'included',
+            type: 'match',
+            value: '10.0.0.5',
+          },
+        ],
+        namespace_type: 'agnostic',
+        os_types: ['windows', 'linux', 'macos'],
+        tags: ['policy:all'],
+        type: 'simple',
+        comments: [],
+      });
+      await waiter;
+    });
+
+    it('should dispatch a form failure state when an entry is rejected by the API', async () => {
+      updateOneHostIsolationExceptionItemMock.mockRejectedValue({
+        body: { message: 'error message', statusCode: 500, error: 'Not today' },
+      });
+      const waiter = spyMiddleware.waitForAction('hostIsolationExceptionsFormStateChanged', {
+        validate({ payload }) {
+          return isFailedResourceState(payload);
+        },
+      });
+      store.dispatch({
+        type: 'hostIsolationExceptionsSubmitEdit',
+        payload: fakeException,
+      });
+      await waiter;
+    });
+  });
+
   describe('When deleting an item from host isolation exceptions', () => {
     beforeEach(() => {
       deleteHostIsolationExceptionItemsMock.mockReset();
diff --git a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/store/middleware.ts b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/store/middleware.ts
index bbc754e8155b0f..2587fff5bfafd8 100644
--- a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/store/middleware.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/store/middleware.ts
@@ -9,11 +9,12 @@ import {
   CreateExceptionListItemSchema,
   ExceptionListItemSchema,
   FoundExceptionListItemSchema,
+  UpdateExceptionListItemSchema,
 } from '@kbn/securitysolution-io-ts-list-types';
 import { CoreStart, HttpSetup, HttpStart } from 'kibana/public';
 import { matchPath } from 'react-router-dom';
-import { transformNewItemOutput } from '@kbn/securitysolution-list-hooks';
-import { AppLocation, Immutable } from '../../../../../common/endpoint/types';
+import { transformNewItemOutput, transformOutput } from '@kbn/securitysolution-list-hooks';
+import { AppLocation, Immutable, ImmutableObject } from '../../../../../common/endpoint/types';
 import { ImmutableMiddleware, ImmutableMiddlewareAPI } from '../../../../common/store';
 import { AppAction } from '../../../../common/store/actions';
 import { MANAGEMENT_ROUTING_HOST_ISOLATION_EXCEPTIONS_PATH } from '../../../common/constants';
@@ -21,11 +22,14 @@ import { parseQueryFilterToKQL } from '../../../common/utils';
 import {
   createFailedResourceState,
   createLoadedResourceState,
+  createLoadingResourceState,
 } from '../../../state/async_resource_builders';
 import {
   deleteHostIsolationExceptionItems,
   getHostIsolationExceptionItems,
   createHostIsolationExceptionItem,
+  getOneHostIsolationExceptionItem,
+  updateOneHostIsolationExceptionItem,
 } from '../service';
 import { HostIsolationExceptionsPageState } from '../types';
 import { getCurrentListPageDataState, getCurrentLocation, getItemToDelete } from './selector';
@@ -53,6 +57,14 @@ export const createHostIsolationExceptionsPageMiddleware = (
     if (action.type === 'hostIsolationExceptionsSubmitDelete') {
       deleteHostIsolationExceptionsItem(store, coreStart.http);
     }
+
+    if (action.type === 'hostIsolationExceptionsMarkToEdit') {
+      loadHostIsolationExceptionsItem(store, coreStart.http, action.payload.id);
+    }
+
+    if (action.type === 'hostIsolationExceptionsSubmitEdit') {
+      updateHostIsolationExceptionsItem(store, coreStart.http, action.payload);
+    }
   };
 };
 
@@ -67,8 +79,8 @@ async function createHostIsolationException(
   dispatch({
     type: 'hostIsolationExceptionsFormStateChanged',
     payload: {
-      type: 'LoadingResourceState',
       // @ts-expect-error-next-line will be fixed with when AsyncResourceState is refactored (#830)
+      type: 'LoadingResourceState',
       previousState: entry,
     },
   });
@@ -110,8 +122,8 @@ async function loadHostIsolationExceptionsList(
     dispatch({
       type: 'hostIsolationExceptionsPageDataChanged',
       payload: {
-        type: 'LoadingResourceState',
         // @ts-expect-error-next-line will be fixed with when AsyncResourceState is refactored (#830)
+        type: 'LoadingResourceState',
         previousState: getCurrentListPageDataState(store.getState()),
       },
     });
@@ -152,8 +164,8 @@ async function deleteHostIsolationExceptionsItem(
     dispatch({
       type: 'hostIsolationExceptionsDeleteStatusChanged',
       payload: {
-        type: 'LoadingResourceState',
         // @ts-expect-error-next-line will be fixed with when AsyncResourceState is refactored (#830)
+        type: 'LoadingResourceState',
         previousState: store.getState().deletion.status,
       },
     });
@@ -172,3 +184,69 @@ async function deleteHostIsolationExceptionsItem(
     });
   }
 }
+
+async function loadHostIsolationExceptionsItem(
+  store: ImmutableMiddlewareAPI<HostIsolationExceptionsPageState, AppAction>,
+  http: HttpSetup,
+  id: string
+) {
+  const { dispatch } = store;
+  try {
+    const exception: UpdateExceptionListItemSchema = await getOneHostIsolationExceptionItem(
+      http,
+      id
+    );
+    dispatch({
+      type: 'hostIsolationExceptionsFormEntryChanged',
+      payload: exception,
+    });
+  } catch (error) {
+    dispatch({
+      type: 'hostIsolationExceptionsFormStateChanged',
+      payload: createFailedResourceState<ExceptionListItemSchema>(error.body ?? error),
+    });
+  }
+}
+async function updateHostIsolationExceptionsItem(
+  store: ImmutableMiddlewareAPI<HostIsolationExceptionsPageState, AppAction>,
+  http: HttpSetup,
+  exception: ImmutableObject<UpdateExceptionListItemSchema>
+) {
+  const { dispatch } = store;
+  dispatch({
+    type: 'hostIsolationExceptionsFormStateChanged',
+    payload: createLoadingResourceState(createLoadedResourceState(exception)),
+  });
+
+  try {
+    const entry = transformOutput(exception as UpdateExceptionListItemSchema);
+    // Clean unnecessary fields for update action
+    const fieldsToRemove: Array<keyof ExceptionListItemSchema> = [
+      'created_at',
+      'created_by',
+      'created_at',
+      'created_by',
+      'list_id',
+      'tie_breaker_id',
+      'updated_at',
+      'updated_by',
+    ];
+
+    fieldsToRemove.forEach((field) => {
+      delete entry[field as keyof UpdateExceptionListItemSchema];
+    });
+    const response: ExceptionListItemSchema = await updateOneHostIsolationExceptionItem(
+      http,
+      entry
+    );
+    dispatch({
+      type: 'hostIsolationExceptionsFormStateChanged',
+      payload: createLoadedResourceState(response),
+    });
+  } catch (error) {
+    dispatch({
+      type: 'hostIsolationExceptionsFormStateChanged',
+      payload: createFailedResourceState<ExceptionListItemSchema>(error.body ?? error),
+    });
+  }
+}
diff --git a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/store/reducer.ts b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/store/reducer.ts
index d97295598f445b..77a1c248d0cf00 100644
--- a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/store/reducer.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/store/reducer.ts
@@ -56,6 +56,15 @@ export const hostIsolationExceptionsPageReducer: StateReducer = (
         },
       };
     }
+    case 'hostIsolationExceptionsFormEntryChanged': {
+      return {
+        ...state,
+        form: {
+          ...state.form,
+          entry: action.payload,
+        },
+      };
+    }
     case 'hostIsolationExceptionsPageDataChanged': {
       return {
         ...state,
diff --git a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/store/selector.ts b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/store/selector.ts
index 4462864e907024..3eca524d830d5c 100644
--- a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/store/selector.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/store/selector.ts
@@ -9,6 +9,7 @@ import { Pagination } from '@elastic/eui';
 import {
   ExceptionListItemSchema,
   FoundExceptionListItemSchema,
+  UpdateExceptionListItemSchema,
 } from '@kbn/securitysolution-io-ts-list-types';
 import { createSelector } from 'reselect';
 import { Immutable } from '../../../../../common/endpoint/types';
@@ -108,3 +109,18 @@ export const getDeleteError: HostIsolationExceptionsSelector<ServerApiError | un
       return status.error;
     }
   });
+
+const getFormState: HostIsolationExceptionsSelector<StoreState['form']> = (state) => {
+  return state.form;
+};
+
+export const getFormStatusFailure: HostIsolationExceptionsSelector<ServerApiError | undefined> =
+  createSelector(getFormState, (form) => {
+    if (isFailedResourceState(form.status)) {
+      return form.status.error;
+    }
+  });
+
+export const getExceptionToEdit: HostIsolationExceptionsSelector<
+  UpdateExceptionListItemSchema | undefined
+> = (state) => (state.form.entry ? (state.form.entry as UpdateExceptionListItemSchema) : undefined);
diff --git a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/types.ts b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/types.ts
index 1a74042fb652eb..2e61a39eb75427 100644
--- a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/types.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/types.ts
@@ -9,6 +9,7 @@ import type {
   CreateExceptionListItemSchema,
   ExceptionListItemSchema,
   FoundExceptionListItemSchema,
+  UpdateExceptionListItemSchema,
 } from '@kbn/securitysolution-io-ts-list-types';
 import { AsyncResourceState } from '../../state/async_resource_state';
 
@@ -29,7 +30,7 @@ export interface HostIsolationExceptionsPageState {
     status: AsyncResourceState<ExceptionListItemSchema>;
   };
   form: {
-    entry?: CreateExceptionListItemSchema;
-    status: AsyncResourceState<ExceptionListItemSchema>;
+    entry?: CreateExceptionListItemSchema | UpdateExceptionListItemSchema;
+    status: AsyncResourceState<CreateExceptionListItemSchema | UpdateExceptionListItemSchema>;
   };
 }
diff --git a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/delete_modal.test.tsx b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/delete_modal.test.tsx
index 0b09b4bfa14c48..2a75ab06221280 100644
--- a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/delete_modal.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/delete_modal.test.tsx
@@ -83,7 +83,7 @@ describe('When on the host isolation exceptions delete modal', () => {
     act(() => {
       fireEvent.click(cancelButton);
     });
-    await waiter;
+    expect(await waiter).toBeTruthy();
   });
 
   it('should show success toast after the delete is completed', async () => {
diff --git a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form.test.tsx b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form.test.tsx
index b06449de69d8c0..826f7bf6c4d8a9 100644
--- a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form.test.tsx
@@ -12,12 +12,16 @@ import {
   AppContextTestRender,
   createAppRootMockRenderer,
 } from '../../../../../common/mock/endpoint';
-import { CreateExceptionListItemSchema } from '@kbn/securitysolution-io-ts-list-types';
+import {
+  CreateExceptionListItemSchema,
+  UpdateExceptionListItemSchema,
+} from '@kbn/securitysolution-io-ts-list-types';
 import userEvent from '@testing-library/user-event';
+import uuid from 'uuid';
 
 describe('When on the host isolation exceptions add entry form', () => {
   let render: (
-    exception: CreateExceptionListItemSchema
+    exception: CreateExceptionListItemSchema | UpdateExceptionListItemSchema
   ) => ReturnType<AppContextTestRender['render']>;
   let renderResult: ReturnType<typeof render>;
   const onChange = jest.fn();
@@ -27,7 +31,7 @@ describe('When on the host isolation exceptions add entry form', () => {
     onChange.mockReset();
     onError.mockReset();
     const mockedContext = createAppRootMockRenderer();
-    render = (exception: CreateExceptionListItemSchema) => {
+    render = (exception) => {
       return mockedContext.render(
         <HostIsolationExceptionsForm exception={exception} onChange={onChange} onError={onError} />
       );
@@ -72,4 +76,47 @@ describe('When on the host isolation exceptions add entry form', () => {
       });
     });
   });
+  describe('When editing an existing exception', () => {
+    let existingException: UpdateExceptionListItemSchema;
+    beforeEach(() => {
+      existingException = {
+        ...createEmptyHostIsolationException(),
+        name: 'name edit me',
+        description: 'initial description',
+        id: uuid.v4(),
+        item_id: uuid.v4(),
+        entries: [
+          {
+            field: 'destination.ip',
+            operator: 'included',
+            type: 'match',
+            value: '10.0.0.1',
+          },
+        ],
+      };
+      renderResult = render(existingException);
+    });
+    it('should render the form with pre-filled inputs', () => {
+      expect(renderResult.getByTestId('hostIsolationExceptions-form-name-input')).toHaveValue(
+        'name edit me'
+      );
+      expect(renderResult.getByTestId('hostIsolationExceptions-form-ip-input')).toHaveValue(
+        '10.0.0.1'
+      );
+      expect(
+        renderResult.getByTestId('hostIsolationExceptions-form-description-input')
+      ).toHaveValue('initial description');
+    });
+    it('should call onChange when a value is introduced in a field', () => {
+      const ipInput = renderResult.getByTestId('hostIsolationExceptions-form-ip-input');
+      userEvent.clear(ipInput);
+      userEvent.type(ipInput, '10.0.100.1');
+      expect(onChange).toHaveBeenCalledWith({
+        ...existingException,
+        entries: [
+          { field: 'destination.ip', operator: 'included', type: 'match', value: '10.0.100.1' },
+        ],
+      });
+    });
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form.tsx b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form.tsx
index 84263f9d07c81b..7b13df16da4833 100644
--- a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form.tsx
@@ -16,7 +16,10 @@ import {
   EuiTitle,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { CreateExceptionListItemSchema } from '@kbn/securitysolution-io-ts-list-types';
+import {
+  CreateExceptionListItemSchema,
+  UpdateExceptionListItemSchema,
+} from '@kbn/securitysolution-io-ts-list-types';
 import React, { memo, useCallback, useEffect, useMemo, useState } from 'react';
 import { isValidIPv4OrCIDR } from '../../utils';
 import {
@@ -34,18 +37,19 @@ interface ExceptionIpEntry {
   field: 'destination.ip';
   operator: 'included';
   type: 'match';
-  value: '';
+  value: string;
 }
 
 export const HostIsolationExceptionsForm: React.FC<{
-  exception: CreateExceptionListItemSchema;
+  exception: CreateExceptionListItemSchema | UpdateExceptionListItemSchema;
   onError: (error: boolean) => void;
-  onChange: (exception: CreateExceptionListItemSchema) => void;
+  onChange: (exception: CreateExceptionListItemSchema | UpdateExceptionListItemSchema) => void;
 }> = memo(({ exception, onError, onChange }) => {
+  const ipEntry = exception.entries[0] as ExceptionIpEntry;
   const [hasBeenInputNameVisited, setHasBeenInputNameVisited] = useState(false);
   const [hasBeenInputIpVisited, setHasBeenInputIpVisited] = useState(false);
-  const [hasNameError, setHasNameError] = useState(true);
-  const [hasIpError, setHasIpError] = useState(true);
+  const [hasNameError, setHasNameError] = useState(!exception.name);
+  const [hasIpError, setHasIpError] = useState(!ipEntry.value);
 
   useEffect(() => {
     onError(hasNameError || hasIpError);
diff --git a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form_flyout.test.tsx b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form_flyout.test.tsx
index 6cfc9f56beadf6..4ab4ed785e4917 100644
--- a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form_flyout.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form_flyout.test.tsx
@@ -14,6 +14,8 @@ import userEvent from '@testing-library/user-event';
 import { HostIsolationExceptionsFormFlyout } from './form_flyout';
 import { act } from 'react-dom/test-utils';
 import { HOST_ISOLATION_EXCEPTIONS_PATH } from '../../../../../../common/constants';
+import uuid from 'uuid';
+import { createEmptyHostIsolationException } from '../../utils';
 
 jest.mock('../../service.ts');
 
@@ -23,8 +25,6 @@ describe('When on the host isolation exceptions flyout form', () => {
   let renderResult: ReturnType<typeof render>;
   let waitForAction: AppContextTestRender['middlewareSpy']['waitForAction'];
 
-  // const createHostIsolationExceptionItemMock = createHostIsolationExceptionItem as jest.mock;
-
   beforeEach(() => {
     mockedContext = createAppRootMockRenderer();
     render = () => {
@@ -34,7 +34,11 @@ describe('When on the host isolation exceptions flyout form', () => {
   });
 
   describe('When creating a new exception', () => {
-    describe('with invalid data', () => {
+    beforeEach(() => {
+      mockedContext.history.push(`${HOST_ISOLATION_EXCEPTIONS_PATH}?show=create`);
+    });
+
+    describe('with invalida data', () => {
       it('should show disabled buttons when the form first load', () => {
         renderResult = render();
         expect(renderResult.getByTestId('add-exception-cancel-button')).not.toHaveAttribute(
@@ -45,6 +49,7 @@ describe('When on the host isolation exceptions flyout form', () => {
         );
       });
     });
+
     describe('with valid data', () => {
       beforeEach(() => {
         renderResult = render();
@@ -53,6 +58,7 @@ describe('When on the host isolation exceptions flyout form', () => {
         userEvent.type(nameInput, 'test name');
         userEvent.type(ipInput, '10.0.0.1');
       });
+
       it('should show enable buttons when the form is valid', () => {
         expect(renderResult.getByTestId('add-exception-cancel-button')).not.toHaveAttribute(
           'disabled'
@@ -61,13 +67,15 @@ describe('When on the host isolation exceptions flyout form', () => {
           'disabled'
         );
       });
+
       it('should submit the entry data when submit is pressed with valid data', async () => {
         const confirmButton = renderResult.getByTestId('add-exception-confirm-button');
         expect(confirmButton).not.toHaveAttribute('disabled');
         const waiter = waitForAction('hostIsolationExceptionsCreateEntry');
         userEvent.click(confirmButton);
-        await waiter;
+        expect(await waiter).toBeTruthy();
       });
+
       it('should disable the submit button when an operation is in progress', () => {
         act(() => {
           mockedContext.store.dispatch({
@@ -81,6 +89,7 @@ describe('When on the host isolation exceptions flyout form', () => {
         const confirmButton = renderResult.getByTestId('add-exception-confirm-button');
         expect(confirmButton).toHaveAttribute('disabled');
       });
+
       it('should show a toast and close the flyout when the operation is finished', () => {
         mockedContext.history.push(`${HOST_ISOLATION_EXCEPTIONS_PATH}?show=create`);
         act(() => {
@@ -95,13 +104,14 @@ describe('When on the host isolation exceptions flyout form', () => {
         expect(mockedContext.coreStart.notifications.toasts.addSuccess).toHaveBeenCalled();
         expect(mockedContext.history.location.search).toBe('');
       });
-      it('should show an error toast operation fails and enable the submit button', () => {
+
+      it('should show an error toast if operation fails and enable the submit button', async () => {
         act(() => {
           mockedContext.store.dispatch({
             type: 'hostIsolationExceptionsFormStateChanged',
             payload: {
               type: 'FailedResourceState',
-              previousState: { type: 'UninitialisedResourceState' },
+              error: new Error('mocked error'),
             },
           });
         });
@@ -111,4 +121,99 @@ describe('When on the host isolation exceptions flyout form', () => {
       });
     });
   });
+  describe('When editing an existing exception', () => {
+    const fakeId = 'dc5d1d00-2766-11ec-981f-7f84cfc8764f';
+    beforeEach(() => {
+      mockedContext.history.push(`${HOST_ISOLATION_EXCEPTIONS_PATH}?show=edit&id=${fakeId}`);
+    });
+
+    describe('without loaded data', () => {
+      it('should show a loading status while the item is loaded', () => {
+        renderResult = render();
+        expect(renderResult.getByTestId('loading-spinner')).toBeTruthy();
+      });
+
+      it('should request to load data about the editing exception', async () => {
+        const waiter = waitForAction('hostIsolationExceptionsMarkToEdit', {
+          validate: ({ payload }) => {
+            return payload.id === fakeId;
+          },
+        });
+        renderResult = render();
+        expect(await waiter).toBeTruthy();
+      });
+
+      it('should show a warning toast if the item fails to load', () => {
+        renderResult = render();
+        act(() => {
+          mockedContext.store.dispatch({
+            type: 'hostIsolationExceptionsFormEntryChanged',
+            payload: undefined,
+          });
+
+          mockedContext.store.dispatch({
+            type: 'hostIsolationExceptionsFormStateChanged',
+            payload: {
+              type: 'FailedResourceState',
+              error: new Error('mocked error'),
+            },
+          });
+        });
+        expect(mockedContext.coreStart.notifications.toasts.addWarning).toHaveBeenCalled();
+      });
+    });
+
+    describe('with loaded data', () => {
+      beforeEach(async () => {
+        mockedContext.store.dispatch({
+          type: 'hostIsolationExceptionsFormEntryChanged',
+          payload: {
+            ...createEmptyHostIsolationException(),
+            name: 'name edit me',
+            description: 'initial description',
+            id: fakeId,
+            item_id: uuid.v4(),
+            entries: [
+              {
+                field: 'destination.ip',
+                operator: 'included',
+                type: 'match',
+                value: '10.0.0.5',
+              },
+            ],
+          },
+        });
+        renderResult = render();
+      });
+
+      it('should request data again if the url id is changed', async () => {
+        const otherId = 'd75fbd74-2a92-11ec-8d3d-0242ac130003';
+        act(() => {
+          mockedContext.history.push(`${HOST_ISOLATION_EXCEPTIONS_PATH}?show=edit&id=${otherId}`);
+        });
+        await waitForAction('hostIsolationExceptionsMarkToEdit', {
+          validate: ({ payload }) => {
+            return payload.id === otherId;
+          },
+        });
+      });
+
+      it('should enable the buttons from the start', () => {
+        expect(renderResult.getByTestId('add-exception-cancel-button')).not.toHaveAttribute(
+          'disabled'
+        );
+        expect(renderResult.getByTestId('add-exception-confirm-button')).not.toHaveAttribute(
+          'disabled'
+        );
+      });
+
+      it('should submit the entry data when submit is pressed with valid data', async () => {
+        const confirmButton = renderResult.getByTestId('add-exception-confirm-button');
+        expect(confirmButton).not.toHaveAttribute('disabled');
+        const waiter = waitForAction('hostIsolationExceptionsSubmitEdit');
+        userEvent.click(confirmButton);
+        expect(await waiter).toBeTruthy();
+      });
+    });
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form_flyout.tsx b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form_flyout.tsx
index 5502a1b8ea2b10..de12616c67a3c1 100644
--- a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form_flyout.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form_flyout.tsx
@@ -16,20 +16,32 @@ import {
   EuiFlyoutHeader,
   EuiTitle,
 } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { CreateExceptionListItemSchema } from '@kbn/securitysolution-io-ts-list-types';
+import {
+  CreateExceptionListItemSchema,
+  UpdateExceptionListItemSchema,
+} from '@kbn/securitysolution-io-ts-list-types';
+import { omit } from 'lodash';
 import React, { memo, useCallback, useEffect, useMemo, useState } from 'react';
 import { useDispatch } from 'react-redux';
+import { useHistory } from 'react-router-dom';
 import { Dispatch } from 'redux';
 import { Loader } from '../../../../../common/components/loader';
 import { useToasts } from '../../../../../common/lib/kibana';
+import { getHostIsolationExceptionsListPath } from '../../../../common/routing';
 import {
-  isFailedResourceState,
   isLoadedResourceState,
   isLoadingResourceState,
 } from '../../../../state/async_resource_state';
+import {
+  getCreateErrorMessage,
+  getCreationSuccessMessage,
+  getLoadErrorMessage,
+  getUpdateErrorMessage,
+  getUpdateSuccessMessage,
+} from './translations';
 import { HostIsolationExceptionsPageAction } from '../../store/action';
+import { getCurrentLocation, getExceptionToEdit, getFormStatusFailure } from '../../store/selector';
 import { createEmptyHostIsolationException } from '../../utils';
 import {
   useHostIsolationExceptionsNavigateCallback,
@@ -41,20 +53,26 @@ export const HostIsolationExceptionsFormFlyout: React.FC<{}> = memo(() => {
   const dispatch = useDispatch<Dispatch<HostIsolationExceptionsPageAction>>();
   const toasts = useToasts();
 
+  const location = useHostIsolationExceptionsSelector(getCurrentLocation);
+
   const creationInProgress = useHostIsolationExceptionsSelector((state) =>
     isLoadingResourceState(state.form.status)
   );
   const creationSuccessful = useHostIsolationExceptionsSelector((state) =>
     isLoadedResourceState(state.form.status)
   );
-  const creationFailure = useHostIsolationExceptionsSelector((state) =>
-    isFailedResourceState(state.form.status)
-  );
+  const creationFailure = useHostIsolationExceptionsSelector(getFormStatusFailure);
+
+  const exceptionToEdit = useHostIsolationExceptionsSelector(getExceptionToEdit);
 
   const navigateCallback = useHostIsolationExceptionsNavigateCallback();
 
+  const history = useHistory();
+
   const [formHasError, setFormHasError] = useState(true);
-  const [exception, setException] = useState<CreateExceptionListItemSchema | undefined>(undefined);
+  const [exception, setException] = useState<
+    CreateExceptionListItemSchema | UpdateExceptionListItemSchema | undefined
+  >(undefined);
 
   const onCancel = useCallback(
     () =>
@@ -65,12 +83,31 @@ export const HostIsolationExceptionsFormFlyout: React.FC<{}> = memo(() => {
     [navigateCallback]
   );
 
+  // load data to edit or create
   useEffect(() => {
-    setException(createEmptyHostIsolationException());
-  }, []);
+    if (location.show === 'create' && exception === undefined) {
+      setException(createEmptyHostIsolationException());
+    } else if (location.show === 'edit') {
+      // prevent flyout to show edit without an id
+      if (!location.id) {
+        onCancel();
+        return;
+      }
+      // load the exception to edit
+      if (!exceptionToEdit || location.id !== exceptionToEdit.id) {
+        dispatch({
+          type: 'hostIsolationExceptionsMarkToEdit',
+          payload: { id: location.id! },
+        });
+      } else {
+        setException(exceptionToEdit);
+      }
+    }
+  }, [dispatch, exception, exceptionToEdit, location.id, location.show, onCancel]);
 
+  // handle creation and edit success
   useEffect(() => {
-    if (creationSuccessful) {
+    if (creationSuccessful && exception?.name) {
       onCancel();
       dispatch({
         type: 'hostIsolationExceptionsFormStateChanged',
@@ -78,30 +115,45 @@ export const HostIsolationExceptionsFormFlyout: React.FC<{}> = memo(() => {
           type: 'UninitialisedResourceState',
         },
       });
-      toasts.addSuccess(
-        i18n.translate(
-          'xpack.securitySolution.hostIsolationExceptions.form.creationSuccessToastTitle',
-          {
-            defaultMessage: '"{name}" has been added to the host isolation exceptions list.',
-            values: { name: exception?.name },
-          }
-        )
-      );
+      if (exception?.item_id) {
+        toasts.addSuccess(getUpdateSuccessMessage(exception.name));
+      } else {
+        toasts.addSuccess(getCreationSuccessMessage(exception.name));
+      }
+    }
+  }, [creationSuccessful, dispatch, exception?.item_id, exception?.name, onCancel, toasts]);
+
+  // handle load item to edit error
+  useEffect(() => {
+    if (creationFailure && location.show === 'edit' && !exception?.item_id) {
+      toasts.addWarning(getLoadErrorMessage(creationFailure));
+      history.replace(getHostIsolationExceptionsListPath(omit(location, ['show', 'id'])));
+      dispatch({
+        type: 'hostIsolationExceptionsFormStateChanged',
+        payload: {
+          type: 'UninitialisedResourceState',
+        },
+      });
     }
-  }, [creationSuccessful, onCancel, dispatch, toasts, exception?.name]);
+  }, [creationFailure, dispatch, exception?.item_id, history, location, toasts]);
 
+  // handle edit or creation error
   useEffect(() => {
     if (creationFailure) {
-      toasts.addDanger(
-        i18n.translate(
-          'xpack.securitySolution.hostIsolationExceptions.form.creationFailureToastTitle',
-          {
-            defaultMessage: 'There was an error creating the exception',
-          }
-        )
-      );
+      // failed to load the entry
+      if (exception?.item_id) {
+        toasts.addDanger(getUpdateErrorMessage(creationFailure));
+      } else {
+        toasts.addDanger(getCreateErrorMessage(creationFailure));
+      }
+      dispatch({
+        type: 'hostIsolationExceptionsFormStateChanged',
+        payload: {
+          type: 'UninitialisedResourceState',
+        },
+      });
     }
-  }, [dispatch, toasts, creationFailure]);
+  }, [creationFailure, dispatch, exception?.item_id, toasts]);
 
   const handleOnCancel = useCallback(() => {
     if (creationInProgress) return;
@@ -109,10 +161,17 @@ export const HostIsolationExceptionsFormFlyout: React.FC<{}> = memo(() => {
   }, [creationInProgress, onCancel]);
 
   const handleOnSubmit = useCallback(() => {
-    dispatch({
-      type: 'hostIsolationExceptionsCreateEntry',
-      payload: exception,
-    });
+    if (exception?.item_id) {
+      dispatch({
+        type: 'hostIsolationExceptionsSubmitEdit',
+        payload: exception,
+      });
+    } else {
+      dispatch({
+        type: 'hostIsolationExceptionsCreateEntry',
+        payload: exception,
+      });
+    }
   }, [dispatch, exception]);
 
   const confirmButtonMemo = useMemo(
@@ -124,13 +183,20 @@ export const HostIsolationExceptionsFormFlyout: React.FC<{}> = memo(() => {
         onClick={handleOnSubmit}
         isLoading={creationInProgress}
       >
-        <FormattedMessage
-          id="xpack.securitySolution.hostIsolationExceptions.flyout.actions.create"
-          defaultMessage="Add Host Isolation Exception"
-        />
+        {exception?.item_id ? (
+          <FormattedMessage
+            id="xpack.securitySolution.hostIsolationExceptions.flyout.editButton"
+            defaultMessage="Edit Host Isolation Exception"
+          />
+        ) : (
+          <FormattedMessage
+            id="xpack.securitySolution.hostIsolationExceptions.flyout.createButton"
+            defaultMessage="Add Host Isolation Exception"
+          />
+        )}
       </EuiButton>
     ),
-    [formHasError, creationInProgress, handleOnSubmit]
+    [formHasError, creationInProgress, handleOnSubmit, exception?.item_id]
   );
 
   return exception ? (
@@ -141,12 +207,21 @@ export const HostIsolationExceptionsFormFlyout: React.FC<{}> = memo(() => {
     >
       <EuiFlyoutHeader hasBorder>
         <EuiTitle size="m">
-          <h2>
-            <FormattedMessage
-              id="xpack.securitySolution.hostIsolationExceptions.flyout.title"
-              defaultMessage="Add Host Isolation Exception"
-            />
-          </h2>
+          {exception?.item_id ? (
+            <h2>
+              <FormattedMessage
+                id="xpack.securitySolution.hostIsolationExceptions.flyout.editTitle"
+                defaultMessage="Edit Host Isolation Exception"
+              />
+            </h2>
+          ) : (
+            <h2>
+              <FormattedMessage
+                id="xpack.securitySolution.hostIsolationExceptions.flyout.title"
+                defaultMessage="Add Host Isolation Exception"
+              />
+            </h2>
+          )}
         </EuiTitle>
       </EuiFlyoutHeader>
 
diff --git a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/translations.ts b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/translations.ts
index df179c7a2221c5..207e094453d905 100644
--- a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/translations.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/translations.ts
@@ -6,6 +6,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
+import { ServerApiError } from '../../../../../common/types';
 
 export const NAME_PLACEHOLDER = i18n.translate(
   'xpack.securitySolution.hostIsolationExceptions.form.name.placeholder',
@@ -62,3 +63,67 @@ export const IP_ERROR = i18n.translate(
     defaultMessage: 'The ip is invalid. Only IPv4 with optional CIDR is supported',
   }
 );
+
+export const DELETE_HOST_ISOLATION_EXCEPTION_LABEL = i18n.translate(
+  'xpack.securitySolution.hostIsolationExceptions.list.action.delete',
+  {
+    defaultMessage: 'Delete Exception',
+  }
+);
+
+export const EDIT_HOST_ISOLATION_EXCEPTION_LABEL = i18n.translate(
+  'xpack.securitySolution.hostIsolationExceptions.list.action.edit',
+  {
+    defaultMessage: 'Edit Exception',
+  }
+);
+
+export const getCreateErrorMessage = (creationError: ServerApiError) => {
+  return i18n.translate(
+    'xpack.securitySolution.hostIsolationExceptions.form.failedToastTitle.create',
+    {
+      defaultMessage: 'There was an error creating the exception: "{error}"',
+      values: { error: creationError.message },
+    }
+  );
+};
+
+export const getUpdateErrorMessage = (updateError: ServerApiError) => {
+  return i18n.translate(
+    'xpack.securitySolution.hostIsolationExceptions.form.failedToastTitle.update',
+    {
+      defaultMessage: 'There was an error updating the exception: "{error}"',
+      values: { error: updateError.message },
+    }
+  );
+};
+
+export const getLoadErrorMessage = (getError: ServerApiError) => {
+  return i18n.translate(
+    'xpack.securitySolution.hostIsolationExceptions.form.failedToastTitle.get',
+    {
+      defaultMessage: 'Unable to edit exception: "{error}"',
+      values: { error: getError.message },
+    }
+  );
+};
+
+export const getUpdateSuccessMessage = (name: string) => {
+  return i18n.translate(
+    'xpack.securitySolution.hostIsolationExceptions.form.editingSuccessToastTitle',
+    {
+      defaultMessage: '"{name}" has been updated.',
+      values: { name },
+    }
+  );
+};
+
+export const getCreationSuccessMessage = (name: string) => {
+  return i18n.translate(
+    'xpack.securitySolution.hostIsolationExceptions.form.creationSuccessToastTitle',
+    {
+      defaultMessage: '"{name}" has been added to the host isolation exceptions list.',
+      values: { name },
+    }
+  );
+};
diff --git a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/host_isolation_exceptions_list.tsx b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/host_isolation_exceptions_list.tsx
index cfb0121396e24e..3c634a917c0cef 100644
--- a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/host_isolation_exceptions_list.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/host_isolation_exceptions_list.tsx
@@ -33,19 +33,16 @@ import { HostIsolationExceptionsEmptyState } from './components/empty';
 import { HostIsolationExceptionsPageAction } from '../store/action';
 import { HostIsolationExceptionDeleteModal } from './components/delete_modal';
 import { HostIsolationExceptionsFormFlyout } from './components/form_flyout';
+import {
+  DELETE_HOST_ISOLATION_EXCEPTION_LABEL,
+  EDIT_HOST_ISOLATION_EXCEPTION_LABEL,
+} from './components/translations';
 
 type HostIsolationExceptionPaginatedContent = PaginatedContentProps<
   Immutable<ExceptionListItemSchema>,
   typeof ExceptionItem
 >;
 
-const DELETE_HOST_ISOLATION_EXCEPTION_LABEL = i18n.translate(
-  'xpack.securitySolution.hostIsolationExceptions.list.actions.delete',
-  {
-    defaultMessage: 'Delete Exception',
-  }
-);
-
 export const HostIsolationExceptionsList = () => {
   const listItems = useHostIsolationExceptionsSelector(getListItems);
   const pagination = useHostIsolationExceptionsSelector(getListPagination);
@@ -70,6 +67,17 @@ export const HostIsolationExceptionsList = () => {
     item: element,
     'data-test-subj': `hostIsolationExceptionsCard`,
     actions: [
+      {
+        icon: 'trash',
+        onClick: () => {
+          navigateCallback({
+            show: 'edit',
+            id: element.id,
+          });
+        },
+        'data-test-subj': 'editHostIsolationException',
+        children: EDIT_HOST_ISOLATION_EXCEPTION_LABEL,
+      },
       {
         icon: 'trash',
         onClick: () => {
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.ts
index f772986bff1469..0ff6282f8a0187 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.ts
@@ -412,8 +412,8 @@ const fetchEditTrustedAppIfNeeded = async (
         dispatch({
           type: 'trustedAppCreationEditItemStateChanged',
           payload: {
-            type: 'LoadingResourceState',
             // @ts-expect-error-next-line will be fixed with when AsyncResourceState is refactored (#830)
+            type: 'LoadingResourceState',
             previousState: editItemState(currentState)!,
           },
         });

From 5ee779c3c244d0be457a304d4708163f6cae26de Mon Sep 17 00:00:00 2001
From: Mark Hopkin <mark.hopkin@elastic.co>
Date: Thu, 14 Oct 2021 11:42:14 +0100
Subject: [PATCH 46/71] remove stray semicolon (#114969)

---
 .../fleet/sections/agent_policy/details_page/index.tsx          | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/details_page/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/details_page/index.tsx
index 76994feb18fead..c1d0e089fcc65d 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/details_page/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/details_page/index.tsx
@@ -343,7 +343,7 @@ export const AgentPolicyDetailsPage: React.FunctionComponent = () => {
             />
           </EuiPortal>
         )}
-        <AgentPolicyDetailsContent agentPolicy={agentPolicy} />;
+        <AgentPolicyDetailsContent agentPolicy={agentPolicy} />
       </>
     );
   }, [

From 06e469394a06d56c40a1a7e896da1d152c87bc5e Mon Sep 17 00:00:00 2001
From: Gloria Hornero <snootchie.boochies@gmail.com>
Date: Thu, 14 Oct 2021 13:15:02 +0200
Subject: [PATCH 47/71] cleanup (#114902)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../cypress/screens/alerts.ts                 | 11 -----
 .../cypress/screens/alerts_details.ts         |  6 ---
 .../cypress/screens/alerts_detection_rules.ts | 10 -----
 .../cypress/screens/all_cases.ts              |  6 ---
 .../cypress/screens/case_details.ts           |  9 -----
 .../cypress/screens/common/callouts.ts        |  2 -
 .../cypress/screens/configure_cases.ts        |  2 -
 .../cypress/screens/create_new_rule.ts        | 11 -----
 .../cypress/screens/edit_rule.ts              |  1 -
 .../cypress/screens/exceptions.ts             |  4 --
 .../cypress/screens/fields_browser.ts         | 11 -----
 .../cypress/screens/hosts/events.ts           | 10 -----
 .../cypress/screens/hosts/main.ts             |  2 -
 .../cypress/screens/rule_details.ts           |  4 --
 .../cypress/screens/shared.ts                 |  2 -
 .../cypress/screens/sourcerer.ts              |  1 -
 .../cypress/screens/timeline.ts               | 40 -------------------
 .../cypress/screens/timelines.ts              |  2 -
 .../security_solution/cypress/tasks/alerts.ts | 16 --------
 .../cypress/tasks/alerts_detection_rules.ts   | 25 +-----------
 .../cypress/tasks/case_details.ts             | 13 +-----
 .../cypress/tasks/create_new_rule.ts          |  5 ---
 .../cypress/tasks/exceptions.ts               | 21 ----------
 .../cypress/tasks/exceptions_table.ts         |  5 ---
 .../cypress/tasks/fields_browser.ts           | 13 ------
 .../cypress/tasks/hosts/events.ts             | 12 ------
 .../cypress/tasks/security_header.ts          |  4 --
 .../cypress/tasks/security_main.ts            |  8 ----
 .../cypress/tasks/timeline.ts                 | 25 ------------
 29 files changed, 2 insertions(+), 279 deletions(-)

diff --git a/x-pack/plugins/security_solution/cypress/screens/alerts.ts b/x-pack/plugins/security_solution/cypress/screens/alerts.ts
index d18a8e1ba10ab5..0a815705f5b21f 100644
--- a/x-pack/plugins/security_solution/cypress/screens/alerts.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/alerts.ts
@@ -16,8 +16,6 @@ export const ALERT_CHECKBOX = '[data-test-subj="select-event"].euiCheckbox__inpu
 
 export const ALERT_GRID_CELL = '[data-test-subj="dataGridRowCell"]';
 
-export const ALERT_ID = '[data-test-subj="draggable-content-_id"]';
-
 export const ALERT_RISK_SCORE_HEADER =
   '[data-test-subj="dataGridHeaderCell-signal.rule.risk_score"]';
 
@@ -45,26 +43,17 @@ export const MANAGE_ALERT_DETECTION_RULES_BTN = '[data-test-subj="manage-alert-d
 
 export const MARK_ALERT_ACKNOWLEDGED_BTN = '[data-test-subj="acknowledged-alert-status"]';
 
-export const MARK_SELECTED_ALERTS_ACKNOWLEDGED_BTN =
-  '[data-test-subj="markSelectedAlertsAcknowledgedButton"]';
-
 export const NUMBER_OF_ALERTS =
   '[data-test-subj="events-viewer-panel"] [data-test-subj="server-side-event-count"]';
 
 export const OPEN_ALERT_BTN = '[data-test-subj="open-alert-status"]';
 
-export const OPEN_SELECTED_ALERTS_BTN = '[data-test-subj="openSelectedAlertsButton"]';
-
 export const OPENED_ALERTS_FILTER_BTN = '[data-test-subj="openAlerts"]';
 
-export const SELECT_EVENT_CHECKBOX = '[data-test-subj="select-event"]';
-
 export const SELECTED_ALERTS = '[data-test-subj="selectedShowBulkActionsButton"]';
 
 export const SEND_ALERT_TO_TIMELINE_BTN = '[data-test-subj="send-alert-to-timeline-button"]';
 
-export const SHOWING_ALERTS = '[data-test-subj="showingAlerts"]';
-
 export const TAKE_ACTION_POPOVER_BTN = '[data-test-subj="selectedShowBulkActionsButton"]';
 
 export const TIMELINE_CONTEXT_MENU_BTN = '[data-test-subj="timeline-context-menu-button"]';
diff --git a/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts b/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts
index 2c288aa59374cd..c740a669d059a8 100644
--- a/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts
@@ -24,8 +24,6 @@ export const INVESTIGATION_TIME_ENRICHMENT_SECTION =
 
 export const JSON_VIEW_WRAPPER = '[data-test-subj="jsonViewWrapper"]';
 
-export const JSON_CONTENT = '[data-test-subj="jsonView"]';
-
 export const JSON_LINES = '.euiCodeBlock__line';
 
 export const JSON_VIEW_TAB = '[data-test-subj="jsonViewTab"]';
@@ -36,16 +34,12 @@ export const TABLE_TAB = '[data-test-subj="tableTab"]';
 
 export const TABLE_ROWS = '.euiTableRow';
 
-export const THREAT_CONTENT = '[data-test-subj^=draggable-content-]';
-
 export const THREAT_DETAILS_ACCORDION = '.euiAccordion__triggerWrapper';
 
 export const THREAT_DETAILS_VIEW = '[data-test-subj="threat-details-view-0"]';
 
 export const THREAT_INTEL_TAB = '[data-test-subj="threatIntelTab"]';
 
-export const THREAT_SUMMARY_VIEW = '[data-test-subj="threat-summary-view"]';
-
 export const TITLE = '.euiTitle';
 
 export const UPDATE_ENRICHMENT_RANGE_BUTTON = '[data-test-subj="enrichment-button"]';
diff --git a/x-pack/plugins/security_solution/cypress/screens/alerts_detection_rules.ts b/x-pack/plugins/security_solution/cypress/screens/alerts_detection_rules.ts
index 315796a715cd3e..39e08e29bdc2a1 100644
--- a/x-pack/plugins/security_solution/cypress/screens/alerts_detection_rules.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/alerts_detection_rules.ts
@@ -21,14 +21,10 @@ export const DUPLICATE_RULE_ACTION_BTN = '[data-test-subj="duplicateRuleAction"]
 
 export const DUPLICATE_RULE_MENU_PANEL_BTN = '[data-test-subj="rules-details-duplicate-rule"]';
 
-export const REFRESH_BTN = '[data-test-subj="refreshRulesAction"] button';
-
 export const ACTIVATE_RULE_BULK_BTN = '[data-test-subj="activateRuleBulk"]';
 
 export const DEACTIVATE_RULE_BULK_BTN = '[data-test-subj="deactivateRuleBulk"]';
 
-export const EXPORT_RULE_BULK_BTN = '[data-test-subj="exportRuleBulk"]';
-
 export const DELETE_RULE_BULK_BTN = '[data-test-subj="deleteRuleBulk"]';
 
 export const DUPLICATE_RULE_BULK_BTN = '[data-test-subj="duplicateRuleBulk"]';
@@ -37,8 +33,6 @@ export const ELASTIC_RULES_BTN = '[data-test-subj="showElasticRulesFilterButton"
 
 export const EXPORT_ACTION_BTN = '[data-test-subj="exportRuleAction"]';
 
-export const FIFTH_RULE = 4;
-
 export const FIRST_RULE = 0;
 
 export const FOURTH_RULE = 3;
@@ -72,8 +66,6 @@ export const RULES_ROW = '.euiTableRow';
 
 export const RULES_MONIROTING_TABLE = '[data-test-subj="allRulesTableTab-monitoring"]';
 
-export const SEVENTH_RULE = 6;
-
 export const SEVERITY = '[data-test-subj="severity"]';
 
 export const SHOWING_RULES_TEXT = '[data-test-subj="showingRules"]';
@@ -92,8 +84,6 @@ export const rowsPerPageSelector = (count: number) =>
 export const pageSelector = (pageNumber: number) =>
   `[data-test-subj="pagination-button-${pageNumber - 1}"]`;
 
-export const NEXT_BTN = '[data-test-subj="pagination-button-next"]';
-
 export const SELECT_ALL_RULES_BTN = '[data-test-subj="selectAllRules"]';
 
 export const RULES_EMPTY_PROMPT = '[data-test-subj="rulesEmptyPrompt"]';
diff --git a/x-pack/plugins/security_solution/cypress/screens/all_cases.ts b/x-pack/plugins/security_solution/cypress/screens/all_cases.ts
index fa6b6add57bacd..9d653fb384a1a4 100644
--- a/x-pack/plugins/security_solution/cypress/screens/all_cases.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/all_cases.ts
@@ -5,10 +5,6 @@
  * 2.0.
  */
 
-export const ALL_CASES_CASE = (id: string) => {
-  return `[data-test-subj="cases-table-row-${id}"]`;
-};
-
 export const ALL_CASES_CLOSED_CASES_STATS = '[data-test-subj="closedStatsHeader"]';
 
 export const ALL_CASES_COMMENTS_COUNT = '[data-test-subj="case-table-column-commentCount"]';
@@ -19,8 +15,6 @@ export const ALL_CASES_CREATE_NEW_CASE_TABLE_BTN = '[data-test-subj="cases-table
 
 export const ALL_CASES_IN_PROGRESS_CASES_STATS = '[data-test-subj="inProgressStatsHeader"]';
 
-export const ALL_CASES_ITEM_ACTIONS_BTN = '[data-test-subj="euiCollapsedItemActionsButton"]';
-
 export const ALL_CASES_NAME = '[data-test-subj="case-details-link"]';
 
 export const ALL_CASES_OPEN_CASES_COUNT = '[data-test-subj="case-status-filter"]';
diff --git a/x-pack/plugins/security_solution/cypress/screens/case_details.ts b/x-pack/plugins/security_solution/cypress/screens/case_details.ts
index ef8f45b222dd07..8ec9a3fdacffc0 100644
--- a/x-pack/plugins/security_solution/cypress/screens/case_details.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/case_details.ts
@@ -5,16 +5,11 @@
  * 2.0.
  */
 
-export const CASE_ACTIONS_BTN = '[data-test-subj="property-actions-ellipses"]';
-
 export const CASE_DETAILS_DESCRIPTION =
   '[data-test-subj="description-action"] [data-test-subj="user-action-markdown"]';
 
 export const CASE_DETAILS_PAGE_TITLE = '[data-test-subj="header-page-title"]';
 
-export const CASE_DETAILS_PUSH_TO_EXTERNAL_SERVICE_BTN =
-  '[data-test-subj="push-to-external-service"]';
-
 export const CASE_DETAILS_STATUS = '[data-test-subj="case-view-status-dropdown"]';
 
 export const CASE_DETAILS_TAGS = '[data-test-subj="case-tags"]';
@@ -34,10 +29,6 @@ export const CONNECTOR_CARD_DETAILS = '[data-test-subj="connector-card"]';
 
 export const CONNECTOR_TITLE = '[data-test-subj="connector-card"] span.euiTitle';
 
-export const DELETE_CASE_BTN = '[data-test-subj="property-actions-trash"]';
-
-export const DELETE_CASE_CONFIRMATION_BTN = '[data-test-subj="confirmModalConfirmButton"]';
-
 export const PARTICIPANTS = 1;
 
 export const REPORTER = 0;
diff --git a/x-pack/plugins/security_solution/cypress/screens/common/callouts.ts b/x-pack/plugins/security_solution/cypress/screens/common/callouts.ts
index 032d244f769770..d2dbf6da4aed2f 100644
--- a/x-pack/plugins/security_solution/cypress/screens/common/callouts.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/common/callouts.ts
@@ -5,8 +5,6 @@
  * 2.0.
  */
 
-export const CALLOUT = '[data-test-subj^="callout-"]';
-
 export const callOutWithId = (id: string) => `[data-test-subj^="callout-${id}"]`;
 
 export const CALLOUT_DISMISS_BTN = '[data-test-subj^="callout-dismiss-"]';
diff --git a/x-pack/plugins/security_solution/cypress/screens/configure_cases.ts b/x-pack/plugins/security_solution/cypress/screens/configure_cases.ts
index 1ad91ed0977a00..1014835f81efed 100644
--- a/x-pack/plugins/security_solution/cypress/screens/configure_cases.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/configure_cases.ts
@@ -20,8 +20,6 @@ export const PASSWORD = '[data-test-subj="connector-servicenow-password-form-inp
 
 export const SAVE_BTN = '[data-test-subj="saveNewActionButton"]';
 
-export const SAVE_CHANGES_BTN = '[data-test-subj="case-configure-action-bottom-bar-save-button"]';
-
 export const SERVICE_NOW_CONNECTOR_CARD = '[data-test-subj=".servicenow-card"]';
 
 export const TOASTER = '[data-test-subj="euiToastHeader"]';
diff --git a/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts b/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts
index 4748a48dbeb11f..3510df6186870a 100644
--- a/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts
@@ -58,8 +58,6 @@ export const COMBO_BOX_CLEAR_BTN = '[data-test-subj="comboBoxClearButton"]';
 
 export const COMBO_BOX_INPUT = '[data-test-subj="comboBoxInput"]';
 
-export const COMBO_BOX_RESULT = '.euiFilterSelectItem';
-
 export const CREATE_AND_ACTIVATE_BTN = '[data-test-subj="create-activate"]';
 
 export const CUSTOM_QUERY_INPUT = '[data-test-subj="queryInput"]';
@@ -70,9 +68,6 @@ export const THREAT_MAPPING_COMBO_BOX_INPUT =
 export const THREAT_MATCH_CUSTOM_QUERY_INPUT =
   '[data-test-subj="detectionEngineStepDefineRuleQueryBar"] [data-test-subj="queryInput"]';
 
-export const THREAT_MATCH_INDICATOR_QUERY_INPUT =
-  '[data-test-subj="detectionEngineStepDefineRuleThreatMatchIndices"] [data-test-subj="queryInput"]';
-
 export const THREAT_MATCH_QUERY_INPUT =
   '[data-test-subj="detectionEngineStepDefineThreatRuleQueryBar"] [data-test-subj="queryInput"]';
 
@@ -206,12 +201,6 @@ export const SCHEDULE_INTERVAL_AMOUNT_INPUT =
 export const SCHEDULE_INTERVAL_UNITS_INPUT =
   '[data-test-subj="detectionEngineStepScheduleRuleInterval"] [data-test-subj="timeType"]';
 
-export const SCHEDULE_LOOKBACK_AMOUNT_INPUT =
-  '[data-test-subj="detectionEngineStepScheduleRuleFrom"] [data-test-subj="timeType"]';
-
-export const SCHEDULE_LOOKBACK_UNITS_INPUT =
-  '[data-test-subj="detectionEngineStepScheduleRuleFrom"] [data-test-subj="schedule-units-input"]';
-
 export const SEVERITY_DROPDOWN =
   '[data-test-subj="detectionEngineStepAboutRuleSeverity"] [data-test-subj="select"]';
 
diff --git a/x-pack/plugins/security_solution/cypress/screens/edit_rule.ts b/x-pack/plugins/security_solution/cypress/screens/edit_rule.ts
index 8d8520e109b15e..73f3640071251f 100644
--- a/x-pack/plugins/security_solution/cypress/screens/edit_rule.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/edit_rule.ts
@@ -7,5 +7,4 @@
 
 export const EDIT_SUBMIT_BUTTON = '[data-test-subj="ruleEditSubmitButton"]';
 export const BACK_TO_RULE_DETAILS = '[data-test-subj="ruleEditBackToRuleDetails"]';
-export const KIBANA_LOADING_INDICATOR = '[data-test-subj="globalLoadingIndicator"]';
 export const KIBANA_LOADING_COMPLETE_INDICATOR = '[data-test-subj="globalLoadingIndicator-hidden"]';
diff --git a/x-pack/plugins/security_solution/cypress/screens/exceptions.ts b/x-pack/plugins/security_solution/cypress/screens/exceptions.ts
index bd6d3b78872063..e5027ee8b4f3ae 100644
--- a/x-pack/plugins/security_solution/cypress/screens/exceptions.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/exceptions.ts
@@ -32,14 +32,10 @@ export const ADD_NESTED_BTN = '[data-test-subj="exceptionsNestedButton"]';
 
 export const ENTRY_DELETE_BTN = '[data-test-subj="builderItemEntryDeleteButton"]';
 
-export const FIELD_INPUT_LIST_BTN = '[data-test-subj="comboBoxToggleListButton"]';
-
 export const CANCEL_BTN = '[data-test-subj="cancelExceptionAddButton"]';
 
 export const BUILDER_MODAL_BODY = '[data-test-subj="exceptionsBuilderWrapper"]';
 
-export const EXCEPTIONS_TABLE_TAB = '[data-test-subj="allRulesTableTab-exceptions"]';
-
 export const EXCEPTIONS_TABLE = '[data-test-subj="exceptions-table"]';
 
 export const EXCEPTIONS_TABLE_SEARCH = '[data-test-subj="exceptionsHeaderSearchInput"]';
diff --git a/x-pack/plugins/security_solution/cypress/screens/fields_browser.ts b/x-pack/plugins/security_solution/cypress/screens/fields_browser.ts
index 1115dfb00914ee..4a5f813c301db0 100644
--- a/x-pack/plugins/security_solution/cypress/screens/fields_browser.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/fields_browser.ts
@@ -15,14 +15,10 @@ export const FIELDS_BROWSER_CHECKBOX = (id: string) => {
 
 export const FIELDS_BROWSER_CONTAINER = '[data-test-subj="fields-browser-container"]';
 
-export const FIELDS_BROWSER_DRAGGABLE_HOST_GEO_COUNTRY_NAME_HEADER = `${FIELDS_BROWSER_CONTAINER} [data-test-subj="field-name-host.geo.country_name"]`;
-
 export const FIELDS_BROWSER_FIELDS_COUNT = `${FIELDS_BROWSER_CONTAINER} [data-test-subj="fields-count"]`;
 
 export const FIELDS_BROWSER_FILTER_INPUT = `${FIELDS_BROWSER_CONTAINER} [data-test-subj="field-search"]`;
 
-export const FIELDS_BROWSER_HEADER_DROP_AREA = '[data-test-subj="headers-group"]';
-
 export const FIELDS_BROWSER_HOST_CATEGORIES_COUNT = `${FIELDS_BROWSER_CONTAINER} [data-test-subj="host-category-count"]`;
 
 export const FIELDS_BROWSER_HOST_GEO_CITY_NAME_CHECKBOX = `${FIELDS_BROWSER_CONTAINER} [data-test-subj="field-host.geo.city_name-checkbox"]`;
@@ -35,11 +31,6 @@ export const FIELDS_BROWSER_HOST_GEO_CONTINENT_NAME_CHECKBOX = `${FIELDS_BROWSER
 export const FIELDS_BROWSER_HEADER_HOST_GEO_CONTINENT_NAME_HEADER =
   '[data-test-subj="timeline"] [data-test-subj="header-text-host.geo.continent_name"]';
 
-export const FIELDS_BROWSER_HOST_GEO_COUNTRY_NAME_CHECKBOX = `${FIELDS_BROWSER_CONTAINER} [data-test-subj="field-host.geo.country_name-checkbox"]`;
-
-export const FIELDS_BROWSER_HOST_GEO_COUNTRY_NAME_HEADER =
-  '[data-test-subj="timeline"] [data-test-subj="header-text-host.geo.country_name"]';
-
 export const FIELDS_BROWSER_MESSAGE_CHECKBOX = `${FIELDS_BROWSER_CONTAINER} [data-test-subj="field-message-checkbox"]`;
 
 export const FIELDS_BROWSER_MESSAGE_HEADER =
@@ -47,8 +38,6 @@ export const FIELDS_BROWSER_MESSAGE_HEADER =
 
 export const FIELDS_BROWSER_RESET_FIELDS = `${FIELDS_BROWSER_CONTAINER} [data-test-subj="reset-fields"]`;
 
-export const FIELDS_BROWSER_TITLE = `${FIELDS_BROWSER_CONTAINER} [data-test-subj="field-browser-title"]`;
-
 export const FIELDS_BROWSER_SELECTED_CATEGORY_COUNT = `${FIELDS_BROWSER_CONTAINER} [data-test-subj="selected-category-count-badge"]`;
 
 export const FIELDS_BROWSER_SELECTED_CATEGORY_TITLE = `${FIELDS_BROWSER_CONTAINER} [data-test-subj="selected-category-title"]`;
diff --git a/x-pack/plugins/security_solution/cypress/screens/hosts/events.ts b/x-pack/plugins/security_solution/cypress/screens/hosts/events.ts
index de4acdd721c685..57de63b92a08bf 100644
--- a/x-pack/plugins/security_solution/cypress/screens/hosts/events.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/hosts/events.ts
@@ -5,18 +5,11 @@
  * 2.0.
  */
 
-export const CLOSE_MODAL = '[data-test-subj="modal-inspect-close"]';
-
 export const EVENTS_VIEWER_FIELDS_BUTTON =
   '[data-test-subj="events-viewer-panel"] [data-test-subj="show-field-browser"]';
 
-export const EVENTS_VIEWER_PANEL = '[data-test-subj="events-viewer-panel"]';
-
 export const FIELDS_BROWSER_CONTAINER = '[data-test-subj="fields-browser-container"]';
 
-export const HEADER_SUBTITLE =
-  '[data-test-subj="events-viewer-panel"] [data-test-subj="header-panel-subtitle"]';
-
 export const HOST_GEO_CITY_NAME_CHECKBOX = '[data-test-subj="field-host.geo.city_name-checkbox"]';
 
 export const HOST_GEO_CITY_NAME_HEADER =
@@ -32,9 +25,6 @@ export const INSPECT_MODAL = '[data-test-subj="modal-inspect-euiModal"]';
 export const INSPECT_QUERY =
   '[data-test-subj="events-viewer-panel"] [data-test-subj="inspect-icon-button"]';
 
-export const LOAD_MORE =
-  '[data-test-subj="events-viewer-panel"] [data-test-subj="TimelineMoreButton"';
-
 export const SERVER_SIDE_EVENT_COUNT = '[data-test-subj="server-side-event-count"]';
 
 export const EVENTS_VIEWER_PAGINATION =
diff --git a/x-pack/plugins/security_solution/cypress/screens/hosts/main.ts b/x-pack/plugins/security_solution/cypress/screens/hosts/main.ts
index 95381b06f44e92..4f1dd8387c63f2 100644
--- a/x-pack/plugins/security_solution/cypress/screens/hosts/main.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/hosts/main.ts
@@ -13,8 +13,6 @@ export const AUTHENTICATIONS_TAB = '[data-test-subj="navigation-authentications"
 
 export const EVENTS_TAB = '[data-test-subj="navigation-events"]';
 
-export const KQL_SEARCH_BAR = '[data-test-subj="queryInput"]';
-
 export const UNCOMMON_PROCESSES_TAB = '[data-test-subj="navigation-uncommonProcesses"]';
 
 export const HOST_OVERVIEW = `[data-test-subj="host-overview"]`;
diff --git a/x-pack/plugins/security_solution/cypress/screens/rule_details.ts b/x-pack/plugins/security_solution/cypress/screens/rule_details.ts
index 9bc22f35741d9b..fb1fded1fe8a6e 100644
--- a/x-pack/plugins/security_solution/cypress/screens/rule_details.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/rule_details.ts
@@ -58,8 +58,6 @@ export const FIELDS_BROWSER_BTN =
 
 export const REFRESH_BUTTON = '[data-test-subj="refreshButton"]';
 
-export const RULE_ABOUT_DETAILS_HEADER_TOGGLE = '[data-test-subj="stepAboutDetailsToggle"]';
-
 export const RULE_NAME_HEADER = '[data-test-subj="header-page-title"]';
 
 export const RULE_NAME_OVERRIDE_DETAILS = 'Rule name override';
@@ -83,8 +81,6 @@ export const RUNS_EVERY_DETAILS = 'Runs every';
 export const SCHEDULE_DETAILS =
   '[data-test-subj=schedule] [data-test-subj="listItemColumnStepRuleDescription"]';
 
-export const SCHEDULE_STEP = '[data-test-subj="schedule"]  .euiDescriptionList__description';
-
 export const SEVERITY_DETAILS = 'Severity';
 
 export const TAGS_DETAILS = 'Tags';
diff --git a/x-pack/plugins/security_solution/cypress/screens/shared.ts b/x-pack/plugins/security_solution/cypress/screens/shared.ts
index 99a0e423c563ab..8a7ba48b1415d6 100644
--- a/x-pack/plugins/security_solution/cypress/screens/shared.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/shared.ts
@@ -5,6 +5,4 @@
  * 2.0.
  */
 
-export const NOTIFICATION_TOASTS = '[data-test-subj="globalToastList"]';
-
 export const TOAST_ERROR = '.euiToast--danger';
diff --git a/x-pack/plugins/security_solution/cypress/screens/sourcerer.ts b/x-pack/plugins/security_solution/cypress/screens/sourcerer.ts
index 142307735d3406..874fc7352e9089 100644
--- a/x-pack/plugins/security_solution/cypress/screens/sourcerer.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/sourcerer.ts
@@ -28,4 +28,3 @@ export const SOURCERER_TIMELINE = {
   radioCustomLabel:
     '[data-test-subj="timeline-sourcerer-radio"] label.euiRadio__label[for="custom"]',
 };
-export const SOURCERER_TIMELINE_ADVANCED = '[data-test-subj="advanced-settings"]';
diff --git a/x-pack/plugins/security_solution/cypress/screens/timeline.ts b/x-pack/plugins/security_solution/cypress/screens/timeline.ts
index 4cf5d2f87f7a99..2e412bbed6fdce 100644
--- a/x-pack/plugins/security_solution/cypress/screens/timeline.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/timeline.ts
@@ -26,8 +26,6 @@ export const CASE = (id: string) => {
 
 export const CLOSE_TIMELINE_BTN = '[data-test-subj="close-timeline"]';
 
-export const COLUMN_HEADERS = '[data-test-subj="column-headers"] [data-test-subj^=header-text]';
-
 export const COMBO_BOX = '.euiComboBoxOption__content';
 
 export const CREATE_NEW_TIMELINE = '[data-test-subj="timeline-new"]';
@@ -41,17 +39,8 @@ export const FAVORITE_TIMELINE = '[data-test-subj="timeline-favorite-filled-star
 
 export const FIELD_BROWSER = '[data-test-subj="show-field-browser"]';
 
-export const GRAPH_TAB_BUTTON = '[data-test-subj="timelineTabs-graph"]';
-
-export const HEADER = '[data-test-subj="header"]';
-
-export const HEADERS_GROUP =
-  '[data-test-subj="events-viewer-panel"] [data-test-subj="headers-group"]';
-
 export const ID_HEADER_FIELD = '[data-test-subj="timeline"] [data-test-subj="header-text-_id"]';
 
-export const ID_FIELD = '[data-test-subj="timeline"] [data-test-subj="field-name-_id"]';
-
 export const ID_TOGGLE_FIELD = '[data-test-subj="toggle-field-_id"]';
 
 export const ID_HOVER_ACTION_OVERFLOW_BTN = '[data-test-subj="more-actions-_id"]';
@@ -66,11 +55,6 @@ export const NOTE_CARD_CONTENT = '[data-test-subj="notes"]';
 
 export const EVENT_NOTE = '[data-test-subj="timeline-notes-button-small"]';
 
-export const NOTE_BY_NOTE_ID = (noteId: string) =>
-  `[data-test-subj="note-preview-${noteId}"] .euiMarkdownFormat`;
-
-export const NOTE_CONTENT = (noteId: string) => `${NOTE_BY_NOTE_ID(noteId)} p`;
-
 export const NOTES_TEXT_AREA = '[data-test-subj="add-a-note"] textarea';
 
 export const NOTES_TAB_BUTTON = '[data-test-subj="timelineTabs-notes"]';
@@ -96,12 +80,8 @@ export const OPEN_TIMELINE_TEMPLATE_ICON =
 
 export const PIN_EVENT = '[data-test-subj="pin"]';
 
-export const PINNED_TAB_BUTTON = '[data-test-subj="timelineTabs-pinned"]';
-
 export const PROVIDER_BADGE = '[data-test-subj="providerBadge"]';
 
-export const REMOVE_COLUMN = '[data-test-subj="remove-column"]';
-
 export const RESET_FIELDS =
   '[data-test-subj="fields-browser-container"] [data-test-subj="reset-fields"]';
 
@@ -112,18 +92,6 @@ export const SEARCH_OR_FILTER_CONTAINER =
 
 export const INDICATOR_MATCH_ROW_RENDER = '[data-test-subj="threat-match-row"]';
 
-export const QUERY_TAB_EVENTS_TABLE = '[data-test-subj="query-events-table"]';
-
-export const QUERY_TAB_EVENTS_BODY = '[data-test-subj="query-tab-flyout-body"]';
-
-export const QUERY_TAB_EVENTS_FOOTER = '[data-test-subj="query-tab-flyout-footer"]';
-
-export const PINNED_TAB_EVENTS_TABLE = '[data-test-subj="pinned-events-table"]';
-
-export const PINNED_TAB_EVENTS_BODY = '[data-test-subj="pinned-tab-flyout-body"]';
-
-export const PINNED_TAB_EVENTS_FOOTER = '[data-test-subj="pinned-tab-flyout-footer"]';
-
 export const QUERY_TAB_BUTTON = '[data-test-subj="timelineTabs-query"]';
 
 export const SERVER_SIDE_EVENT_COUNT = '[data-test-subj="server-side-event-count"]';
@@ -145,8 +113,6 @@ export const TIMELINE_CORRELATION_INPUT = '[data-test-subj="eqlQueryBarTextInput
 
 export const TIMELINE_CORRELATION_TAB = '[data-test-subj="timelineTabs-eql"]';
 
-export const TIMELINE_BOTTOM_BAR_CONTAINER = '[data-test-subj="timeline-bottom-bar-container"]';
-
 export const TIMELINE_DATA_PROVIDERS_ACTION_MENU = '[data-test-subj="providerActions"]';
 
 export const TIMELINE_ADD_FIELD_BUTTON = '[data-test-subj="addField"]';
@@ -213,8 +179,6 @@ export const TIMELINE_SETTINGS_ICON = '[data-test-subj="settings-plus-in-circle"
 
 export const TIMELINE_SEARCH_OR_FILTER = '[data-test-subj="timeline-select-search-or-filter"]';
 
-export const TIMELINE_SEARCH_OR_FILTER_CONTENT = '.searchOrFilterPopover';
-
 export const TIMELINE_KQLMODE_SEARCH = '[data-test-subj="kqlModePopoverSearch"]';
 
 export const TIMELINE_KQLMODE_FILTER = '[data-test-subj="kqlModePopoverFilter"]';
@@ -257,10 +221,6 @@ export const TIMELINE_TABS = '[data-test-subj="timeline"] .euiTabs';
 
 export const TIMELINE_TAB_CONTENT_EQL = '[data-test-subj="timeline-tab-content-eql"]';
 
-export const TIMELINE_TAB_CONTENT_QUERY = '[data-test-subj="timeline-tab-content-query"]';
-
-export const TIMELINE_TAB_CONTENT_PINNED = '[data-test-subj="timeline-tab-content-pinned"]';
-
 export const TIMELINE_TAB_CONTENT_GRAPHS_NOTES =
   '[data-test-subj="timeline-tab-content-graph-notes"]';
 
diff --git a/x-pack/plugins/security_solution/cypress/screens/timelines.ts b/x-pack/plugins/security_solution/cypress/screens/timelines.ts
index ab6c790c599abf..ca60250330f83d 100644
--- a/x-pack/plugins/security_solution/cypress/screens/timelines.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/timelines.ts
@@ -27,6 +27,4 @@ export const TIMELINES_PINNED_EVENT_COUNT = '[data-test-subj="pinned-event-count
 
 export const TIMELINES_TABLE = '[data-test-subj="timelines-table"]';
 
-export const TIMELINES_USERNAME = '[data-test-subj="username"]';
-
 export const REFRESH_BUTTON = '[data-test-subj="refreshButton-linkIcon"]';
diff --git a/x-pack/plugins/security_solution/cypress/tasks/alerts.ts b/x-pack/plugins/security_solution/cypress/tasks/alerts.ts
index 5b8ad49f61b0da..067c9957189b9e 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/alerts.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/alerts.ts
@@ -17,13 +17,11 @@ import {
   LOADING_ALERTS_PANEL,
   MANAGE_ALERT_DETECTION_RULES_BTN,
   MARK_ALERT_ACKNOWLEDGED_BTN,
-  MARK_SELECTED_ALERTS_ACKNOWLEDGED_BTN,
   OPEN_ALERT_BTN,
   OPENED_ALERTS_FILTER_BTN,
   SEND_ALERT_TO_TIMELINE_BTN,
   TAKE_ACTION_POPOVER_BTN,
   TIMELINE_CONTEXT_MENU_BTN,
-  SELECT_EVENT_CHECKBOX,
 } from '../screens/alerts';
 import { LOADING_INDICATOR, REFRESH_BUTTON } from '../screens/security_header';
 import { TIMELINE_COLUMN_SPINNER } from '../screens/timeline';
@@ -73,10 +71,6 @@ export const expandFirstAlert = () => {
 
 export const viewThreatIntelTab = () => cy.get(THREAT_INTEL_TAB).click();
 
-export const viewThreatDetails = () => {
-  cy.get(EXPAND_ALERT_BTN).first().click({ force: true });
-};
-
 export const setEnrichmentDates = (from?: string, to?: string) => {
   cy.get(ENRICHMENT_QUERY_RANGE_PICKER).within(() => {
     if (from) {
@@ -130,11 +124,6 @@ export const markAcknowledgedFirstAlert = () => {
   cy.get(MARK_ALERT_ACKNOWLEDGED_BTN).click();
 };
 
-export const markAcknowledgedAlerts = () => {
-  cy.get(TAKE_ACTION_POPOVER_BTN).click({ force: true });
-  cy.get(MARK_SELECTED_ALERTS_ACKNOWLEDGED_BTN).click();
-};
-
 export const selectNumberOfAlerts = (numberOfAlerts: number) => {
   for (let i = 0; i < numberOfAlerts; i++) {
     cy.get(ALERT_CHECKBOX).eq(i).click({ force: true });
@@ -174,8 +163,3 @@ export const waitForAlertsPanelToBeLoaded = () => {
   cy.get(LOADING_ALERTS_PANEL).should('exist');
   cy.get(LOADING_ALERTS_PANEL).should('not.exist');
 };
-
-export const waitForAlertsToBeLoaded = () => {
-  const expectedNumberOfDisplayedAlerts = 25;
-  cy.get(SELECT_EVENT_CHECKBOX).should('have.length', expectedNumberOfDisplayedAlerts);
-};
diff --git a/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts b/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts
index 6b985c7009b274..84b81108f8be3a 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts
@@ -27,7 +27,6 @@ import {
   SORT_RULES_BTN,
   EXPORT_ACTION_BTN,
   EDIT_RULE_ACTION_BTN,
-  NEXT_BTN,
   RULE_AUTO_REFRESH_IDLE_MODAL,
   RULE_AUTO_REFRESH_IDLE_MODAL_CONTINUE,
   rowsPerPageSelector,
@@ -41,10 +40,9 @@ import {
   RULES_DELETE_CONFIRMATION_MODAL,
   ACTIVATE_RULE_BULK_BTN,
   DEACTIVATE_RULE_BULK_BTN,
-  EXPORT_RULE_BULK_BTN,
   RULE_DETAILS_DELETE_BTN,
 } from '../screens/alerts_detection_rules';
-import { ALL_ACTIONS, DELETE_RULE } from '../screens/rule_details';
+import { ALL_ACTIONS } from '../screens/rule_details';
 import { LOADING_INDICATOR } from '../screens/security_header';
 
 export const activateRule = (rulePosition: number) => {
@@ -97,11 +95,6 @@ export const deleteFirstRule = () => {
   cy.get(DELETE_RULE_ACTION_BTN).click();
 };
 
-export const deleteRule = () => {
-  cy.get(ALL_ACTIONS).click();
-  cy.get(DELETE_RULE).click();
-};
-
 export const deleteSelectedRules = () => {
   cy.get(BULK_ACTIONS_BTN).click({ force: true });
   cy.get(DELETE_RULE_BULK_BTN).click();
@@ -137,11 +130,6 @@ export const deactivateSelectedRules = () => {
   cy.get(DEACTIVATE_RULE_BULK_BTN).click();
 };
 
-export const exportSelectedRules = () => {
-  cy.get(BULK_ACTIONS_BTN).click({ force: true });
-  cy.get(EXPORT_RULE_BULK_BTN).click();
-};
-
 export const exportFirstRule = () => {
   cy.get(COLLAPSED_ACTION_BTN).first().click({ force: true });
   cy.get(EXPORT_ACTION_BTN).click();
@@ -214,11 +202,6 @@ export const waitForRulesTableToBeRefreshed = () => {
   cy.get(RULES_TABLE_REFRESH_INDICATOR).should('not.exist');
 };
 
-export const waitForRulesTableToBeAutoRefreshed = () => {
-  cy.get(RULES_TABLE_AUTOREFRESH_INDICATOR).should('exist');
-  cy.get(RULES_TABLE_AUTOREFRESH_INDICATOR).should('not.exist');
-};
-
 export const waitForPrebuiltDetectionRulesToBeLoaded = () => {
   cy.get(LOAD_PREBUILT_RULES_BTN).should('not.exist');
   cy.get(RULES_TABLE).should('exist');
@@ -273,9 +256,3 @@ export const goToPage = (pageNumber: number) => {
   cy.get(pageSelector(pageNumber)).last().click({ force: true });
   waitForRulesTableToBeRefreshed();
 };
-
-export const goToNextPage = () => {
-  cy.get(RULES_TABLE_REFRESH_INDICATOR).should('not.exist');
-  cy.get(NEXT_BTN).click({ force: true });
-  waitForRulesTableToBeRefreshed();
-};
diff --git a/x-pack/plugins/security_solution/cypress/tasks/case_details.ts b/x-pack/plugins/security_solution/cypress/tasks/case_details.ts
index f64c3c9d790073..57f6f24ee890a1 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/case_details.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/case_details.ts
@@ -6,18 +6,7 @@
  */
 
 import { TIMELINE_TITLE } from '../screens/timeline';
-import {
-  CASE_ACTIONS_BTN,
-  CASE_DETAILS_TIMELINE_LINK_MARKDOWN,
-  DELETE_CASE_BTN,
-  DELETE_CASE_CONFIRMATION_BTN,
-} from '../screens/case_details';
-
-export const deleteCase = () => {
-  cy.get(CASE_ACTIONS_BTN).first().click();
-  cy.get(DELETE_CASE_BTN).click();
-  cy.get(DELETE_CASE_CONFIRMATION_BTN).click();
-};
+import { CASE_DETAILS_TIMELINE_LINK_MARKDOWN } from '../screens/case_details';
 
 export const openCaseTimeline = () => {
   cy.get(CASE_DETAILS_TIMELINE_LINK_MARKDOWN).click();
diff --git a/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts b/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts
index b7fb0785736f67..591be21b5682b0 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts
@@ -32,7 +32,6 @@ import {
   CUSTOM_QUERY_REQUIRED,
   DEFAULT_RISK_SCORE_INPUT,
   DEFINE_CONTINUE_BUTTON,
-  DEFINE_EDIT_TAB,
   EQL_QUERY_INPUT,
   EQL_QUERY_PREVIEW_HISTOGRAM,
   EQL_QUERY_VALIDATION_SPINNER,
@@ -495,10 +494,6 @@ export const fillDefineMachineLearningRuleAndContinue = (rule: MachineLearningRu
   cy.get(MACHINE_LEARNING_DROPDOWN_INPUT).should('not.exist');
 };
 
-export const goToDefineStepTab = () => {
-  cy.get(DEFINE_EDIT_TAB).click({ force: true });
-};
-
 export const goToAboutStepTab = () => {
   cy.get(ABOUT_EDIT_TAB).click({ force: true });
 };
diff --git a/x-pack/plugins/security_solution/cypress/tasks/exceptions.ts b/x-pack/plugins/security_solution/cypress/tasks/exceptions.ts
index 97e93ef8194a47..4548c921890c8e 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/exceptions.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/exceptions.ts
@@ -5,11 +5,9 @@
  * 2.0.
  */
 
-import { Exception } from '../objects/exception';
 import {
   FIELD_INPUT,
   OPERATOR_INPUT,
-  VALUES_INPUT,
   CANCEL_BTN,
   BUILDER_MODAL_BODY,
   EXCEPTION_ITEM_CONTAINER,
@@ -38,25 +36,6 @@ export const addExceptionEntryOperatorValue = (operator: string, index = 0) => {
   cy.get(BUILDER_MODAL_BODY).click();
 };
 
-export const addExceptionEntryValue = (values: string[], index = 0) => {
-  values.forEach((value) => {
-    cy.get(VALUES_INPUT).eq(index).type(`${value}{enter}`);
-  });
-  cy.get(BUILDER_MODAL_BODY).click();
-};
-
-export const addExceptionEntry = (exception: Exception, index = 0) => {
-  addExceptionEntryFieldValue(exception.field, index);
-  addExceptionEntryOperatorValue(exception.operator, index);
-  addExceptionEntryValue(exception.values, index);
-};
-
-export const addNestedExceptionEntry = (exception: Exception, index = 0) => {
-  addExceptionEntryFieldValue(exception.field, index);
-  addExceptionEntryOperatorValue(exception.operator, index);
-  addExceptionEntryValue(exception.values, index);
-};
-
 export const closeExceptionBuilderModal = () => {
   cy.get(CANCEL_BTN).click();
 };
diff --git a/x-pack/plugins/security_solution/cypress/tasks/exceptions_table.ts b/x-pack/plugins/security_solution/cypress/tasks/exceptions_table.ts
index 838af066abd603..f2bc0c1f7e6ed3 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/exceptions_table.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/exceptions_table.ts
@@ -6,7 +6,6 @@
  */
 
 import {
-  EXCEPTIONS_TABLE_TAB,
   EXCEPTIONS_TABLE,
   EXCEPTIONS_TABLE_SEARCH,
   EXCEPTIONS_TABLE_DELETE_BTN,
@@ -16,10 +15,6 @@ import {
   EXCEPTIONS_TABLE_EXPORT_BTN,
 } from '../screens/exceptions';
 
-export const goToExceptionsTable = () => {
-  cy.get(EXCEPTIONS_TABLE_TAB).should('exist').click({ force: true });
-};
-
 export const waitForExceptionsTableToBeLoaded = () => {
   cy.get(EXCEPTIONS_TABLE).should('exist');
   cy.get(EXCEPTIONS_TABLE_SEARCH).should('exist');
diff --git a/x-pack/plugins/security_solution/cypress/tasks/fields_browser.ts b/x-pack/plugins/security_solution/cypress/tasks/fields_browser.ts
index 72945f557ac1b2..ee8bdb3b023dde 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/fields_browser.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/fields_browser.ts
@@ -5,12 +5,8 @@
  * 2.0.
  */
 
-import { drag, drop } from '../tasks/common';
-
 import {
   FIELDS_BROWSER_FILTER_INPUT,
-  FIELDS_BROWSER_DRAGGABLE_HOST_GEO_COUNTRY_NAME_HEADER,
-  FIELDS_BROWSER_HEADER_DROP_AREA,
   FIELDS_BROWSER_HOST_GEO_CITY_NAME_CHECKBOX,
   FIELDS_BROWSER_HOST_GEO_CONTINENT_NAME_CHECKBOX,
   FIELDS_BROWSER_MESSAGE_CHECKBOX,
@@ -37,15 +33,6 @@ export const addsHostGeoContinentNameToTimeline = () => {
   });
 };
 
-export const addsHostGeoCountryNameToTimelineDraggingIt = () => {
-  cy.get(FIELDS_BROWSER_DRAGGABLE_HOST_GEO_COUNTRY_NAME_HEADER).should('exist');
-  cy.get(FIELDS_BROWSER_DRAGGABLE_HOST_GEO_COUNTRY_NAME_HEADER).then((field) => drag(field));
-
-  cy.get(FIELDS_BROWSER_HEADER_DROP_AREA)
-    .first()
-    .then((headersDropArea) => drop(headersDropArea));
-};
-
 export const clearFieldsBrowser = () => {
   cy.get(FIELDS_BROWSER_FILTER_INPUT).type('{selectall}{backspace}');
 };
diff --git a/x-pack/plugins/security_solution/cypress/tasks/hosts/events.ts b/x-pack/plugins/security_solution/cypress/tasks/hosts/events.ts
index d40b43bac1e3ff..bf8abe4328b967 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/hosts/events.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/hosts/events.ts
@@ -7,14 +7,12 @@
 
 import { drag, drop } from '../common';
 import {
-  CLOSE_MODAL,
   EVENTS_VIEWER_FIELDS_BUTTON,
   EVENTS_VIEWER_PAGINATION,
   FIELDS_BROWSER_CONTAINER,
   HOST_GEO_CITY_NAME_CHECKBOX,
   HOST_GEO_COUNTRY_NAME_CHECKBOX,
   INSPECT_QUERY,
-  LOAD_MORE,
   SERVER_SIDE_EVENT_COUNT,
 } from '../../screens/hosts/events';
 import { DATAGRID_HEADERS } from '../../screens/timeline';
@@ -32,19 +30,9 @@ export const addsHostGeoCountryNameToHeader = () => {
   });
 };
 
-export const closeModal = () => {
-  cy.get(CLOSE_MODAL).click();
-};
-
-export const loadMoreEvents = () => {
-  cy.get(LOAD_MORE).click({ force: true });
-};
-
 export const openEventsViewerFieldsBrowser = () => {
   cy.get(EVENTS_VIEWER_FIELDS_BUTTON).click({ force: true });
-
   cy.get(SERVER_SIDE_EVENT_COUNT).should('not.have.text', '0');
-
   cy.get(FIELDS_BROWSER_CONTAINER).should('exist');
 };
 
diff --git a/x-pack/plugins/security_solution/cypress/tasks/security_header.ts b/x-pack/plugins/security_solution/cypress/tasks/security_header.ts
index 0d6ab9449da86e..558b750e2641ba 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/security_header.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/security_header.ts
@@ -22,7 +22,3 @@ export const navigateFromHeaderTo = (page: string) => {
 export const refreshPage = () => {
   cy.get(REFRESH_BUTTON).click({ force: true }).should('not.have.text', 'Updating');
 };
-
-export const waitForThePageToBeUpdated = () => {
-  cy.get(REFRESH_BUTTON).should('not.have.text', 'Updating');
-};
diff --git a/x-pack/plugins/security_solution/cypress/tasks/security_main.ts b/x-pack/plugins/security_solution/cypress/tasks/security_main.ts
index 01651b7b943d00..9b8af6c5ceef6e 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/security_main.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/security_main.ts
@@ -7,7 +7,6 @@
 
 import {
   CLOSE_TIMELINE_BUTTON,
-  MAIN_PAGE,
   TIMELINE_TOGGLE_BUTTON,
   TIMELINE_BOTTOM_BAR_TOGGLE_BUTTON,
 } from '../screens/security_main';
@@ -25,13 +24,6 @@ export const closeTimelineUsingCloseButton = () => {
   cy.get(CLOSE_TIMELINE_BUTTON).filter(':visible').click();
 };
 
-export const openTimelineIfClosed = () =>
-  cy.get(MAIN_PAGE).then(($page) => {
-    if ($page.find(TIMELINE_BOTTOM_BAR_TOGGLE_BUTTON).length === 1) {
-      openTimelineUsingToggle();
-    }
-  });
-
 export const enterFullScreenMode = () => {
   cy.get(TIMELINE_FULL_SCREEN_BUTTON).first().click({ force: true });
 };
diff --git a/x-pack/plugins/security_solution/cypress/tasks/timeline.ts b/x-pack/plugins/security_solution/cypress/tasks/timeline.ts
index 039e8ed44886e0..4c6b73de809408 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/timeline.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/timeline.ts
@@ -22,7 +22,6 @@ import {
   COMBO_BOX,
   CREATE_NEW_TIMELINE,
   FIELD_BROWSER,
-  ID_FIELD,
   ID_HEADER_FIELD,
   ID_TOGGLE_FIELD,
   ID_HOVER_ACTION_OVERFLOW_BTN,
@@ -69,8 +68,6 @@ import {
 } from '../screens/timeline';
 import { REFRESH_BUTTON, TIMELINE } from '../screens/timelines';
 
-import { drag, drop } from '../tasks/common';
-
 import { closeFieldsBrowser, filterFieldsBrowser } from '../tasks/fields_browser';
 
 export const hostExistsQuery = 'host.name: *';
@@ -121,10 +118,6 @@ export const goToCorrelationTab = () => {
   return cy.root().find(TIMELINE_CORRELATION_TAB);
 };
 
-export const getNotePreviewByNoteId = (noteId: string) => {
-  return cy.get(`[data-test-subj="note-preview-${noteId}"]`);
-};
-
 export const goToQueryTab = () => {
   cy.root()
     .pipe(($el) => {
@@ -302,10 +295,6 @@ export const populateTimeline = () => {
   cy.get(SERVER_SIDE_EVENT_COUNT).should('not.have.text', '0');
 };
 
-export const unpinFirstEvent = () => {
-  cy.get(PIN_EVENT).first().click({ force: true });
-};
-
 const clickTimestampHoverActionOverflowButton = () => {
   cy.get(TIMESTAMP_HOVER_ACTION_OVERFLOW_BTN).should('exist');
 
@@ -320,16 +309,6 @@ export const clickTimestampToggleField = () => {
   cy.get(TIMESTAMP_TOGGLE_FIELD).click({ force: true });
 };
 
-export const dragAndDropIdToggleFieldToTimeline = () => {
-  cy.get(ID_HEADER_FIELD).should('not.exist');
-
-  cy.get(ID_FIELD).then((field) => drag(field));
-
-  cy.get(`[data-test-subj="timeline"] [data-test-subj="headers-group"]`)
-    .first()
-    .then((headersDropArea) => drop(headersDropArea));
-};
-
 export const removeColumn = (columnName: string) => {
   cy.get(FIELD_BROWSER).first().click();
   filterFieldsBrowser(columnName);
@@ -350,10 +329,6 @@ export const waitForTimelineChanges = () => {
   cy.get(TIMELINE_CHANGES_IN_PROGRESS).should('not.exist');
 };
 
-export const waitForEventsPanelToBeLoaded = () => {
-  cy.get(QUERY_TAB_BUTTON).find('.euiBadge').should('exist');
-};
-
 /**
  * We keep clicking on the refresh button until we have the timeline we are looking
  * for. NOTE: That because refresh happens so fast, the click handler in most cases

From 187d9496857f2fae4395caf1d62d2a6ebb2eb0fb Mon Sep 17 00:00:00 2001
From: Kyle Pollich <kyle.pollich@elastic.co>
Date: Thu, 14 Oct 2021 07:19:50 -0400
Subject: [PATCH 48/71] [Fleet] Improve Functionality around Managed Package
 Policies (#114526)

* Enabled auto policy upgrades for APM and Synthetics

* fixup! Enabled auto policy upgrades for APM and Synthetics

* Rework preconfiguration policy upgrade flow + report errors

* Fix type error in test

* Fix type errors + tests

* wip

* Remove keep policies up to date checks

* Remove references to KEEP_POLICIES_UP_TO_DATE_PACKAGES

* Move package policy upgrade results to nonFatalErrors

* Fix types

* Fix type error

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../server/routes/setup/handlers.test.ts      |   5 +-
 .../fleet/server/routes/setup/handlers.ts     |  20 +++-
 .../services/managed_package_policies.test.ts | 104 +++++++++++++++++-
 .../services/managed_package_policies.ts      |  65 ++++++++---
 .../fleet/server/services/preconfiguration.ts |  22 ++--
 x-pack/plugins/fleet/server/services/setup.ts |   5 +-
 6 files changed, 186 insertions(+), 35 deletions(-)

diff --git a/x-pack/plugins/fleet/server/routes/setup/handlers.test.ts b/x-pack/plugins/fleet/server/routes/setup/handlers.test.ts
index bd82989a9e8287..c196054faf08cc 100644
--- a/x-pack/plugins/fleet/server/routes/setup/handlers.test.ts
+++ b/x-pack/plugins/fleet/server/routes/setup/handlers.test.ts
@@ -53,7 +53,10 @@ describe('FleetSetupHandler', () => {
     );
     await fleetSetupHandler(context, request, response);
 
-    const expectedBody: PostFleetSetupResponse = { isInitialized: true, nonFatalErrors: [] };
+    const expectedBody: PostFleetSetupResponse = {
+      isInitialized: true,
+      nonFatalErrors: [],
+    };
     expect(response.customError).toHaveBeenCalledTimes(0);
     expect(response.ok).toHaveBeenCalledWith({ body: expectedBody });
   });
diff --git a/x-pack/plugins/fleet/server/routes/setup/handlers.ts b/x-pack/plugins/fleet/server/routes/setup/handlers.ts
index 6311b9d970d35d..d24db96667d527 100644
--- a/x-pack/plugins/fleet/server/routes/setup/handlers.ts
+++ b/x-pack/plugins/fleet/server/routes/setup/handlers.ts
@@ -49,13 +49,21 @@ export const fleetSetupHandler: RequestHandler = async (context, request, respon
     const setupStatus = await setupFleet(soClient, esClient);
     const body: PostFleetSetupResponse = {
       ...setupStatus,
-      nonFatalErrors: setupStatus.nonFatalErrors.map((e) => {
+      nonFatalErrors: setupStatus.nonFatalErrors.flatMap((e) => {
         // JSONify the error object so it can be displayed properly in the UI
-        const error = e.error ?? e;
-        return {
-          name: error.name,
-          message: error.message,
-        };
+        if ('error' in e) {
+          return {
+            name: e.error.name,
+            message: e.error.message,
+          };
+        } else {
+          return e.errors.map((upgradePackagePolicyError: any) => {
+            return {
+              name: upgradePackagePolicyError.key,
+              message: upgradePackagePolicyError.message,
+            };
+          });
+        }
       }),
     };
 
diff --git a/x-pack/plugins/fleet/server/services/managed_package_policies.test.ts b/x-pack/plugins/fleet/server/services/managed_package_policies.test.ts
index a53b1fe6489055..52c1c71446d641 100644
--- a/x-pack/plugins/fleet/server/services/managed_package_policies.test.ts
+++ b/x-pack/plugins/fleet/server/services/managed_package_policies.test.ts
@@ -18,7 +18,7 @@ jest.mock('./app_context', () => {
     ...jest.requireActual('./app_context'),
     appContextService: {
       getLogger: jest.fn(() => {
-        return { debug: jest.fn() };
+        return { error: jest.fn() };
       }),
     },
   };
@@ -27,7 +27,9 @@ jest.mock('./app_context', () => {
 describe('managed package policies', () => {
   afterEach(() => {
     (packagePolicyService.get as jest.Mock).mockReset();
+    (packagePolicyService.getUpgradeDryRunDiff as jest.Mock).mockReset();
     (getPackageInfo as jest.Mock).mockReset();
+    (packagePolicyService.upgrade as jest.Mock).mockReset();
   });
 
   it('should not upgrade policies for non-managed package', async () => {
@@ -54,6 +56,16 @@ describe('managed package policies', () => {
       }
     );
 
+    (packagePolicyService.getUpgradeDryRunDiff as jest.Mock).mockImplementationOnce(
+      (savedObjectsClient: any, id: string) => {
+        return {
+          name: 'non-managed-package-policy',
+          diff: [{ id: 'foo' }, { id: 'bar' }],
+          hasErrors: false,
+        };
+      }
+    );
+
     (getPackageInfo as jest.Mock).mockImplementationOnce(
       ({ savedObjectsClient, pkgName, pkgVersion }) => ({
         name: pkgName,
@@ -91,6 +103,16 @@ describe('managed package policies', () => {
       }
     );
 
+    (packagePolicyService.getUpgradeDryRunDiff as jest.Mock).mockImplementationOnce(
+      (savedObjectsClient: any, id: string) => {
+        return {
+          name: 'non-managed-package-policy',
+          diff: [{ id: 'foo' }, { id: 'bar' }],
+          hasErrors: false,
+        };
+      }
+    );
+
     (getPackageInfo as jest.Mock).mockImplementationOnce(
       ({ savedObjectsClient, pkgName, pkgVersion }) => ({
         name: pkgName,
@@ -103,4 +125,84 @@ describe('managed package policies', () => {
 
     expect(packagePolicyService.upgrade).toBeCalledWith(soClient, esClient, ['managed-package-id']);
   });
+
+  describe('when dry run reports conflicts', () => {
+    it('should return errors + diff without performing upgrade', async () => {
+      const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+      const soClient = savedObjectsClientMock.create();
+
+      (packagePolicyService.get as jest.Mock).mockImplementationOnce(
+        (savedObjectsClient: any, id: string) => {
+          return {
+            id,
+            inputs: {},
+            version: '',
+            revision: 1,
+            updated_at: '',
+            updated_by: '',
+            created_at: '',
+            created_by: '',
+            package: {
+              name: 'conflicting-package',
+              title: 'Conflicting Package',
+              version: '0.0.1',
+            },
+          };
+        }
+      );
+
+      (packagePolicyService.getUpgradeDryRunDiff as jest.Mock).mockImplementationOnce(
+        (savedObjectsClient: any, id: string) => {
+          return {
+            name: 'conflicting-package-policy',
+            diff: [
+              { id: 'foo' },
+              { id: 'bar', errors: [{ key: 'some.test.value', message: 'Conflict detected' }] },
+            ],
+            hasErrors: true,
+          };
+        }
+      );
+
+      (getPackageInfo as jest.Mock).mockImplementationOnce(
+        ({ savedObjectsClient, pkgName, pkgVersion }) => ({
+          name: pkgName,
+          version: pkgVersion,
+          keepPoliciesUpToDate: true,
+        })
+      );
+
+      const result = await upgradeManagedPackagePolicies(soClient, esClient, [
+        'conflicting-package-policy',
+      ]);
+
+      expect(result).toEqual([
+        {
+          packagePolicyId: 'conflicting-package-policy',
+          diff: [
+            {
+              id: 'foo',
+            },
+            {
+              id: 'bar',
+              errors: [
+                {
+                  key: 'some.test.value',
+                  message: 'Conflict detected',
+                },
+              ],
+            },
+          ],
+          errors: [
+            {
+              key: 'some.test.value',
+              message: 'Conflict detected',
+            },
+          ],
+        },
+      ]);
+
+      expect(packagePolicyService.upgrade).not.toBeCalled();
+    });
+  });
 });
diff --git a/x-pack/plugins/fleet/server/services/managed_package_policies.ts b/x-pack/plugins/fleet/server/services/managed_package_policies.ts
index 73f85525f4c607..25e24828927120 100644
--- a/x-pack/plugins/fleet/server/services/managed_package_policies.ts
+++ b/x-pack/plugins/fleet/server/services/managed_package_policies.ts
@@ -7,12 +7,19 @@
 
 import type { ElasticsearchClient, SavedObjectsClientContract } from 'src/core/server';
 
+import type { UpgradePackagePolicyDryRunResponseItem } from '../../common';
 import { AUTO_UPDATE_PACKAGES } from '../../common';
 
 import { appContextService } from './app_context';
-import { getPackageInfo } from './epm/packages';
+import { getInstallation, getPackageInfo } from './epm/packages';
 import { packagePolicyService } from './package_policy';
 
+export interface UpgradeManagedPackagePoliciesResult {
+  packagePolicyId: string;
+  diff: UpgradePackagePolicyDryRunResponseItem['diff'];
+  errors: any;
+}
+
 /**
  * Upgrade any package policies for packages installed through setup that are denoted as `AUTO_UPGRADE` packages
  * or have the `keep_policies_up_to_date` flag set to `true`
@@ -21,8 +28,8 @@ export const upgradeManagedPackagePolicies = async (
   soClient: SavedObjectsClientContract,
   esClient: ElasticsearchClient,
   packagePolicyIds: string[]
-) => {
-  const policyIdsToUpgrade: string[] = [];
+): Promise<UpgradeManagedPackagePoliciesResult[]> => {
+  const results: UpgradeManagedPackagePoliciesResult[] = [];
 
   for (const packagePolicyId of packagePolicyIds) {
     const packagePolicy = await packagePolicyService.get(soClient, packagePolicyId);
@@ -37,22 +44,50 @@ export const upgradeManagedPackagePolicies = async (
       pkgVersion: packagePolicy.package.version,
     });
 
+    const installedPackage = await getInstallation({
+      savedObjectsClient: soClient,
+      pkgName: packagePolicy.package.name,
+    });
+
+    const isPolicyVersionAlignedWithInstalledVersion =
+      packageInfo.version === installedPackage?.version;
+
     const shouldUpgradePolicies =
-      AUTO_UPDATE_PACKAGES.some((pkg) => pkg.name === packageInfo.name) ||
-      packageInfo.keepPoliciesUpToDate;
+      !isPolicyVersionAlignedWithInstalledVersion &&
+      (AUTO_UPDATE_PACKAGES.some((pkg) => pkg.name === packageInfo.name) ||
+        packageInfo.keepPoliciesUpToDate);
 
     if (shouldUpgradePolicies) {
-      policyIdsToUpgrade.push(packagePolicy.id);
-    }
-  }
-
-  if (policyIdsToUpgrade.length) {
-    appContextService
-      .getLogger()
-      .debug(
-        `Upgrading ${policyIdsToUpgrade.length} package policies: ${policyIdsToUpgrade.join(', ')}`
+      // Since upgrades don't report diffs/errors, we need to perform a dry run first in order
+      // to notify the user of any granular policy upgrade errors that occur during Fleet's
+      // preconfiguration check
+      const dryRunResults = await packagePolicyService.getUpgradeDryRunDiff(
+        soClient,
+        packagePolicyId
       );
 
-    await packagePolicyService.upgrade(soClient, esClient, policyIdsToUpgrade);
+      if (dryRunResults.hasErrors) {
+        const errors = dryRunResults.diff?.[1].errors;
+        appContextService
+          .getLogger()
+          .error(
+            new Error(
+              `Error upgrading package policy ${packagePolicyId}: ${JSON.stringify(errors)}`
+            )
+          );
+
+        results.push({ packagePolicyId, diff: dryRunResults.diff, errors });
+        continue;
+      }
+
+      try {
+        await packagePolicyService.upgrade(soClient, esClient, [packagePolicyId]);
+        results.push({ packagePolicyId, diff: dryRunResults.diff, errors: [] });
+      } catch (error) {
+        results.push({ packagePolicyId, diff: dryRunResults.diff, errors: [error] });
+      }
+    }
   }
+
+  return results;
 };
diff --git a/x-pack/plugins/fleet/server/services/preconfiguration.ts b/x-pack/plugins/fleet/server/services/preconfiguration.ts
index a878af64aa05e1..3b322e1112d6ae 100644
--- a/x-pack/plugins/fleet/server/services/preconfiguration.ts
+++ b/x-pack/plugins/fleet/server/services/preconfiguration.ts
@@ -35,13 +35,14 @@ import { agentPolicyService, addPackageToAgentPolicy } from './agent_policy';
 import type { InputsOverride } from './package_policy';
 import { overridePackageInputs } from './package_policy';
 import { appContextService } from './app_context';
+import type { UpgradeManagedPackagePoliciesResult } from './managed_package_policies';
 import { upgradeManagedPackagePolicies } from './managed_package_policies';
 import { outputService } from './output';
 
 interface PreconfigurationResult {
   policies: Array<{ id: string; updated_at: string }>;
   packages: string[];
-  nonFatalErrors: PreconfigurationError[];
+  nonFatalErrors: Array<PreconfigurationError | UpgradeManagedPackagePoliciesResult>;
 }
 
 function isPreconfiguredOutputDifferentFromCurrent(
@@ -326,16 +327,15 @@ export async function ensurePreconfiguredPackagesAndPolicies(
     }
   }
 
-  try {
-    const fulfilledPolicyPackagePolicyIds = fulfilledPolicies.flatMap<string>(
-      ({ policy }) => policy?.package_policies as string[]
-    );
+  const fulfilledPolicyPackagePolicyIds = fulfilledPolicies
+    .filter(({ policy }) => policy?.package_policies)
+    .flatMap<string>(({ policy }) => policy?.package_policies as string[]);
 
-    await upgradeManagedPackagePolicies(soClient, esClient, fulfilledPolicyPackagePolicyIds);
-    // Swallow errors that occur when upgrading
-  } catch (error) {
-    appContextService.getLogger().error(error);
-  }
+  const packagePolicyUpgradeResults = await upgradeManagedPackagePolicies(
+    soClient,
+    esClient,
+    fulfilledPolicyPackagePolicyIds
+  );
 
   return {
     policies: fulfilledPolicies.map((p) =>
@@ -353,7 +353,7 @@ export async function ensurePreconfiguredPackagesAndPolicies(
           }
     ),
     packages: fulfilledPackages.map((pkg) => pkgToPkgKey(pkg)),
-    nonFatalErrors: [...rejectedPackages, ...rejectedPolicies],
+    nonFatalErrors: [...rejectedPackages, ...rejectedPolicies, ...packagePolicyUpgradeResults],
   };
 }
 
diff --git a/x-pack/plugins/fleet/server/services/setup.ts b/x-pack/plugins/fleet/server/services/setup.ts
index 08c580d80c804d..37d79c1bb691d2 100644
--- a/x-pack/plugins/fleet/server/services/setup.ts
+++ b/x-pack/plugins/fleet/server/services/setup.ts
@@ -32,10 +32,13 @@ import { ensureDefaultComponentTemplate } from './epm/elasticsearch/template/ins
 import { getInstallations, installPackage } from './epm/packages';
 import { isPackageInstalled } from './epm/packages/install';
 import { pkgToPkgKey } from './epm/registry';
+import type { UpgradeManagedPackagePoliciesResult } from './managed_package_policies';
 
 export interface SetupStatus {
   isInitialized: boolean;
-  nonFatalErrors: Array<PreconfigurationError | DefaultPackagesInstallationError>;
+  nonFatalErrors: Array<
+    PreconfigurationError | DefaultPackagesInstallationError | UpgradeManagedPackagePoliciesResult
+  >;
 }
 
 export async function setupFleet(

From f598cf1ffd83d61fdc6c5205d5a9e25721f799dd Mon Sep 17 00:00:00 2001
From: Anton Dosov <anton.dosov@elastic.co>
Date: Thu, 14 Oct 2021 13:46:16 +0200
Subject: [PATCH 49/71] Update app services bundle limits (#114789)

---
 packages/kbn-optimizer/limits.yml | 36 +++++++++++++++----------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/packages/kbn-optimizer/limits.yml b/packages/kbn-optimizer/limits.yml
index 068408bce40fd2..f331bb6dae444f 100644
--- a/packages/kbn-optimizer/limits.yml
+++ b/packages/kbn-optimizer/limits.yml
@@ -2,7 +2,6 @@ pageLoadAssetSize:
   advancedSettings: 27596
   alerting: 106936
   apm: 64385
-  bfetch: 51874
   canvas: 1066647
   charts: 95000
   cloud: 21076
@@ -11,17 +10,12 @@ pageLoadAssetSize:
   crossClusterReplication: 65408
   dashboard: 374194
   dashboardEnhanced: 65646
-  data: 824229
-  dataEnhanced: 50420
   devTools: 38637
   discover: 99999
   discoverEnhanced: 42730
-  embeddable: 99999
-  embeddableEnhanced: 41145
   enterpriseSearch: 35741
   esUiShared: 326654
   features: 21723
-  fieldFormats: 92628
   globalSearch: 29696
   globalSearchBar: 50403
   globalSearchProviders: 25554
@@ -30,8 +24,6 @@ pageLoadAssetSize:
   home: 30182
   indexLifecycleManagement: 107090
   indexManagement: 140608
-  indexPatternManagement: 28222
-  indexPatternEditor: 25000
   infra: 184320
   fleet: 250000
   ingestPipelines: 58003
@@ -39,8 +31,6 @@ pageLoadAssetSize:
   inspector: 148711
   kibanaLegacy: 107711
   kibanaOverview: 56279
-  kibanaReact: 188705
-  kibanaUtils: 198829
   lens: 96624
   licenseManagement: 41817
   licensing: 29004
@@ -55,7 +45,6 @@ pageLoadAssetSize:
   observability: 89709
   painlessLab: 179748
   remoteClusters: 51327
-  reporting: 183418
   rollup: 97204
   savedObjects: 108518
   savedObjectsManagement: 101836
@@ -63,18 +52,14 @@ pageLoadAssetSize:
   savedObjectsTaggingOss: 20590
   searchprofiler: 67080
   security: 95864
-  share: 99061
   snapshotRestore: 79032
   spaces: 57868
   telemetry: 51957
   telemetryManagementSection: 38586
   transform: 41007
   triggersActionsUi: 100000
-  uiActions: 97717
-  uiActionsEnhanced: 32000
   upgradeAssistant: 81241
   uptime: 40825
-  urlDrilldown: 70674
   urlForwarding: 32579
   usageCollection: 39762
   visDefaultEditor: 50178
@@ -92,7 +77,6 @@ pageLoadAssetSize:
   runtimeFields: 41752
   stackAlerts: 29684
   presentationUtil: 94301
-  indexPatternFieldEditor: 50000
   osquery: 107090
   fileUpload: 25664
   dataVisualizer: 27530
@@ -110,9 +94,25 @@ pageLoadAssetSize:
   expressionShape: 34008
   interactiveSetup: 80000
   expressionTagcloud: 27505
-  expressions: 239290
   securitySolution: 231753
   customIntegrations: 28810
   expressionMetricVis: 23121
   visTypeMetric: 23332
-  dataViews: 42000
+  bfetch: 22837
+  kibanaUtils: 97808
+  data: 491273
+  dataViews: 41532
+  expressions: 140958
+  fieldFormats: 65209
+  kibanaReact: 99422
+  share: 71239
+  uiActions: 35121
+  dataEnhanced: 24980
+  embeddable: 87309
+  embeddableEnhanced: 22107
+  uiActionsEnhanced: 38494
+  urlDrilldown: 30063
+  indexPatternEditor: 19123
+  indexPatternFieldEditor: 34448
+  indexPatternManagement: 19165
+  reporting: 57003

From 29d750a8c1a319b18a2c1942d480b5bc66add010 Mon Sep 17 00:00:00 2001
From: Kevin Lacabane <kevin.lacabane@elastic.co>
Date: Thu, 14 Oct 2021 14:33:07 +0200
Subject: [PATCH 50/71] [Stack Monitoring] fix feature controls functional test
 (#114781)

* fix feature controls functional test

* target test-subj attr instead of class
---
 .../monitoring/public/application/pages/page_template.tsx       | 2 +-
 x-pack/plugins/monitoring/public/directives/main/index.html     | 2 +-
 .../apps/monitoring/feature_controls/monitoring_spaces.ts       | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/x-pack/plugins/monitoring/public/application/pages/page_template.tsx b/x-pack/plugins/monitoring/public/application/pages/page_template.tsx
index 5c030814d9cdf5..23eeb2c034a80f 100644
--- a/x-pack/plugins/monitoring/public/application/pages/page_template.tsx
+++ b/x-pack/plugins/monitoring/public/application/pages/page_template.tsx
@@ -92,7 +92,7 @@ export const PageTemplate: React.FC<PageTemplateProps> = ({
   };
 
   return (
-    <div className="app-container">
+    <div className="app-container" data-test-subj="monitoringAppContainer">
       <ActionMenu>
         <AlertsDropdown />
       </ActionMenu>
diff --git a/x-pack/plugins/monitoring/public/directives/main/index.html b/x-pack/plugins/monitoring/public/directives/main/index.html
index 558ed5e874cd6e..c989c71d8c1d44 100644
--- a/x-pack/plugins/monitoring/public/directives/main/index.html
+++ b/x-pack/plugins/monitoring/public/directives/main/index.html
@@ -1,4 +1,4 @@
-<div class="app-container">
+<div class="app-container" data-test-subj="monitoringAppContainer">
   <div class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--justifyContentSpaceBetween euiFlexGroup--directionRow euiFlexGroup--responsive">
     <div class="euiFlexItem euiFlexItem--flexGrowZero">
       <div class="euiFlexGroup euiFlexGroup--gutterNone euiFlexGroup--justifyContentSpaceEvenly euiFlexGroup--responsive euiFlexGroup--directionColumn">
diff --git a/x-pack/test/functional/apps/monitoring/feature_controls/monitoring_spaces.ts b/x-pack/test/functional/apps/monitoring/feature_controls/monitoring_spaces.ts
index f2b872bccbaa7b..71f100b49068fc 100644
--- a/x-pack/test/functional/apps/monitoring/feature_controls/monitoring_spaces.ts
+++ b/x-pack/test/functional/apps/monitoring/feature_controls/monitoring_spaces.ts
@@ -52,7 +52,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
           basePath: '/s/custom_space',
         });
 
-        const exists = await find.existsByCssSelector('monitoring-main');
+        const exists = await find.existsByCssSelector('[data-test-subj="monitoringAppContainer"]');
         expect(exists).to.be(true);
       });
     });

From b21e1ebf3806793f09770cc03d7a65a83fac5e17 Mon Sep 17 00:00:00 2001
From: Tim Roes <tim.roes@elastic.co>
Date: Thu, 14 Oct 2021 14:43:06 +0200
Subject: [PATCH 51/71] Deprecate DataView.flattenHit in favor of data plugin
 flattenHit (#114517)

* WIP replacing indexPattern.flattenHit by tabify

* Fix jest tests

* Read metaFields from index pattern

* Remove old test code

* remove unnecessary changes

* Remove flattenHitWrapper APIs

* Fix imports

* Fix missing metaFields

* Add all meta fields to allowlist

* Improve inline comments

* Move flattenHit test to new implementation

* Add deprecation comment to implementation

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../__snapshots__/tabify_docs.test.ts.snap    | 160 +----------------
 .../data/common/search/tabify/index.ts        |   2 +-
 .../common/search/tabify/tabify_docs.test.ts  | 170 ++++++++++++------
 .../data/common/search/tabify/tabify_docs.ts  |  85 ++++++++-
 src/plugins/data/public/index.ts              |   2 -
 .../data_views/common/data_views/data_view.ts |   3 +
 .../common/data_views/flatten_hit.ts          |  17 +-
 src/plugins/data_views/public/index.ts        |   2 +-
 .../public/__mocks__/index_pattern.ts         |   9 +-
 .../__mocks__/index_pattern_with_timefield.ts |   9 +-
 .../doc_table/components/table_row.tsx        |   3 +-
 .../sidebar/discover_sidebar.test.tsx         |   4 +-
 .../discover_sidebar_responsive.test.tsx      |   6 +-
 .../sidebar/lib/field_calculator.js           |   4 +-
 .../sidebar/lib/field_calculator.test.ts      |   3 +-
 .../apps/main/utils/calc_field_counts.ts      |   4 +-
 .../discover_grid/discover_grid.tsx           |   4 +-
 .../discover_grid_cell_actions.tsx            |   6 +-
 .../discover_grid_document_selection.test.tsx |  45 ++---
 .../discover_grid_expand_button.test.tsx      |  36 ++--
 .../get_render_cell_value.test.tsx            |  33 ++--
 .../components/table/table.test.tsx           |   6 +-
 .../application/components/table/table.tsx    |   3 +-
 .../generate_csv/generate_csv.test.ts         |   1 +
 .../generate_csv/generate_csv.ts              |   2 +-
 25 files changed, 293 insertions(+), 326 deletions(-)

diff --git a/src/plugins/data/common/search/tabify/__snapshots__/tabify_docs.test.ts.snap b/src/plugins/data/common/search/tabify/__snapshots__/tabify_docs.test.ts.snap
index 22276335a0599d..9a85ba57ce5ef7 100644
--- a/src/plugins/data/common/search/tabify/__snapshots__/tabify_docs.test.ts.snap
+++ b/src/plugins/data/common/search/tabify/__snapshots__/tabify_docs.test.ts.snap
@@ -1,6 +1,6 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`tabifyDocs combines meta fields if meta option is set 1`] = `
+exports[`tabify_docs tabifyDocs converts fields by default 1`] = `
 Object {
   "columns": Array [
     Object {
@@ -108,7 +108,7 @@ Object {
 }
 `;
 
-exports[`tabifyDocs converts fields by default 1`] = `
+exports[`tabify_docs tabifyDocs converts source if option is set 1`] = `
 Object {
   "columns": Array [
     Object {
@@ -216,7 +216,7 @@ Object {
 }
 `;
 
-exports[`tabifyDocs converts source if option is set 1`] = `
+exports[`tabify_docs tabifyDocs skips nested fields if option is set 1`] = `
 Object {
   "columns": Array [
     Object {
@@ -324,115 +324,7 @@ Object {
 }
 `;
 
-exports[`tabifyDocs skips nested fields if option is set 1`] = `
-Object {
-  "columns": Array [
-    Object {
-      "id": "fieldTest",
-      "meta": Object {
-        "field": "fieldTest",
-        "index": "test-index",
-        "params": Object {
-          "id": "number",
-        },
-        "type": "number",
-      },
-      "name": "fieldTest",
-    },
-    Object {
-      "id": "invalidMapping",
-      "meta": Object {
-        "field": "invalidMapping",
-        "index": "test-index",
-        "params": undefined,
-        "type": "number",
-      },
-      "name": "invalidMapping",
-    },
-    Object {
-      "id": "nested",
-      "meta": Object {
-        "field": "nested",
-        "index": "test-index",
-        "params": undefined,
-        "type": "object",
-      },
-      "name": "nested",
-    },
-    Object {
-      "id": "sourceTest",
-      "meta": Object {
-        "field": "sourceTest",
-        "index": "test-index",
-        "params": Object {
-          "id": "number",
-        },
-        "type": "number",
-      },
-      "name": "sourceTest",
-    },
-    Object {
-      "id": "_id",
-      "meta": Object {
-        "field": "_id",
-        "index": "test-index",
-        "params": undefined,
-        "type": "string",
-      },
-      "name": "_id",
-    },
-    Object {
-      "id": "_index",
-      "meta": Object {
-        "field": "_index",
-        "index": "test-index",
-        "params": undefined,
-        "type": "string",
-      },
-      "name": "_index",
-    },
-    Object {
-      "id": "_score",
-      "meta": Object {
-        "field": "_score",
-        "index": "test-index",
-        "params": undefined,
-        "type": "number",
-      },
-      "name": "_score",
-    },
-    Object {
-      "id": "_type",
-      "meta": Object {
-        "field": "_type",
-        "index": "test-index",
-        "params": undefined,
-        "type": "string",
-      },
-      "name": "_type",
-    },
-  ],
-  "rows": Array [
-    Object {
-      "_id": "hit-id-value",
-      "_index": "hit-index-value",
-      "_score": 77,
-      "_type": "hit-type-value",
-      "fieldTest": 123,
-      "invalidMapping": 345,
-      "nested": Array [
-        Object {
-          "field": 123,
-        },
-      ],
-      "sourceTest": 123,
-    },
-  ],
-  "type": "datatable",
-}
-`;
-
-exports[`tabifyDocs works without provided index pattern 1`] = `
+exports[`tabify_docs tabifyDocs works without provided index pattern 1`] = `
 Object {
   "columns": Array [
     Object {
@@ -475,53 +367,9 @@ Object {
       },
       "name": "sourceTest",
     },
-    Object {
-      "id": "_id",
-      "meta": Object {
-        "field": "_id",
-        "index": undefined,
-        "params": undefined,
-        "type": "string",
-      },
-      "name": "_id",
-    },
-    Object {
-      "id": "_index",
-      "meta": Object {
-        "field": "_index",
-        "index": undefined,
-        "params": undefined,
-        "type": "string",
-      },
-      "name": "_index",
-    },
-    Object {
-      "id": "_score",
-      "meta": Object {
-        "field": "_score",
-        "index": undefined,
-        "params": undefined,
-        "type": "number",
-      },
-      "name": "_score",
-    },
-    Object {
-      "id": "_type",
-      "meta": Object {
-        "field": "_type",
-        "index": undefined,
-        "params": undefined,
-        "type": "string",
-      },
-      "name": "_type",
-    },
   ],
   "rows": Array [
     Object {
-      "_id": "hit-id-value",
-      "_index": "hit-index-value",
-      "_score": 77,
-      "_type": "hit-type-value",
       "fieldTest": 123,
       "invalidMapping": 345,
       "nested": Array [
diff --git a/src/plugins/data/common/search/tabify/index.ts b/src/plugins/data/common/search/tabify/index.ts
index 74fbc7ba4cfa4a..279ff705f231c8 100644
--- a/src/plugins/data/common/search/tabify/index.ts
+++ b/src/plugins/data/common/search/tabify/index.ts
@@ -6,6 +6,6 @@
  * Side Public License, v 1.
  */
 
-export { tabifyDocs } from './tabify_docs';
+export { tabifyDocs, flattenHit } from './tabify_docs';
 export { tabifyAggResponse } from './tabify';
 export { tabifyGetColumns } from './get_columns';
diff --git a/src/plugins/data/common/search/tabify/tabify_docs.test.ts b/src/plugins/data/common/search/tabify/tabify_docs.test.ts
index 1a3f7195b722e1..a2910a1be4a9a4 100644
--- a/src/plugins/data/common/search/tabify/tabify_docs.test.ts
+++ b/src/plugins/data/common/search/tabify/tabify_docs.test.ts
@@ -6,71 +6,137 @@
  * Side Public License, v 1.
  */
 
-import { tabifyDocs } from './tabify_docs';
-import { IndexPattern } from '../..';
+import { tabifyDocs, flattenHit } from './tabify_docs';
+import { IndexPattern, DataView } from '../..';
 import type { estypes } from '@elastic/elasticsearch';
 
-describe('tabifyDocs', () => {
-  const fieldFormats = {
-    getInstance: (id: string) => ({ toJSON: () => ({ id }) }),
-    getDefaultInstance: (id: string) => ({ toJSON: () => ({ id }) }),
-  };
+import { fieldFormatsMock } from '../../../../field_formats/common/mocks';
+import { stubbedSavedObjectIndexPattern } from '../../../../data_views/common/data_view.stub';
 
-  const index = new IndexPattern({
+class MockFieldFormatter {}
+
+fieldFormatsMock.getInstance = jest.fn().mockImplementation(() => new MockFieldFormatter()) as any;
+
+// helper function to create index patterns
+function create(id: string) {
+  const {
+    type,
+    version,
+    attributes: { timeFieldName, fields, title },
+  } = stubbedSavedObjectIndexPattern(id);
+
+  return new DataView({
     spec: {
-      id: 'test-index',
-      fields: {
-        sourceTest: { name: 'sourceTest', type: 'number', searchable: true, aggregatable: true },
-        fieldTest: { name: 'fieldTest', type: 'number', searchable: true, aggregatable: true },
-        'nested.field': {
-          name: 'nested.field',
-          type: 'number',
-          searchable: true,
-          aggregatable: true,
-        },
-      },
+      id,
+      type,
+      version,
+      timeFieldName,
+      fields: JSON.parse(fields),
+      title,
+      runtimeFieldMap: {},
     },
-    fieldFormats: fieldFormats as any,
+    fieldFormats: fieldFormatsMock,
+    shortDotsEnable: false,
+    metaFields: ['_id', '_type', '_score', '_routing'],
   });
+}
 
-  // @ts-expect-error not full inteface
-  const response = {
-    hits: {
-      hits: [
+describe('tabify_docs', () => {
+  describe('flattenHit', () => {
+    let indexPattern: DataView;
+
+    // create an indexPattern instance for each test
+    beforeEach(() => {
+      indexPattern = create('test-pattern');
+    });
+
+    it('returns sorted object keys that combine _source, fields and metaFields in a defined order', () => {
+      const response = flattenHit(
         {
-          _id: 'hit-id-value',
-          _index: 'hit-index-value',
-          _type: 'hit-type-value',
-          _score: 77,
-          _source: { sourceTest: 123 },
-          fields: { fieldTest: 123, invalidMapping: 345, nested: [{ field: 123 }] },
+          _index: 'foobar',
+          _id: 'a',
+          _source: {
+            name: 'first',
+          },
+          fields: {
+            date: ['1'],
+            zzz: ['z'],
+            _abc: ['a'],
+          },
         },
-      ],
-    },
-  } as estypes.SearchResponse<unknown>;
-
-  it('converts fields by default', () => {
-    const table = tabifyDocs(response, index);
-    expect(table).toMatchSnapshot();
+        indexPattern
+      );
+      const expectedOrder = ['_abc', 'date', 'name', 'zzz', '_id', '_routing', '_score', '_type'];
+      expect(Object.keys(response)).toEqual(expectedOrder);
+      expect(Object.entries(response).map(([key]) => key)).toEqual(expectedOrder);
+    });
   });
 
-  it('converts source if option is set', () => {
-    const table = tabifyDocs(response, index, { source: true });
-    expect(table).toMatchSnapshot();
-  });
+  describe('tabifyDocs', () => {
+    const fieldFormats = {
+      getInstance: (id: string) => ({ toJSON: () => ({ id }) }),
+      getDefaultInstance: (id: string) => ({ toJSON: () => ({ id }) }),
+    };
 
-  it('skips nested fields if option is set', () => {
-    const table = tabifyDocs(response, index, { shallow: true });
-    expect(table).toMatchSnapshot();
-  });
+    const index = new IndexPattern({
+      spec: {
+        id: 'test-index',
+        fields: {
+          sourceTest: { name: 'sourceTest', type: 'number', searchable: true, aggregatable: true },
+          fieldTest: { name: 'fieldTest', type: 'number', searchable: true, aggregatable: true },
+          'nested.field': {
+            name: 'nested.field',
+            type: 'number',
+            searchable: true,
+            aggregatable: true,
+          },
+        },
+      },
+      metaFields: ['_id', '_index', '_score', '_type'],
+      fieldFormats: fieldFormats as any,
+    });
 
-  it('combines meta fields if meta option is set', () => {
-    const table = tabifyDocs(response, index, { meta: true });
-    expect(table).toMatchSnapshot();
-  });
+    // @ts-expect-error not full inteface
+    const response = {
+      hits: {
+        hits: [
+          {
+            _id: 'hit-id-value',
+            _index: 'hit-index-value',
+            _type: 'hit-type-value',
+            _score: 77,
+            _source: { sourceTest: 123 },
+            fields: { fieldTest: 123, invalidMapping: 345, nested: [{ field: 123 }] },
+          },
+        ],
+      },
+    } as estypes.SearchResponse<unknown>;
+
+    it('converts fields by default', () => {
+      const table = tabifyDocs(response, index);
+      expect(table).toMatchSnapshot();
+    });
+
+    it('converts source if option is set', () => {
+      const table = tabifyDocs(response, index, { source: true });
+      expect(table).toMatchSnapshot();
+    });
+
+    it('skips nested fields if option is set', () => {
+      const table = tabifyDocs(response, index, { shallow: true });
+      expect(table).toMatchSnapshot();
+    });
+
+    it('combines meta fields from index pattern', () => {
+      const table = tabifyDocs(response, index);
+      expect(table.columns.map((col) => col.id)).toEqual(
+        expect.arrayContaining(['_id', '_index', '_score', '_type'])
+      );
+    });
 
-  it('works without provided index pattern', () => {
-    const table = tabifyDocs(response);
-    expect(table).toMatchSnapshot();
+    it('works without provided index pattern', () => {
+      const table = tabifyDocs(response);
+      expect(table).toMatchSnapshot();
+    });
   });
 });
diff --git a/src/plugins/data/common/search/tabify/tabify_docs.ts b/src/plugins/data/common/search/tabify/tabify_docs.ts
index 8e628e7741df56..4259488771761c 100644
--- a/src/plugins/data/common/search/tabify/tabify_docs.ts
+++ b/src/plugins/data/common/search/tabify/tabify_docs.ts
@@ -11,12 +11,60 @@ import { isPlainObject } from 'lodash';
 import { IndexPattern } from '../..';
 import { Datatable, DatatableColumn, DatatableColumnType } from '../../../../expressions/common';
 
+type ValidMetaFieldNames = keyof Pick<
+  estypes.SearchHit,
+  | '_id'
+  | '_ignored'
+  | '_index'
+  | '_node'
+  | '_primary_term'
+  | '_routing'
+  | '_score'
+  | '_seq_no'
+  | '_shard'
+  | '_source'
+  | '_type'
+  | '_version'
+>;
+const VALID_META_FIELD_NAMES: ValidMetaFieldNames[] = [
+  '_id',
+  '_ignored',
+  '_index',
+  '_node',
+  '_primary_term',
+  '_routing',
+  '_score',
+  '_seq_no',
+  '_shard',
+  '_source',
+  '_type',
+  '_version',
+];
+
+function isValidMetaFieldName(field: string): field is ValidMetaFieldNames {
+  // Since the array above is more narrowly typed than string[], we cannot use
+  // string to find a value in here. We manually cast it to wider string[] type
+  // so we're able to use `includes` on it.
+  return (VALID_META_FIELD_NAMES as string[]).includes(field);
+}
+
 export interface TabifyDocsOptions {
   shallow?: boolean;
+  /**
+   * If set to `false` the _source of the document, if requested, won't be
+   * merged into the flattened document.
+   */
   source?: boolean;
-  meta?: boolean;
 }
 
+/**
+ * Flattens an individual hit (from an ES response) into an object. This will
+ * create flattened field names, like `user.name`.
+ *
+ * @param hit The hit from an ES reponse's hits.hits[]
+ * @param indexPattern The index pattern for the requested index if available.
+ * @param params Parameters how to flatten the hit
+ */
 export function flattenHit(
   hit: estypes.SearchHit,
   indexPattern?: IndexPattern,
@@ -62,13 +110,36 @@ export function flattenHit(
   if (params?.source !== false && hit._source) {
     flatten(hit._source as Record<string, any>);
   }
-  if (params?.meta !== false) {
-    // combine the fields that Discover allows to add as columns
-    const { _id, _index, _type, _score } = hit;
-    flatten({ _id, _index, _score, _type });
-  }
 
-  return flat;
+  // Merge all valid meta fields into the flattened object
+  // expect for _source (in case that was specified as a meta field)
+  indexPattern?.metaFields?.forEach((metaFieldName) => {
+    if (!isValidMetaFieldName(metaFieldName) || metaFieldName === '_source') {
+      return;
+    }
+    flat[metaFieldName] = hit[metaFieldName];
+  });
+
+  // Use a proxy to make sure that keys are always returned in a specific order,
+  // so we have a guarantee on the flattened order of keys.
+  return new Proxy(flat, {
+    ownKeys: (target) => {
+      return Reflect.ownKeys(target).sort((a, b) => {
+        const aIsMeta = indexPattern?.metaFields?.includes(String(a));
+        const bIsMeta = indexPattern?.metaFields?.includes(String(b));
+        if (aIsMeta && bIsMeta) {
+          return String(a).localeCompare(String(b));
+        }
+        if (aIsMeta) {
+          return 1;
+        }
+        if (bIsMeta) {
+          return -1;
+        }
+        return String(a).localeCompare(String(b));
+      });
+    },
+  });
 }
 
 export const tabifyDocs = (
diff --git a/src/plugins/data/public/index.ts b/src/plugins/data/public/index.ts
index 3ae98c083976e1..4d51a7ae0ad772 100644
--- a/src/plugins/data/public/index.ts
+++ b/src/plugins/data/public/index.ts
@@ -52,7 +52,6 @@ import {
   ILLEGAL_CHARACTERS_VISIBLE,
   ILLEGAL_CHARACTERS,
   validateDataView,
-  flattenHitWrapper,
 } from './data_views';
 
 export type { IndexPatternsService } from './data_views';
@@ -69,7 +68,6 @@ export const indexPatterns = {
   getFieldSubtypeMulti,
   getFieldSubtypeNested,
   validate: validateDataView,
-  flattenHitWrapper,
 };
 
 export {
diff --git a/src/plugins/data_views/common/data_views/data_view.ts b/src/plugins/data_views/common/data_views/data_view.ts
index 5768ebe635729d..57db127208dc3c 100644
--- a/src/plugins/data_views/common/data_views/data_view.ts
+++ b/src/plugins/data_views/common/data_views/data_view.ts
@@ -72,6 +72,9 @@ export class DataView implements IIndexPattern {
     formatField: FormatFieldFn;
   };
   public formatField: FormatFieldFn;
+  /**
+   * @deprecated Use `flattenHit` utility method exported from data plugin instead.
+   */
   public flattenHit: (hit: Record<string, any>, deep?: boolean) => Record<string, any>;
   public metaFields: string[];
   /**
diff --git a/src/plugins/data_views/common/data_views/flatten_hit.ts b/src/plugins/data_views/common/data_views/flatten_hit.ts
index ddf484affa2982..0a6388f0914b15 100644
--- a/src/plugins/data_views/common/data_views/flatten_hit.ts
+++ b/src/plugins/data_views/common/data_views/flatten_hit.ts
@@ -6,6 +6,11 @@
  * Side Public License, v 1.
  */
 
+// --------- DEPRECATED ---------
+// This implementation of flattenHit is deprecated and should no longer be used.
+// If you consider adding features to this, please don't but use the `flattenHit`
+// implementation from the data plugin.
+
 import _ from 'lodash';
 import { DataView } from './data_view';
 
@@ -114,15 +119,3 @@ export function flattenHitWrapper(dataView: DataView, metaFields = {}, cache = n
     return decorateFlattened(flattened);
   };
 }
-
-/**
- * This wraps `flattenHitWrapper` so one single cache can be provided for all uses of that
- * function. The returned value of this function is what is included in the index patterns
- * setup contract.
- *
- * @public
- */
-export function createFlattenHitWrapper() {
-  const cache = new WeakMap();
-  return _.partial(flattenHitWrapper, _, _, cache);
-}
diff --git a/src/plugins/data_views/public/index.ts b/src/plugins/data_views/public/index.ts
index 572806df11fa3c..5c810ec1fd4c86 100644
--- a/src/plugins/data_views/public/index.ts
+++ b/src/plugins/data_views/public/index.ts
@@ -13,7 +13,7 @@ export {
   ILLEGAL_CHARACTERS,
   validateDataView,
 } from '../common/lib';
-export { flattenHitWrapper, formatHitProvider, onRedirectNoIndexPattern } from './data_views';
+export { formatHitProvider, onRedirectNoIndexPattern } from './data_views';
 
 export { IndexPatternField, IIndexPatternFieldList, TypeMeta } from '../common';
 
diff --git a/src/plugins/discover/public/__mocks__/index_pattern.ts b/src/plugins/discover/public/__mocks__/index_pattern.ts
index f9cc202f9063e2..2acb512617a6b4 100644
--- a/src/plugins/discover/public/__mocks__/index_pattern.ts
+++ b/src/plugins/discover/public/__mocks__/index_pattern.ts
@@ -6,9 +6,9 @@
  * Side Public License, v 1.
  */
 
-import { IIndexPatternFieldList } from '../../../data/common';
+import type { estypes } from '@elastic/elasticsearch';
+import { flattenHit, IIndexPatternFieldList } from '../../../data/common';
 import { IndexPattern } from '../../../data/common';
-import { indexPatterns } from '../../../data/public';
 
 const fields = [
   {
@@ -85,10 +85,11 @@ const indexPattern = {
   getFormatterForField: () => ({ convert: () => 'formatted' }),
 } as unknown as IndexPattern;
 
-indexPattern.flattenHit = indexPatterns.flattenHitWrapper(indexPattern, indexPattern.metaFields);
 indexPattern.isTimeBased = () => !!indexPattern.timeFieldName;
 indexPattern.formatField = (hit: Record<string, unknown>, fieldName: string) => {
-  return fieldName === '_source' ? hit._source : indexPattern.flattenHit(hit)[fieldName];
+  return fieldName === '_source'
+    ? hit._source
+    : flattenHit(hit as unknown as estypes.SearchHit, indexPattern)[fieldName];
 };
 
 export const indexPatternMock = indexPattern;
diff --git a/src/plugins/discover/public/__mocks__/index_pattern_with_timefield.ts b/src/plugins/discover/public/__mocks__/index_pattern_with_timefield.ts
index 0f64a6c67741d0..6cf8e8b3485ff9 100644
--- a/src/plugins/discover/public/__mocks__/index_pattern_with_timefield.ts
+++ b/src/plugins/discover/public/__mocks__/index_pattern_with_timefield.ts
@@ -6,9 +6,9 @@
  * Side Public License, v 1.
  */
 
-import { IIndexPatternFieldList } from '../../../data/common';
+import { flattenHit, IIndexPatternFieldList } from '../../../data/common';
 import { IndexPattern } from '../../../data/common';
-import { indexPatterns } from '../../../data/public';
+import type { estypes } from '@elastic/elasticsearch';
 
 const fields = [
   {
@@ -76,10 +76,11 @@ const indexPattern = {
   popularizeField: () => {},
 } as unknown as IndexPattern;
 
-indexPattern.flattenHit = indexPatterns.flattenHitWrapper(indexPattern, indexPattern.metaFields);
 indexPattern.isTimeBased = () => !!indexPattern.timeFieldName;
 indexPattern.formatField = (hit: Record<string, unknown>, fieldName: string) => {
-  return fieldName === '_source' ? hit._source : indexPattern.flattenHit(hit)[fieldName];
+  return fieldName === '_source'
+    ? hit._source
+    : flattenHit(hit as unknown as estypes.SearchHit, indexPattern)[fieldName];
 };
 
 export const indexPatternWithTimefieldMock = indexPattern;
diff --git a/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_row.tsx b/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_row.tsx
index 8d56f2adeaf650..d91735460af085 100644
--- a/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_row.tsx
+++ b/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_row.tsx
@@ -10,6 +10,7 @@ import React, { Fragment, useCallback, useMemo, useState } from 'react';
 import classNames from 'classnames';
 import { i18n } from '@kbn/i18n';
 import { EuiButtonEmpty, EuiIcon } from '@elastic/eui';
+import { flattenHit } from '../../../../../../../../data/common';
 import { DocViewer } from '../../../../../components/doc_viewer/doc_viewer';
 import { FilterManager, IndexPattern } from '../../../../../../../../data/public';
 import { TableCell } from './table_row/table_cell';
@@ -57,7 +58,7 @@ export const TableRow = ({
   });
   const anchorDocTableRowSubj = row.isAnchor ? ' docTableAnchorRow' : '';
 
-  const flattenedRow = useMemo(() => indexPattern.flattenHit(row), [indexPattern, row]);
+  const flattenedRow = useMemo(() => flattenHit(row, indexPattern), [indexPattern, row]);
   const mapping = useMemo(() => indexPattern.fields.getByName, [indexPattern]);
 
   // toggle display of the rows details, a full list of the fields from each row
diff --git a/src/plugins/discover/public/application/apps/main/components/sidebar/discover_sidebar.test.tsx b/src/plugins/discover/public/application/apps/main/components/sidebar/discover_sidebar.test.tsx
index e53bf006e2b4ed..a550dbd59b9fa7 100644
--- a/src/plugins/discover/public/application/apps/main/components/sidebar/discover_sidebar.test.tsx
+++ b/src/plugins/discover/public/application/apps/main/components/sidebar/discover_sidebar.test.tsx
@@ -15,7 +15,7 @@ import realHits from '../../../../../__fixtures__/real_hits.js';
 import { mountWithIntl } from '@kbn/test/jest';
 import React from 'react';
 import { DiscoverSidebarProps } from './discover_sidebar';
-import { IndexPatternAttributes } from '../../../../../../../data/common';
+import { flattenHit, IndexPatternAttributes } from '../../../../../../../data/common';
 import { SavedObject } from '../../../../../../../../core/types';
 import { getDefaultFieldFilter } from './lib/field_filter';
 import { DiscoverSidebarComponent as DiscoverSidebar } from './discover_sidebar';
@@ -44,7 +44,7 @@ function getCompProps(): DiscoverSidebarProps {
   const fieldCounts: Record<string, number> = {};
 
   for (const hit of hits) {
-    for (const key of Object.keys(indexPattern.flattenHit(hit))) {
+    for (const key of Object.keys(flattenHit(hit, indexPattern))) {
       fieldCounts[key] = (fieldCounts[key] || 0) + 1;
     }
   }
diff --git a/src/plugins/discover/public/application/apps/main/components/sidebar/discover_sidebar_responsive.test.tsx b/src/plugins/discover/public/application/apps/main/components/sidebar/discover_sidebar_responsive.test.tsx
index 9d73f885c988da..ded7897d2a9e5a 100644
--- a/src/plugins/discover/public/application/apps/main/components/sidebar/discover_sidebar_responsive.test.tsx
+++ b/src/plugins/discover/public/application/apps/main/components/sidebar/discover_sidebar_responsive.test.tsx
@@ -15,7 +15,7 @@ import realHits from '../../../../../__fixtures__/real_hits.js';
 import { act } from 'react-dom/test-utils';
 import { mountWithIntl } from '@kbn/test/jest';
 import React from 'react';
-import { IndexPatternAttributes } from '../../../../../../../data/common';
+import { flattenHit, IndexPatternAttributes } from '../../../../../../../data/common';
 import { SavedObject } from '../../../../../../../../core/types';
 import {
   DiscoverSidebarResponsive,
@@ -72,7 +72,7 @@ function getCompProps(): DiscoverSidebarResponsiveProps {
   const indexPattern = stubLogstashIndexPattern;
 
   // @ts-expect-error _.each() is passing additional args to flattenHit
-  const hits = each(cloneDeep(realHits), indexPattern.flattenHit) as Array<
+  const hits = each(cloneDeep(realHits), (hit) => flattenHit(hit, indexPattern)) as Array<
     Record<string, unknown>
   > as ElasticSearchHit[];
 
@@ -83,7 +83,7 @@ function getCompProps(): DiscoverSidebarResponsiveProps {
   ];
 
   for (const hit of hits) {
-    for (const key of Object.keys(indexPattern.flattenHit(hit))) {
+    for (const key of Object.keys(flattenHit(hit, indexPattern))) {
       mockfieldCounts[key] = (mockfieldCounts[key] || 0) + 1;
     }
   }
diff --git a/src/plugins/discover/public/application/apps/main/components/sidebar/lib/field_calculator.js b/src/plugins/discover/public/application/apps/main/components/sidebar/lib/field_calculator.js
index 8f86cdad82cf74..be7e9c616273db 100644
--- a/src/plugins/discover/public/application/apps/main/components/sidebar/lib/field_calculator.js
+++ b/src/plugins/discover/public/application/apps/main/components/sidebar/lib/field_calculator.js
@@ -8,12 +8,12 @@
 
 import { map, sortBy, without, each, defaults, isObject } from 'lodash';
 import { i18n } from '@kbn/i18n';
+import { flattenHit } from '../../../../../../../../data/common';
 
 function getFieldValues(hits, field, indexPattern) {
   const name = field.name;
-  const flattenHit = indexPattern.flattenHit;
   return map(hits, function (hit) {
-    return flattenHit(hit)[name];
+    return flattenHit(hit, indexPattern)[name];
   });
 }
 
diff --git a/src/plugins/discover/public/application/apps/main/components/sidebar/lib/field_calculator.test.ts b/src/plugins/discover/public/application/apps/main/components/sidebar/lib/field_calculator.test.ts
index c3ff7970c5aac9..d4bc41f36b2d41 100644
--- a/src/plugins/discover/public/application/apps/main/components/sidebar/lib/field_calculator.test.ts
+++ b/src/plugins/discover/public/application/apps/main/components/sidebar/lib/field_calculator.test.ts
@@ -13,6 +13,7 @@ import { keys, each, cloneDeep, clone, uniq, filter, map } from 'lodash';
 import realHits from '../../../../../../__fixtures__/real_hits.js';
 
 import { IndexPattern } from '../../../../../../../../data/public';
+import { flattenHit } from '../../../../../../../../data/common';
 
 // @ts-expect-error
 import { fieldCalculator } from './field_calculator';
@@ -120,7 +121,7 @@ describe('fieldCalculator', function () {
     let hits: any;
 
     beforeEach(function () {
-      hits = each(cloneDeep(realHits), (hit) => indexPattern.flattenHit(hit));
+      hits = each(cloneDeep(realHits), (hit) => flattenHit(hit, indexPattern));
     });
 
     it('Should return an array of values for _source fields', function () {
diff --git a/src/plugins/discover/public/application/apps/main/utils/calc_field_counts.ts b/src/plugins/discover/public/application/apps/main/utils/calc_field_counts.ts
index 1ce7023539be4b..211c4e5c8b0698 100644
--- a/src/plugins/discover/public/application/apps/main/utils/calc_field_counts.ts
+++ b/src/plugins/discover/public/application/apps/main/utils/calc_field_counts.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import type { IndexPattern } from 'src/plugins/data/common';
+import { flattenHit, IndexPattern } from '../../../../../../data/common';
 import { ElasticSearchHit } from '../../../doc_views/doc_views_types';
 
 /**
@@ -22,7 +22,7 @@ export function calcFieldCounts(
     return {};
   }
   for (const hit of rows) {
-    const fields = Object.keys(indexPattern.flattenHit(hit));
+    const fields = Object.keys(flattenHit(hit, indexPattern));
     for (const fieldName of fields) {
       counts[fieldName] = (counts[fieldName] || 0) + 1;
     }
diff --git a/src/plugins/discover/public/application/components/discover_grid/discover_grid.tsx b/src/plugins/discover/public/application/components/discover_grid/discover_grid.tsx
index 0fe506b3b8537e..11323080274a98 100644
--- a/src/plugins/discover/public/application/components/discover_grid/discover_grid.tsx
+++ b/src/plugins/discover/public/application/components/discover_grid/discover_grid.tsx
@@ -21,7 +21,7 @@ import {
   EuiLoadingSpinner,
   EuiIcon,
 } from '@elastic/eui';
-import type { IndexPattern } from 'src/plugins/data/common';
+import { flattenHit, IndexPattern } from '../../../../../data/common';
 import { DocViewFilterFn, ElasticSearchHit } from '../../doc_views/doc_views_types';
 import { getSchemaDetectors } from './discover_grid_schema';
 import { DiscoverGridFlyout } from './discover_grid_flyout';
@@ -271,7 +271,7 @@ export const DiscoverGrid = ({
       getRenderCellValueFn(
         indexPattern,
         displayedRows,
-        displayedRows ? displayedRows.map((hit) => indexPattern.flattenHit(hit)) : [],
+        displayedRows ? displayedRows.map((hit) => flattenHit(hit, indexPattern)) : [],
         useNewFieldsApi,
         fieldsToShow,
         services.uiSettings.get(MAX_DOC_FIELDS_DISPLAYED)
diff --git a/src/plugins/discover/public/application/components/discover_grid/discover_grid_cell_actions.tsx b/src/plugins/discover/public/application/components/discover_grid/discover_grid_cell_actions.tsx
index b1823eb3d668c8..a31b551821ddb3 100644
--- a/src/plugins/discover/public/application/components/discover_grid/discover_grid_cell_actions.tsx
+++ b/src/plugins/discover/public/application/components/discover_grid/discover_grid_cell_actions.tsx
@@ -9,7 +9,7 @@
 import React, { useContext } from 'react';
 import { EuiDataGridColumnCellActionProps } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import { IndexPatternField } from '../../../../../data/common';
+import { flattenHit, IndexPatternField } from '../../../../../data/common';
 import { DiscoverGridContext } from './discover_grid_context';
 
 export const FilterInBtn = ({
@@ -27,7 +27,7 @@ export const FilterInBtn = ({
     <Component
       onClick={() => {
         const row = context.rows[rowIndex];
-        const flattened = context.indexPattern.flattenHit(row);
+        const flattened = flattenHit(row, context.indexPattern);
 
         if (flattened) {
           context.onFilter(columnId, flattened[columnId], '+');
@@ -60,7 +60,7 @@ export const FilterOutBtn = ({
     <Component
       onClick={() => {
         const row = context.rows[rowIndex];
-        const flattened = context.indexPattern.flattenHit(row);
+        const flattened = flattenHit(row, context.indexPattern);
 
         if (flattened) {
           context.onFilter(columnId, flattened[columnId], '-');
diff --git a/src/plugins/discover/public/application/components/discover_grid/discover_grid_document_selection.test.tsx b/src/plugins/discover/public/application/components/discover_grid/discover_grid_document_selection.test.tsx
index 41cf3f5a68edbf..e9b93e21553a2a 100644
--- a/src/plugins/discover/public/application/components/discover_grid/discover_grid_document_selection.test.tsx
+++ b/src/plugins/discover/public/application/components/discover_grid/discover_grid_document_selection.test.tsx
@@ -17,6 +17,17 @@ import { esHits } from '../../../__mocks__/es_hits';
 import { indexPatternMock } from '../../../__mocks__/index_pattern';
 import { DiscoverGridContext } from './discover_grid_context';
 
+const baseContextMock = {
+  expanded: undefined,
+  setExpanded: jest.fn(),
+  rows: esHits,
+  onFilter: jest.fn(),
+  indexPattern: indexPatternMock,
+  isDarkMode: false,
+  selectedDocs: [],
+  setSelectedDocs: jest.fn(),
+};
+
 describe('document selection', () => {
   describe('getDocId', () => {
     test('doc with custom routing', () => {
@@ -39,14 +50,7 @@ describe('document selection', () => {
   describe('SelectButton', () => {
     test('is not checked', () => {
       const contextMock = {
-        expanded: undefined,
-        setExpanded: jest.fn(),
-        rows: esHits,
-        onFilter: jest.fn(),
-        indexPattern: indexPatternMock,
-        isDarkMode: false,
-        selectedDocs: [],
-        setSelectedDocs: jest.fn(),
+        ...baseContextMock,
       };
 
       const component = mountWithIntl(
@@ -68,14 +72,8 @@ describe('document selection', () => {
 
     test('is checked', () => {
       const contextMock = {
-        expanded: undefined,
-        setExpanded: jest.fn(),
-        rows: esHits,
-        onFilter: jest.fn(),
-        indexPattern: indexPatternMock,
-        isDarkMode: false,
+        ...baseContextMock,
         selectedDocs: ['i::1::'],
-        setSelectedDocs: jest.fn(),
       };
 
       const component = mountWithIntl(
@@ -97,14 +95,7 @@ describe('document selection', () => {
 
     test('adding a selection', () => {
       const contextMock = {
-        expanded: undefined,
-        setExpanded: jest.fn(),
-        rows: esHits,
-        onFilter: jest.fn(),
-        indexPattern: indexPatternMock,
-        isDarkMode: false,
-        selectedDocs: [],
-        setSelectedDocs: jest.fn(),
+        ...baseContextMock,
       };
 
       const component = mountWithIntl(
@@ -126,14 +117,8 @@ describe('document selection', () => {
     });
     test('removing a selection', () => {
       const contextMock = {
-        expanded: undefined,
-        setExpanded: jest.fn(),
-        rows: esHits,
-        onFilter: jest.fn(),
-        indexPattern: indexPatternMock,
-        isDarkMode: false,
+        ...baseContextMock,
         selectedDocs: ['i::1::'],
-        setSelectedDocs: jest.fn(),
       };
 
       const component = mountWithIntl(
diff --git a/src/plugins/discover/public/application/components/discover_grid/discover_grid_expand_button.test.tsx b/src/plugins/discover/public/application/components/discover_grid/discover_grid_expand_button.test.tsx
index d1299b39a25b2e..3f7cb70091cfa6 100644
--- a/src/plugins/discover/public/application/components/discover_grid/discover_grid_expand_button.test.tsx
+++ b/src/plugins/discover/public/application/components/discover_grid/discover_grid_expand_button.test.tsx
@@ -14,17 +14,21 @@ import { DiscoverGridContext } from './discover_grid_context';
 import { indexPatternMock } from '../../../__mocks__/index_pattern';
 import { esHits } from '../../../__mocks__/es_hits';
 
+const baseContextMock = {
+  expanded: undefined,
+  setExpanded: jest.fn(),
+  rows: esHits,
+  onFilter: jest.fn(),
+  indexPattern: indexPatternMock,
+  isDarkMode: false,
+  selectedDocs: [],
+  setSelectedDocs: jest.fn(),
+};
+
 describe('Discover grid view button ', function () {
   it('when no document is expanded, setExpanded is called with current document', async () => {
     const contextMock = {
-      expanded: undefined,
-      setExpanded: jest.fn(),
-      rows: esHits,
-      onFilter: jest.fn(),
-      indexPattern: indexPatternMock,
-      isDarkMode: false,
-      selectedDocs: [],
-      setSelectedDocs: jest.fn(),
+      ...baseContextMock,
     };
 
     const component = mountWithIntl(
@@ -45,14 +49,8 @@ describe('Discover grid view button ', function () {
   });
   it('when the current document is expanded, setExpanded is called with undefined', async () => {
     const contextMock = {
+      ...baseContextMock,
       expanded: esHits[0],
-      setExpanded: jest.fn(),
-      rows: esHits,
-      onFilter: jest.fn(),
-      indexPattern: indexPatternMock,
-      isDarkMode: false,
-      selectedDocs: [],
-      setSelectedDocs: jest.fn(),
     };
 
     const component = mountWithIntl(
@@ -73,14 +71,8 @@ describe('Discover grid view button ', function () {
   });
   it('when another document is expanded, setExpanded is called with the current document', async () => {
     const contextMock = {
+      ...baseContextMock,
       expanded: esHits[0],
-      setExpanded: jest.fn(),
-      rows: esHits,
-      onFilter: jest.fn(),
-      indexPattern: indexPatternMock,
-      isDarkMode: false,
-      selectedDocs: [],
-      setSelectedDocs: jest.fn(),
     };
 
     const component = mountWithIntl(
diff --git a/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.test.tsx b/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.test.tsx
index 5aca237d465813..6556876217953c 100644
--- a/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.test.tsx
+++ b/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.test.tsx
@@ -11,6 +11,7 @@ import { ReactWrapper, shallow } from 'enzyme';
 import { getRenderCellValueFn } from './get_render_cell_value';
 import { indexPatternMock } from '../../../__mocks__/index_pattern';
 import { ElasticSearchHit } from '../../doc_views/doc_views_types';
+import { flattenHit } from 'src/plugins/data/common';
 
 jest.mock('../../../../../kibana_react/public', () => ({
   useUiSetting: () => true,
@@ -68,12 +69,16 @@ const rowsFieldsWithTopLevelObject: ElasticSearchHit[] = [
   },
 ];
 
+const flatten = (hit: ElasticSearchHit): Record<string, unknown> => {
+  return flattenHit(hit, indexPatternMock);
+};
+
 describe('Discover grid cell rendering', function () {
   it('renders bytes column correctly', () => {
     const DiscoverGridCellValue = getRenderCellValueFn(
       indexPatternMock,
       rowsSource,
-      rowsSource.map((row) => indexPatternMock.flattenHit(row)),
+      rowsSource.map(flatten),
       false,
       [],
       100
@@ -95,7 +100,7 @@ describe('Discover grid cell rendering', function () {
     const DiscoverGridCellValue = getRenderCellValueFn(
       indexPatternMock,
       rowsSource,
-      rowsSource.map((row) => indexPatternMock.flattenHit(row)),
+      rowsSource.map(flatten),
       false,
       [],
       100
@@ -146,7 +151,7 @@ describe('Discover grid cell rendering', function () {
     const DiscoverGridCellValue = getRenderCellValueFn(
       indexPatternMock,
       rowsSource,
-      rowsSource.map((row) => indexPatternMock.flattenHit(row)),
+      rowsSource.map(flatten),
       false,
       [],
       100
@@ -189,7 +194,7 @@ describe('Discover grid cell rendering', function () {
     const DiscoverGridCellValue = getRenderCellValueFn(
       indexPatternMock,
       rowsFields,
-      rowsFields.map((row) => indexPatternMock.flattenHit(row)),
+      rowsFields.map(flatten),
       true,
       [],
       100
@@ -244,7 +249,7 @@ describe('Discover grid cell rendering', function () {
     const DiscoverGridCellValue = getRenderCellValueFn(
       indexPatternMock,
       rowsFields,
-      rowsFields.map((row) => indexPatternMock.flattenHit(row)),
+      rowsFields.map(flatten),
       true,
       [],
       // this is the number of rendered items
@@ -287,7 +292,7 @@ describe('Discover grid cell rendering', function () {
     const DiscoverGridCellValue = getRenderCellValueFn(
       indexPatternMock,
       rowsFields,
-      rowsFields.map((row) => indexPatternMock.flattenHit(row)),
+      rowsFields.map(flatten),
       true,
       [],
       100
@@ -335,7 +340,7 @@ describe('Discover grid cell rendering', function () {
     const DiscoverGridCellValue = getRenderCellValueFn(
       indexPatternMock,
       rowsFieldsWithTopLevelObject,
-      rowsFieldsWithTopLevelObject.map((row) => indexPatternMock.flattenHit(row)),
+      rowsFieldsWithTopLevelObject.map(flatten),
       true,
       [],
       100
@@ -376,7 +381,7 @@ describe('Discover grid cell rendering', function () {
     const DiscoverGridCellValue = getRenderCellValueFn(
       indexPatternMock,
       rowsFieldsWithTopLevelObject,
-      rowsFieldsWithTopLevelObject.map((row) => indexPatternMock.flattenHit(row)),
+      rowsFieldsWithTopLevelObject.map(flatten),
       true,
       [],
       100
@@ -416,7 +421,7 @@ describe('Discover grid cell rendering', function () {
     const DiscoverGridCellValue = getRenderCellValueFn(
       indexPatternMock,
       rowsFieldsWithTopLevelObject,
-      rowsFieldsWithTopLevelObject.map((row) => indexPatternMock.flattenHit(row)),
+      rowsFieldsWithTopLevelObject.map(flatten),
       true,
       [],
       100
@@ -447,7 +452,7 @@ describe('Discover grid cell rendering', function () {
     const DiscoverGridCellValue = getRenderCellValueFn(
       indexPatternMock,
       rowsFieldsWithTopLevelObject,
-      rowsFieldsWithTopLevelObject.map((row) => indexPatternMock.flattenHit(row)),
+      rowsFieldsWithTopLevelObject.map(flatten),
       true,
       [],
       100
@@ -466,7 +471,9 @@ describe('Discover grid cell rendering', function () {
       <span
         dangerouslySetInnerHTML={
           Object {
-            "__html": 100,
+            "__html": Array [
+              100,
+            ],
           }
         }
       />
@@ -477,7 +484,7 @@ describe('Discover grid cell rendering', function () {
     const DiscoverGridCellValue = getRenderCellValueFn(
       indexPatternMock,
       rowsSource,
-      rowsSource.map((row) => indexPatternMock.flattenHit(row)),
+      rowsSource.map(flatten),
       false,
       [],
       100
@@ -499,7 +506,7 @@ describe('Discover grid cell rendering', function () {
     const DiscoverGridCellValue = getRenderCellValueFn(
       indexPatternMock,
       rowsSource,
-      rowsSource.map((row) => indexPatternMock.flattenHit(row)),
+      rowsSource.map(flatten),
       false,
       [],
       100
diff --git a/src/plugins/discover/public/application/components/table/table.test.tsx b/src/plugins/discover/public/application/components/table/table.test.tsx
index 3f010d9d07737a..ce914edcec7030 100644
--- a/src/plugins/discover/public/application/components/table/table.test.tsx
+++ b/src/plugins/discover/public/application/components/table/table.test.tsx
@@ -10,7 +10,7 @@ import React from 'react';
 import { mountWithIntl } from '@kbn/test/jest';
 import { findTestSubject } from '@elastic/eui/lib/test';
 import { DocViewerTable, DocViewerTableProps } from './table';
-import { indexPatterns, IndexPattern } from '../../../../../data/public';
+import { IndexPattern } from '../../../../../data/public';
 import { ElasticSearchHit } from '../../doc_views/doc_views_types';
 
 jest.mock('../../../kibana_services', () => ({
@@ -65,7 +65,7 @@ const indexPattern = {
     ],
   },
   metaFields: ['_index', '_score'],
-  flattenHit: undefined,
+  flattenHit: jest.fn(),
   formatHit: jest.fn((hit) => hit._source),
 } as unknown as IndexPattern;
 
@@ -73,8 +73,6 @@ indexPattern.fields.getByName = (name: string) => {
   return indexPattern.fields.getAll().find((field) => field.name === name);
 };
 
-indexPattern.flattenHit = indexPatterns.flattenHitWrapper(indexPattern, indexPattern.metaFields);
-
 const mountComponent = (props: DocViewerTableProps) => {
   return mountWithIntl(<DocViewerTable {...props} />);
 };
diff --git a/src/plugins/discover/public/application/components/table/table.tsx b/src/plugins/discover/public/application/components/table/table.tsx
index eab3ba6e3d29a0..7f597d846f88f0 100644
--- a/src/plugins/discover/public/application/components/table/table.tsx
+++ b/src/plugins/discover/public/application/components/table/table.tsx
@@ -9,6 +9,7 @@
 import React, { useCallback, useMemo } from 'react';
 import { EuiInMemoryTable } from '@elastic/eui';
 import { IndexPattern, IndexPatternField } from '../../../../../data/public';
+import { flattenHit } from '../../../../../data/common';
 import { SHOW_MULTIFIELDS } from '../../../../common';
 import { getServices } from '../../../kibana_services';
 import { isNestedFieldParent } from '../../apps/main/utils/nested_fields';
@@ -95,7 +96,7 @@ export const DocViewerTable = ({
     return null;
   }
 
-  const flattened = indexPattern?.flattenHit(hit);
+  const flattened = flattenHit(hit, indexPattern, { source: true });
   const fieldsToShow = getFieldsToShow(Object.keys(flattened), indexPattern, showMultiFields);
 
   const items: FieldRecord[] = Object.keys(flattened)
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.test.ts b/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.test.ts
index f393661e4c490d..1902c4ed0272e4 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.test.ts
@@ -75,6 +75,7 @@ const mockSearchSourceGetFieldDefault = jest.fn().mockImplementation((key: strin
           getByName: jest.fn().mockImplementation(() => []),
           getByType: jest.fn().mockImplementation(() => []),
         },
+        metaFields: ['_id', '_index', '_type', '_score'],
         getFormatterForField: jest.fn(),
       };
   }
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.ts b/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.ts
index c269677ae930d4..6c2989d54309d8 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.ts
@@ -356,7 +356,7 @@ export class CsvGenerator {
 
         let table: Datatable | undefined;
         try {
-          table = tabifyDocs(results, index, { shallow: true, meta: true });
+          table = tabifyDocs(results, index, { shallow: true });
         } catch (err) {
           this.logger.error(err);
         }

From f52c718f112bdba3320ac4591a7d3098082f7014 Mon Sep 17 00:00:00 2001
From: Thomas Neirynck <thomas@elastic.co>
Date: Thu, 14 Oct 2021 09:07:22 -0400
Subject: [PATCH 52/71] fix cloudwatch category assignmet (#114928)

---
 src/plugins/home/server/tutorials/cloudwatch_logs/index.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/plugins/home/server/tutorials/cloudwatch_logs/index.ts b/src/plugins/home/server/tutorials/cloudwatch_logs/index.ts
index dd035a66c5cedb..cf0c27ed9be731 100644
--- a/src/plugins/home/server/tutorials/cloudwatch_logs/index.ts
+++ b/src/plugins/home/server/tutorials/cloudwatch_logs/index.ts
@@ -53,6 +53,6 @@ export function cloudwatchLogsSpecProvider(context: TutorialContext): TutorialSc
     onPrem: onPremInstructions([], context),
     elasticCloud: cloudInstructions(),
     onPremElasticCloud: onPremCloudInstructions(),
-    integrationBrowserCategories: ['security', 'network', 'web'],
+    integrationBrowserCategories: ['aws', 'cloud', 'datastore', 'security', 'network'],
   };
 }

From 4db243703649d955500208a4ca89690b52e5fc23 Mon Sep 17 00:00:00 2001
From: Marco Liberati <dej611@users.noreply.github.com>
Date: Thu, 14 Oct 2021 15:28:40 +0200
Subject: [PATCH 53/71] [Lens] Thresholds: when computing default static value
 take into account all layer metrics (#113647)

* :sparkles: compute the default threshold based on data bounds

* :bug: Fix multi layer types issue

* :white_check_mark: Fix test

* :white_check_mark: Fix other test

* :bug: Fix computation bug for the initial static value

* :white_check_mark: Add new suite of test for static value computation

* :bug: Fix extents bug and refactor in a single function + tests

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../public/xy_visualization/expression.tsx    |  30 +-
 .../public/xy_visualization/state_helpers.ts  |   4 +
 .../threshold_helpers.test.ts                 | 569 ++++++++++++++++++
 .../xy_visualization/threshold_helpers.tsx    | 146 +++--
 4 files changed, 700 insertions(+), 49 deletions(-)
 create mode 100644 x-pack/plugins/lens/public/xy_visualization/threshold_helpers.test.ts

diff --git a/x-pack/plugins/lens/public/xy_visualization/expression.tsx b/x-pack/plugins/lens/public/xy_visualization/expression.tsx
index 87462e71f3cf69..7aee537ebbeddc 100644
--- a/x-pack/plugins/lens/public/xy_visualization/expression.tsx
+++ b/x-pack/plugins/lens/public/xy_visualization/expression.tsx
@@ -67,6 +67,7 @@ import {
   getThresholdRequiredPaddings,
   ThresholdAnnotations,
 } from './expression_thresholds';
+import { computeOverallDataDomain } from './threshold_helpers';
 
 declare global {
   interface Window {
@@ -250,6 +251,10 @@ export function XYChart({
   const chartBaseTheme = chartsThemeService.useChartsBaseTheme();
   const darkMode = chartsThemeService.useDarkMode();
   const filteredLayers = getFilteredLayers(layers, data);
+  const layersById = filteredLayers.reduce((memo, layer) => {
+    memo[layer.layerId] = layer;
+    return memo;
+  }, {} as Record<string, LayerArgs>);
 
   const handleCursorUpdate = useActiveCursor(chartsActiveCursorService, chartRef, {
     datatables: Object.values(data.tables),
@@ -386,7 +391,7 @@ export function XYChart({
     const extent = axis.groupId === 'left' ? yLeftExtent : yRightExtent;
     const hasBarOrArea = Boolean(
       axis.series.some((series) => {
-        const seriesType = filteredLayers.find((l) => l.layerId === series.layer)?.seriesType;
+        const seriesType = layersById[series.layer]?.seriesType;
         return seriesType?.includes('bar') || seriesType?.includes('area');
       })
     );
@@ -406,20 +411,15 @@ export function XYChart({
       );
       if (!fit && axisHasThreshold) {
         // Remove this once the chart will support automatic annotation fit for other type of charts
-        for (const series of axis.series) {
-          const table = data.tables[series.layer];
-          for (const row of table.rows) {
-            for (const column of table.columns) {
-              if (column.id === series.accessor) {
-                const value = row[column.id];
-                if (typeof value === 'number') {
-                  // keep the 0 in view
-                  max = Math.max(value, max || 0, 0);
-                  min = Math.min(value, min || 0, 0);
-                }
-              }
-            }
-          }
+        const { min: computedMin, max: computedMax } = computeOverallDataDomain(
+          filteredLayers,
+          axis.series.map(({ accessor }) => accessor),
+          data.tables
+        );
+
+        if (computedMin != null && computedMax != null) {
+          max = Math.max(computedMax, max || 0);
+          min = Math.min(computedMin, min || 0);
         }
         for (const { layerId, yConfig } of thresholdLayers) {
           const table = data.tables[layerId];
diff --git a/x-pack/plugins/lens/public/xy_visualization/state_helpers.ts b/x-pack/plugins/lens/public/xy_visualization/state_helpers.ts
index 4edf7fdf5e512a..14a82011cb5264 100644
--- a/x-pack/plugins/lens/public/xy_visualization/state_helpers.ts
+++ b/x-pack/plugins/lens/public/xy_visualization/state_helpers.ts
@@ -26,6 +26,10 @@ export function isPercentageSeries(seriesType: SeriesType) {
   );
 }
 
+export function isStackedChart(seriesType: SeriesType) {
+  return seriesType.includes('stacked');
+}
+
 export function isHorizontalChart(layers: Array<{ seriesType: SeriesType }>) {
   return layers.every((l) => isHorizontalSeries(l.seriesType));
 }
diff --git a/x-pack/plugins/lens/public/xy_visualization/threshold_helpers.test.ts b/x-pack/plugins/lens/public/xy_visualization/threshold_helpers.test.ts
new file mode 100644
index 00000000000000..d7286de0316d67
--- /dev/null
+++ b/x-pack/plugins/lens/public/xy_visualization/threshold_helpers.test.ts
@@ -0,0 +1,569 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { XYLayerConfig } from '../../common/expressions';
+import { FramePublicAPI } from '../types';
+import { computeOverallDataDomain, getStaticValue } from './threshold_helpers';
+
+function getActiveData(json: Array<{ id: string; rows: Array<Record<string, number | null>> }>) {
+  return json.reduce((memo, { id, rows }) => {
+    const columns = Object.keys(rows[0]).map((columnId) => ({
+      id: columnId,
+      name: columnId,
+      meta: { type: 'number' as const },
+    }));
+    memo[id] = {
+      type: 'datatable' as const,
+      columns,
+      rows,
+    };
+    return memo;
+  }, {} as NonNullable<FramePublicAPI['activeData']>);
+}
+
+describe('threshold helpers', () => {
+  describe('getStaticValue', () => {
+    const hasDateHistogram = () => false;
+    const hasAllNumberHistogram = () => true;
+
+    it('should return fallback value on missing data', () => {
+      expect(getStaticValue([], 'x', {}, hasAllNumberHistogram)).toBe(100);
+    });
+
+    it('should return fallback value on no-configuration/missing hit on current data', () => {
+      // no-config: missing layer
+      expect(
+        getStaticValue(
+          [],
+          'x',
+          {
+            activeData: getActiveData([
+              { id: 'id-a', rows: Array(3).fill({ a: 100, b: 100, c: 100 }) },
+            ]),
+          },
+          hasAllNumberHistogram
+        )
+      ).toBe(100);
+      // accessor id has no hit in data
+      expect(
+        getStaticValue(
+          [{ layerId: 'id-a', seriesType: 'area' } as XYLayerConfig], // missing xAccessor for groupId == x
+          'x',
+          {
+            activeData: getActiveData([
+              { id: 'id-a', rows: Array(3).fill({ a: 100, b: 100, c: 100 }) },
+            ]),
+          },
+          hasAllNumberHistogram
+        )
+      ).toBe(100);
+      expect(
+        getStaticValue(
+          [
+            {
+              layerId: 'id-a',
+              seriesType: 'area',
+              layerType: 'data',
+              accessors: ['d'],
+            } as XYLayerConfig,
+          ], // missing hit of accessor "d" in data
+          'yLeft',
+          {
+            activeData: getActiveData([
+              { id: 'id-a', rows: Array(3).fill({ a: 100, b: 100, c: 100 }) },
+            ]),
+          },
+          hasAllNumberHistogram
+        )
+      ).toBe(100);
+      expect(
+        getStaticValue(
+          [
+            {
+              layerId: 'id-a',
+              seriesType: 'area',
+              layerType: 'data',
+              accessors: ['a'],
+            } as XYLayerConfig,
+          ], // missing yConfig fallbacks to left axis, but the requested group is yRight
+          'yRight',
+          {
+            activeData: getActiveData([
+              { id: 'id-a', rows: Array(3).fill({ a: 100, b: 100, c: 100 }) },
+            ]),
+          },
+          hasAllNumberHistogram
+        )
+      ).toBe(100);
+      expect(
+        getStaticValue(
+          [
+            {
+              layerId: 'id-a',
+              seriesType: 'area',
+              layerType: 'data',
+              accessors: ['a'],
+            } as XYLayerConfig,
+          ], // same as above with x groupId
+          'x',
+          {
+            activeData: getActiveData([
+              { id: 'id-a', rows: Array(3).fill({ a: 100, b: 100, c: 100 }) },
+            ]),
+          },
+          hasAllNumberHistogram
+        )
+      ).toBe(100);
+    });
+
+    it('should work for no yConfig defined and fallback to left axis', () => {
+      expect(
+        getStaticValue(
+          [
+            {
+              layerId: 'id-a',
+              seriesType: 'area',
+              layerType: 'data',
+              accessors: ['a'],
+            } as XYLayerConfig,
+          ],
+          'yLeft',
+          {
+            activeData: getActiveData([
+              { id: 'id-a', rows: Array(3).fill({ a: 100, b: 100, c: 100 }) },
+            ]),
+          },
+          hasAllNumberHistogram
+        )
+      ).toBe(75); // 3/4 of "a" only
+    });
+
+    it('should extract axis side from yConfig', () => {
+      expect(
+        getStaticValue(
+          [
+            {
+              layerId: 'id-a',
+              seriesType: 'area',
+              layerType: 'data',
+              accessors: ['a'],
+              yConfig: [{ forAccessor: 'a', axisMode: 'right' }],
+            } as XYLayerConfig,
+          ],
+          'yRight',
+          {
+            activeData: getActiveData([
+              { id: 'id-a', rows: Array(3).fill({ a: 100, b: 100, c: 100 }) },
+            ]),
+          },
+          hasAllNumberHistogram
+        )
+      ).toBe(75); // 3/4 of "a" only
+    });
+
+    it('should correctly distribute axis on left and right with different formatters when in auto', () => {
+      const tables = getActiveData([
+        { id: 'id-a', rows: Array(3).fill({ a: 100, b: 200, c: 100 }) },
+      ]);
+      tables['id-a'].columns[0].meta.params = { id: 'number' }; // a: number formatter
+      tables['id-a'].columns[1].meta.params = { id: 'percent' }; // b: percent formatter
+      expect(
+        getStaticValue(
+          [
+            {
+              layerId: 'id-a',
+              seriesType: 'area',
+              layerType: 'data',
+              accessors: ['a', 'b'],
+            } as XYLayerConfig,
+          ],
+          'yLeft',
+          { activeData: tables },
+          hasAllNumberHistogram
+        )
+      ).toBe(75); // 3/4 of "a" only
+      expect(
+        getStaticValue(
+          [
+            {
+              layerId: 'id-a',
+              seriesType: 'area',
+              layerType: 'data',
+              accessors: ['a', 'b'],
+            } as XYLayerConfig,
+          ],
+          'yRight',
+          { activeData: tables },
+          hasAllNumberHistogram
+        )
+      ).toBe(150); // 3/4 of "b" only
+    });
+
+    it('should ignore hasHistogram for left or right axis', () => {
+      const tables = getActiveData([
+        { id: 'id-a', rows: Array(3).fill({ a: 100, b: 200, c: 100 }) },
+      ]);
+      tables['id-a'].columns[0].meta.params = { id: 'number' }; // a: number formatter
+      tables['id-a'].columns[1].meta.params = { id: 'percent' }; // b: percent formatter
+      expect(
+        getStaticValue(
+          [
+            {
+              layerId: 'id-a',
+              seriesType: 'area',
+              layerType: 'data',
+              accessors: ['a', 'b'],
+            } as XYLayerConfig,
+          ],
+          'yLeft',
+          { activeData: tables },
+          hasDateHistogram
+        )
+      ).toBe(75); // 3/4 of "a" only
+      expect(
+        getStaticValue(
+          [
+            {
+              layerId: 'id-a',
+              seriesType: 'area',
+              layerType: 'data',
+              accessors: ['a', 'b'],
+            } as XYLayerConfig,
+          ],
+          'yRight',
+          { activeData: tables },
+          hasDateHistogram
+        )
+      ).toBe(150); // 3/4 of "b" only
+    });
+
+    it('should early exit for x group if a date histogram is detected', () => {
+      expect(
+        getStaticValue(
+          [
+            {
+              layerId: 'id-a',
+              seriesType: 'area',
+              layerType: 'data',
+              xAccessor: 'a',
+              accessors: [],
+            } as XYLayerConfig,
+          ],
+          'x', // this is influenced by the callback
+          {
+            activeData: getActiveData([
+              { id: 'id-a', rows: Array(3).fill({ a: 100, b: 100, c: 100 }) },
+            ]),
+          },
+          hasDateHistogram
+        )
+      ).toBe(100);
+    });
+
+    it('should not force zero-based interval for x group', () => {
+      expect(
+        getStaticValue(
+          [
+            {
+              layerId: 'id-a',
+              seriesType: 'area',
+              layerType: 'data',
+              xAccessor: 'a',
+              accessors: [],
+            } as XYLayerConfig,
+          ],
+          'x',
+          {
+            activeData: getActiveData([
+              {
+                id: 'id-a',
+                rows: Array(3)
+                  .fill(1)
+                  .map((_, i) => ({ a: i % 2 ? 33 : 50 })),
+              },
+            ]),
+          },
+          hasAllNumberHistogram
+        )
+      ).toBe(45.75); // 33 (min) + (50 - 33) * 3/4
+    });
+  });
+
+  describe('computeOverallDataDomain', () => {
+    it('should compute the correct value for a single layer with stacked series', () => {
+      for (const seriesType of ['bar_stacked', 'bar_horizontal_stacked', 'area_stacked'])
+        expect(
+          computeOverallDataDomain(
+            [{ layerId: 'id-a', seriesType, accessors: ['a', 'b', 'c'] } as XYLayerConfig],
+            ['a', 'b', 'c'],
+            getActiveData([
+              {
+                id: 'id-a',
+                rows: Array(3)
+                  .fill(1)
+                  .map((_, i) => ({
+                    a: i === 0 ? 25 : null,
+                    b: i === 1 ? 50 : null,
+                    c: i === 2 ? 75 : null,
+                  })),
+              },
+            ])
+          )
+        ).toEqual({ min: 0, max: 150 }); // there's just one series with 150, so the lowerbound fallbacks to 0
+    });
+
+    it('should work for percentage series', () => {
+      for (const seriesType of [
+        'bar_percentage_stacked',
+        'bar_horizontal_percentage_stacked',
+        'area_percentage_stacked',
+      ])
+        expect(
+          computeOverallDataDomain(
+            [{ layerId: 'id-a', seriesType, accessors: ['a', 'b', 'c'] } as XYLayerConfig],
+            ['a', 'b', 'c'],
+            getActiveData([
+              {
+                id: 'id-a',
+                rows: Array(3)
+                  .fill(1)
+                  .map((_, i) => ({
+                    a: i === 0 ? 0.25 : null,
+                    b: i === 1 ? 0.25 : null,
+                    c: i === 2 ? 0.25 : null,
+                  })),
+              },
+            ])
+          )
+        ).toEqual({ min: 0, max: 0.75 });
+    });
+
+    it('should compute the correct value for multiple layers with stacked series', () => {
+      for (const seriesType of ['bar_stacked', 'bar_horizontal_stacked', 'area_stacked']) {
+        expect(
+          computeOverallDataDomain(
+            [
+              { layerId: 'id-a', seriesType, accessors: ['a', 'b', 'c'] },
+              { layerId: 'id-b', seriesType, accessors: ['d', 'e', 'f'] },
+            ] as XYLayerConfig[],
+            ['a', 'b', 'c', 'd', 'e', 'f'],
+            getActiveData([
+              { id: 'id-a', rows: [{ a: 25, b: 100, c: 100 }] },
+              { id: 'id-b', rows: [{ d: 50, e: 50, f: 50 }] },
+            ])
+          )
+        ).toEqual({ min: 0, max: 375 });
+        // same as before but spread on 3 rows with nulls
+        expect(
+          computeOverallDataDomain(
+            [
+              { layerId: 'id-a', seriesType, accessors: ['a', 'b', 'c'] },
+              { layerId: 'id-b', seriesType, accessors: ['d', 'e', 'f'] },
+            ] as XYLayerConfig[],
+            ['a', 'b', 'c', 'd', 'e', 'f'],
+            getActiveData([
+              {
+                id: 'id-a',
+                rows: Array(3)
+                  .fill(1)
+                  .map((_, i) => ({
+                    a: i === 0 ? 25 : null,
+                    b: i === 1 ? 100 : null,
+                    c: i === 2 ? 100 : null,
+                  })),
+              },
+              {
+                id: 'id-b',
+                rows: Array(3)
+                  .fill(1)
+                  .map((_, i) => ({
+                    d: i === 0 ? 50 : null,
+                    e: i === 1 ? 50 : null,
+                    f: i === 2 ? 50 : null,
+                  })),
+              },
+            ])
+          )
+        ).toEqual({ min: 0, max: 375 });
+      }
+    });
+
+    it('should compute the correct value for multiple layers with non-stacked series', () => {
+      for (const seriesType of ['bar', 'bar_horizontal', 'line', 'area'])
+        expect(
+          computeOverallDataDomain(
+            [
+              { layerId: 'id-a', seriesType, accessors: ['a', 'b', 'c'] },
+              { layerId: 'id-b', seriesType, accessors: ['d', 'e', 'f'] },
+            ] as XYLayerConfig[],
+            ['a', 'b', 'c', 'd', 'e', 'f'],
+            getActiveData([
+              { id: 'id-a', rows: Array(3).fill({ a: 100, b: 100, c: 100 }) },
+              { id: 'id-b', rows: Array(3).fill({ d: 50, e: 50, f: 50 }) },
+            ])
+          )
+        ).toEqual({ min: 50, max: 100 });
+    });
+
+    it('should compute the correct value for mixed series (stacked + non-stacked)', () => {
+      for (const nonStackedSeries of ['bar', 'bar_horizontal', 'line', 'area']) {
+        for (const stackedSeries of ['bar_stacked', 'bar_horizontal_stacked', 'area_stacked']) {
+          expect(
+            computeOverallDataDomain(
+              [
+                { layerId: 'id-a', seriesType: nonStackedSeries, accessors: ['a', 'b', 'c'] },
+                { layerId: 'id-b', seriesType: stackedSeries, accessors: ['d', 'e', 'f'] },
+              ] as XYLayerConfig[],
+              ['a', 'b', 'c', 'd', 'e', 'f'],
+              getActiveData([
+                { id: 'id-a', rows: [{ a: 100, b: 100, c: 100 }] },
+                { id: 'id-b', rows: [{ d: 50, e: 50, f: 50 }] },
+              ])
+            )
+          ).toEqual({
+            min: 0, // min is 0 as there is at least one stacked series
+            max: 150, // max is id-b layer accessor sum
+          });
+        }
+      }
+    });
+
+    it('should compute the correct value for a histogram stacked chart', () => {
+      for (const seriesType of ['bar_stacked', 'bar_horizontal_stacked', 'area_stacked'])
+        expect(
+          computeOverallDataDomain(
+            [
+              { layerId: 'id-a', seriesType, xAccessor: 'c', accessors: ['a', 'b'] },
+              { layerId: 'id-b', seriesType, xAccessor: 'f', accessors: ['d', 'e'] },
+            ] as XYLayerConfig[],
+            ['a', 'b', 'd', 'e'],
+            getActiveData([
+              {
+                id: 'id-a',
+                rows: Array(3)
+                  .fill(1)
+                  .map((_, i) => ({ a: 50 * i, b: 100 * i, c: i })),
+              },
+              {
+                id: 'id-b',
+                rows: Array(3)
+                  .fill(1)
+                  .map((_, i) => ({ d: 25 * (i + 1), e: i % 2 ? 100 : null, f: i })),
+              },
+            ])
+          )
+        ).toEqual({ min: 0, max: 375 });
+    });
+
+    it('should compute the correct value for a histogram non-stacked chart', () => {
+      for (const seriesType of ['bar', 'bar_horizontal', 'line', 'area'])
+        expect(
+          computeOverallDataDomain(
+            [
+              { layerId: 'id-a', seriesType, xAccessor: 'c', accessors: ['a', 'b'] },
+              { layerId: 'id-b', seriesType, xAccessor: 'f', accessors: ['d', 'e'] },
+            ] as XYLayerConfig[],
+            ['a', 'b', 'd', 'e'],
+            getActiveData([
+              {
+                id: 'id-a',
+                rows: Array(3)
+                  .fill(1)
+                  .map((_, i) => ({ a: 50 * i, b: 100 * i, c: i })),
+              },
+              {
+                id: 'id-b',
+                rows: Array(3)
+                  .fill(1)
+                  .map((_, i) => ({ d: 25 * (i + 1), e: i % 2 ? 100 : null, f: i })),
+              },
+            ])
+          )
+        ).toEqual({ min: 0, max: 200 });
+    });
+
+    it('should compute the result taking into consideration negative-based intervals too', () => {
+      // stacked
+      expect(
+        computeOverallDataDomain(
+          [
+            {
+              layerId: 'id-a',
+              seriesType: 'area_stacked',
+              accessors: ['a', 'b', 'c'],
+            } as XYLayerConfig,
+          ],
+          ['a', 'b', 'c'],
+          getActiveData([
+            {
+              id: 'id-a',
+              rows: Array(3)
+                .fill(1)
+                .map((_, i) => ({
+                  a: i === 0 ? -100 : null,
+                  b: i === 1 ? 200 : null,
+                  c: i === 2 ? 100 : null,
+                })),
+            },
+          ])
+        )
+      ).toEqual({ min: 0, max: 200 }); // it is stacked, so max is the sum and 0 is the fallback
+      expect(
+        computeOverallDataDomain(
+          [{ layerId: 'id-a', seriesType: 'area', accessors: ['a', 'b', 'c'] } as XYLayerConfig],
+          ['a', 'b', 'c'],
+          getActiveData([
+            {
+              id: 'id-a',
+              rows: Array(3)
+                .fill(1)
+                .map((_, i) => ({
+                  a: i === 0 ? -100 : null,
+                  b: i === 1 ? 200 : null,
+                  c: i === 2 ? 100 : null,
+                })),
+            },
+          ])
+        )
+      ).toEqual({ min: -100, max: 200 });
+    });
+
+    it('should return no result if no layers or accessors are passed', () => {
+      expect(
+        computeOverallDataDomain(
+          [],
+          ['a', 'b', 'c'],
+          getActiveData([{ id: 'id-a', rows: Array(3).fill({ a: 100, b: 100, c: 100 }) }])
+        )
+      ).toEqual({ min: undefined, max: undefined });
+    });
+
+    it('should return no result if data or table is not available', () => {
+      expect(
+        computeOverallDataDomain(
+          [
+            { layerId: 'id-a', seriesType: 'area', accessors: ['a', 'b', 'c'] },
+            { layerId: 'id-b', seriesType: 'line', accessors: ['d', 'e', 'f'] },
+          ] as XYLayerConfig[],
+          ['a', 'b'],
+          getActiveData([{ id: 'id-c', rows: [{ a: 100, b: 100 }] }]) // mind the layer id here
+        )
+      ).toEqual({ min: undefined, max: undefined });
+
+      expect(
+        computeOverallDataDomain(
+          [
+            { layerId: 'id-a', seriesType: 'bar', accessors: ['a', 'b', 'c'] },
+            { layerId: 'id-b', seriesType: 'bar_stacked' },
+          ] as XYLayerConfig[],
+          ['a', 'b'],
+          getActiveData([])
+        )
+      ).toEqual({ min: undefined, max: undefined });
+    });
+  });
+});
diff --git a/x-pack/plugins/lens/public/xy_visualization/threshold_helpers.tsx b/x-pack/plugins/lens/public/xy_visualization/threshold_helpers.tsx
index ec473507094731..8bf5f84b15bad6 100644
--- a/x-pack/plugins/lens/public/xy_visualization/threshold_helpers.tsx
+++ b/x-pack/plugins/lens/public/xy_visualization/threshold_helpers.tsx
@@ -5,12 +5,13 @@
  * 2.0.
  */
 
+import { partition } from 'lodash';
 import { layerTypes } from '../../common';
 import type { XYLayerConfig, YConfig } from '../../common/expressions';
 import { Datatable } from '../../../../../src/plugins/expressions/public';
 import type { DatasourcePublicAPI, FramePublicAPI } from '../types';
 import { groupAxesByType } from './axes_configuration';
-import { isPercentageSeries } from './state_helpers';
+import { isPercentageSeries, isStackedChart } from './state_helpers';
 import type { XYState } from './types';
 import { checkScaleOperation } from './visualization_helpers';
 
@@ -91,14 +92,22 @@ export function getStaticValue(
 
   // filter and organize data dimensions into threshold groups
   // now pick the columnId in the active data
-  const { dataLayer, accessor } = getAccessorCriteriaForGroup(groupId, dataLayers, activeData);
-  if (groupId === 'x' && dataLayer && !layerHasNumberHistogram(dataLayer)) {
+  const {
+    dataLayers: filteredLayers,
+    untouchedDataLayers,
+    accessors,
+  } = getAccessorCriteriaForGroup(groupId, dataLayers, activeData);
+  if (
+    groupId === 'x' &&
+    filteredLayers.length &&
+    !untouchedDataLayers.some(layerHasNumberHistogram)
+  ) {
     return fallbackValue;
   }
   return (
     computeStaticValueForGroup(
-      dataLayer,
-      accessor,
+      filteredLayers,
+      accessors,
       activeData,
       groupId !== 'x' // histogram axis should compute the min based on the current data
     ) || fallbackValue
@@ -111,54 +120,123 @@ function getAccessorCriteriaForGroup(
   activeData: FramePublicAPI['activeData']
 ) {
   switch (groupId) {
-    case 'x':
-      const dataLayer = dataLayers.find(({ xAccessor }) => xAccessor);
+    case 'x': {
+      const filteredDataLayers = dataLayers.filter(({ xAccessor }) => xAccessor);
+      // need to reshape the dataLayers to match the other accessors format
       return {
-        dataLayer,
-        accessor: dataLayer?.xAccessor,
+        dataLayers: filteredDataLayers.map(({ accessors, xAccessor, ...rest }) => ({
+          ...rest,
+          accessors: [xAccessor] as string[],
+        })),
+        // need the untouched ones for some checks later on
+        untouchedDataLayers: filteredDataLayers,
+        accessors: filteredDataLayers.map(({ xAccessor }) => xAccessor) as string[],
       };
-    case 'yLeft':
+    }
+    case 'yLeft': {
       const { left } = groupAxesByType(dataLayers, activeData);
+      const leftIds = new Set(left.map(({ layer }) => layer));
+      const filteredDataLayers = dataLayers.filter(({ layerId }) => leftIds.has(layerId));
       return {
-        dataLayer: dataLayers.find(({ layerId }) => layerId === left[0]?.layer),
-        accessor: left[0]?.accessor,
+        dataLayers: filteredDataLayers,
+        untouchedDataLayers: filteredDataLayers,
+        accessors: left.map(({ accessor }) => accessor),
       };
-    case 'yRight':
+    }
+    case 'yRight': {
       const { right } = groupAxesByType(dataLayers, activeData);
+      const rightIds = new Set(right.map(({ layer }) => layer));
+      const filteredDataLayers = dataLayers.filter(({ layerId }) => rightIds.has(layerId));
       return {
-        dataLayer: dataLayers.find(({ layerId }) => layerId === right[0]?.layer),
-        accessor: right[0]?.accessor,
+        dataLayers: filteredDataLayers,
+        untouchedDataLayers: filteredDataLayers,
+        accessors: right.map(({ accessor }) => accessor),
       };
+    }
+  }
+}
+
+export function computeOverallDataDomain(
+  dataLayers: Array<Pick<XYLayerConfig, 'seriesType' | 'accessors' | 'xAccessor' | 'layerId'>>,
+  accessorIds: string[],
+  activeData: NonNullable<FramePublicAPI['activeData']>
+) {
+  const accessorMap = new Set(accessorIds);
+  let min: number | undefined;
+  let max: number | undefined;
+  const [stacked, unstacked] = partition(dataLayers, ({ seriesType }) =>
+    isStackedChart(seriesType)
+  );
+  for (const { layerId, accessors } of unstacked) {
+    const table = activeData[layerId];
+    if (table) {
+      for (const accessor of accessors) {
+        if (accessorMap.has(accessor)) {
+          for (const row of table.rows) {
+            const value = row[accessor];
+            if (typeof value === 'number') {
+              // when not stacked, do not keep the 0
+              max = max != null ? Math.max(value, max) : value;
+              min = min != null ? Math.min(value, min) : value;
+            }
+          }
+        }
+      }
+    }
+  }
+  // stacked can span multiple layers, so compute an overall max/min by bucket
+  const stackedResults: Record<string, number> = {};
+  for (const { layerId, accessors, xAccessor } of stacked) {
+    const table = activeData[layerId];
+    if (table) {
+      for (const accessor of accessors) {
+        if (accessorMap.has(accessor)) {
+          for (const row of table.rows) {
+            const value = row[accessor];
+            // start with a shared bucket
+            let bucket = 'shared';
+            // but if there's an xAccessor use it as new bucket system
+            if (xAccessor) {
+              bucket = row[xAccessor];
+            }
+            if (typeof value === 'number') {
+              stackedResults[bucket] = stackedResults[bucket] ?? 0;
+              stackedResults[bucket] += value;
+            }
+          }
+        }
+      }
+    }
+  }
+
+  for (const value of Object.values(stackedResults)) {
+    // for stacked extents keep 0 in view
+    max = Math.max(value, max || 0, 0);
+    min = Math.min(value, min || 0, 0);
   }
+
+  return { min, max };
 }
 
 function computeStaticValueForGroup(
-  dataLayer: XYLayerConfig | undefined,
-  accessorId: string | undefined,
+  dataLayers: Array<Pick<XYLayerConfig, 'seriesType' | 'accessors' | 'xAccessor' | 'layerId'>>,
+  accessorIds: string[],
   activeData: NonNullable<FramePublicAPI['activeData']>,
-  minZeroBased: boolean
+  minZeroOrNegativeBase: boolean = true
 ) {
   const defaultThresholdFactor = 3 / 4;
 
-  if (dataLayer && accessorId) {
-    if (isPercentageSeries(dataLayer?.seriesType)) {
+  if (dataLayers.length && accessorIds.length) {
+    if (dataLayers.some(({ seriesType }) => isPercentageSeries(seriesType))) {
       return defaultThresholdFactor;
     }
-    const tableId = Object.keys(activeData).find((key) =>
-      activeData[key].columns.some(({ id }) => id === accessorId)
-    );
-    if (tableId) {
-      const columnMax = activeData[tableId].rows.reduce(
-        (max, row) => Math.max(row[accessorId], max),
-        -Infinity
-      );
-      const columnMin = activeData[tableId].rows.reduce(
-        (max, row) => Math.min(row[accessorId], max),
-        Infinity
-      );
+
+    const { min, max } = computeOverallDataDomain(dataLayers, accessorIds, activeData);
+
+    if (min != null && max != null && isFinite(min) && isFinite(max)) {
       // Custom axis bounds can go below 0, so consider also lower values than 0
-      const finalMinValue = minZeroBased ? Math.min(0, columnMin) : columnMin;
-      const interval = columnMax - finalMinValue;
+      const finalMinValue = minZeroOrNegativeBase ? Math.min(0, min) : min;
+      const interval = max - finalMinValue;
       return Number((finalMinValue + interval * defaultThresholdFactor).toFixed(2));
     }
   }

From 586682a0c480a37e04aa717aceb2dcfa39835495 Mon Sep 17 00:00:00 2001
From: Maja Grubic <maja.grubic@elastic.co>
Date: Thu, 14 Oct 2021 15:49:35 +0200
Subject: [PATCH 54/71] [Discover] Rename default column in the advanced
 settings (#114100)

* [Discover] Rename default column in the advanced settings

* Fix eslint

* Rename default column to an empty string

* Fix typo

* Fix default column filtering

* Update comment

* Make an empty array a default columns

* Improve functional test

* Wording change

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../apps/main/utils/get_state_defaults.ts     | 11 +++++++--
 .../application/helpers/state_helpers.ts      |  7 +++++-
 src/plugins/discover/server/ui_settings.ts    |  5 ++--
 .../apps/discover/_discover_fields_api.ts     | 24 ++++++++++++++++++-
 4 files changed, 41 insertions(+), 6 deletions(-)

diff --git a/src/plugins/discover/public/application/apps/main/utils/get_state_defaults.ts b/src/plugins/discover/public/application/apps/main/utils/get_state_defaults.ts
index 11ebf0ecf9af48..f2f6e4a002aaf3 100644
--- a/src/plugins/discover/public/application/apps/main/utils/get_state_defaults.ts
+++ b/src/plugins/discover/public/application/apps/main/utils/get_state_defaults.ts
@@ -6,9 +6,13 @@
  * Side Public License, v 1.
  */
 
-import { cloneDeep } from 'lodash';
+import { cloneDeep, isEqual } from 'lodash';
 import { IUiSettingsClient } from 'kibana/public';
-import { DEFAULT_COLUMNS_SETTING, SORT_DEFAULT_ORDER_SETTING } from '../../../../../common';
+import {
+  DEFAULT_COLUMNS_SETTING,
+  SEARCH_FIELDS_FROM_SOURCE,
+  SORT_DEFAULT_ORDER_SETTING,
+} from '../../../../../common';
 import { SavedSearch } from '../../../../saved_searches';
 import { DataPublicPluginStart } from '../../../../../../data/public';
 
@@ -19,6 +23,9 @@ function getDefaultColumns(savedSearch: SavedSearch, config: IUiSettingsClient)
   if (savedSearch.columns && savedSearch.columns.length > 0) {
     return [...savedSearch.columns];
   }
+  if (config.get(SEARCH_FIELDS_FROM_SOURCE) && isEqual(config.get(DEFAULT_COLUMNS_SETTING), [])) {
+    return ['_source'];
+  }
   return [...config.get(DEFAULT_COLUMNS_SETTING)];
 }
 
diff --git a/src/plugins/discover/public/application/helpers/state_helpers.ts b/src/plugins/discover/public/application/helpers/state_helpers.ts
index fd17ec9516ab58..bb64f823d61a62 100644
--- a/src/plugins/discover/public/application/helpers/state_helpers.ts
+++ b/src/plugins/discover/public/application/helpers/state_helpers.ts
@@ -24,6 +24,7 @@ export function handleSourceColumnState<TState extends { columns?: string[] }>(
   }
   const useNewFieldsApi = !uiSettings.get(SEARCH_FIELDS_FROM_SOURCE);
   const defaultColumns = uiSettings.get(DEFAULT_COLUMNS_SETTING);
+
   if (useNewFieldsApi) {
     // if fields API is used, filter out the source column
     let cleanedColumns = state.columns.filter((column) => column !== '_source');
@@ -39,9 +40,13 @@ export function handleSourceColumnState<TState extends { columns?: string[] }>(
   } else if (state.columns.length === 0) {
     // if _source fetching is used and there are no column, switch back to default columns
     // this can happen if the fields API was previously used
+    const columns = defaultColumns;
+    if (columns.length === 0) {
+      columns.push('_source');
+    }
     return {
       ...state,
-      columns: [...defaultColumns],
+      columns: [...columns],
     };
   }
 
diff --git a/src/plugins/discover/server/ui_settings.ts b/src/plugins/discover/server/ui_settings.ts
index aa1b44da12bfc9..82221fb8e8593b 100644
--- a/src/plugins/discover/server/ui_settings.ts
+++ b/src/plugins/discover/server/ui_settings.ts
@@ -33,9 +33,10 @@ export const getUiSettings: () => Record<string, UiSettingsParams> = () => ({
     name: i18n.translate('discover.advancedSettings.defaultColumnsTitle', {
       defaultMessage: 'Default columns',
     }),
-    value: ['_source'],
+    value: [],
     description: i18n.translate('discover.advancedSettings.defaultColumnsText', {
-      defaultMessage: 'Columns displayed by default in the Discovery tab',
+      defaultMessage:
+        'Columns displayed by default in the Discover app. If empty, a summary of the document will be displayed.',
     }),
     category: ['discover'],
     schema: schema.arrayOf(schema.string()),
diff --git a/test/functional/apps/discover/_discover_fields_api.ts b/test/functional/apps/discover/_discover_fields_api.ts
index 42e2a94b364620..700c865031cd63 100644
--- a/test/functional/apps/discover/_discover_fields_api.ts
+++ b/test/functional/apps/discover/_discover_fields_api.ts
@@ -15,7 +15,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const retry = getService('retry');
   const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
-  const PageObjects = getPageObjects(['common', 'discover', 'header', 'timePicker']);
+  const PageObjects = getPageObjects(['common', 'discover', 'header', 'timePicker', 'settings']);
   const defaultSettings = {
     defaultIndex: 'logstash-*',
     'discover:searchFieldsFromSource': false,
@@ -67,5 +67,27 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.discover.clickDocViewerTab(1);
       await PageObjects.discover.expectSourceViewerToExist();
     });
+
+    it('switches to _source column when fields API is no longer used', async function () {
+      await PageObjects.settings.navigateTo();
+      await PageObjects.settings.clickKibanaSettings();
+      await PageObjects.settings.toggleAdvancedSettingCheckbox('discover:searchFieldsFromSource');
+
+      await PageObjects.common.navigateToApp('discover');
+      await PageObjects.timePicker.setDefaultAbsoluteRange();
+
+      expect(await PageObjects.discover.getDocHeader()).to.have.string('_source');
+    });
+
+    it('switches to Document column when fields API is used', async function () {
+      await PageObjects.settings.navigateTo();
+      await PageObjects.settings.clickKibanaSettings();
+      await PageObjects.settings.toggleAdvancedSettingCheckbox('discover:searchFieldsFromSource');
+
+      await PageObjects.common.navigateToApp('discover');
+      await PageObjects.timePicker.setDefaultAbsoluteRange();
+
+      expect(await PageObjects.discover.getDocHeader()).to.have.string('Document');
+    });
   });
 }

From cdce98c8a363520e99f59f3f10c59a32586480a7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ester=20Mart=C3=AD=20Vilaseca?=
 <ester.martivilaseca@elastic.co>
Date: Thu, 14 Oct 2021 15:57:27 +0200
Subject: [PATCH 55/71] [Stack monitoring] Fix clusters functional tests when
 react is enabled (#114982)

* Fix test subjects for overview page

* fix pathname matching
---
 .../public/application/pages/cluster/overview_page.tsx         | 2 +-
 x-pack/plugins/monitoring/public/application/route_init.tsx    | 2 +-
 x-pack/plugins/monitoring/public/directives/main/index.html    | 2 +-
 x-pack/test/functional/services/monitoring/cluster_overview.js | 3 +--
 4 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/x-pack/plugins/monitoring/public/application/pages/cluster/overview_page.tsx b/x-pack/plugins/monitoring/public/application/pages/cluster/overview_page.tsx
index b78df27cd12c41..04074762c8d226 100644
--- a/x-pack/plugins/monitoring/public/application/pages/cluster/overview_page.tsx
+++ b/x-pack/plugins/monitoring/public/application/pages/cluster/overview_page.tsx
@@ -50,7 +50,7 @@ export const ClusterOverview: React.FC<{}> = () => {
       {
         id: 'clusterName',
         label: clusters[0].cluster_name,
-        testSubj: 'clusterName',
+        testSubj: 'overviewTabsclusterName',
         route: '/overview',
       },
     ];
diff --git a/x-pack/plugins/monitoring/public/application/route_init.tsx b/x-pack/plugins/monitoring/public/application/route_init.tsx
index c620229eb059a0..52780aa2807076 100644
--- a/x-pack/plugins/monitoring/public/application/route_init.tsx
+++ b/x-pack/plugins/monitoring/public/application/route_init.tsx
@@ -57,7 +57,7 @@ export const RouteInit: React.FC<RouteInitProps> = ({
 
     // check if we need to redirect because of attempt at unsupported multi-cluster monitoring
     const clusterSupported = cluster.isSupported || clusters.length === 1;
-    if (location.pathname !== 'home' && !clusterSupported) {
+    if (location.pathname !== '/home' && !clusterSupported) {
       return <Redirect to="/home" />;
     }
   }
diff --git a/x-pack/plugins/monitoring/public/directives/main/index.html b/x-pack/plugins/monitoring/public/directives/main/index.html
index c989c71d8c1d44..fd14120e1db2fc 100644
--- a/x-pack/plugins/monitoring/public/directives/main/index.html
+++ b/x-pack/plugins/monitoring/public/directives/main/index.html
@@ -299,7 +299,7 @@ <h1 class="euiTitle euiTitle--xsmall">{{pageTitle || monitoringMain.instance}}</
     </div>
 
     <div ng-if="monitoringMain.inOverview" class="euiTabs" role="navigation">
-      <a class="euiTab" data-test-subj="clusterName">{{ pageData.cluster_name }}</a>
+      <a class="euiTab" data-test-subj="overviewTabsclusterName">{{ pageData.cluster_name }}</a>
     </div>
 
     <div ng-if="monitoringMain.inAlerts" class="euiTabs" role="navigation">
diff --git a/x-pack/test/functional/services/monitoring/cluster_overview.js b/x-pack/test/functional/services/monitoring/cluster_overview.js
index 7e888d6233ff7d..215e92fa055beb 100644
--- a/x-pack/test/functional/services/monitoring/cluster_overview.js
+++ b/x-pack/test/functional/services/monitoring/cluster_overview.js
@@ -12,8 +12,7 @@ export function MonitoringClusterOverviewProvider({ getService }) {
   const retry = getService('retry');
 
   const SUBJ_CLUSTER_ALERTS = `clusterAlertsContainer`;
-  const SUBJ_CLUSTER_OVERVIEW = 'clusterOverviewContainer';
-  const SUBJ_CLUSTER_NAME = `${SUBJ_CLUSTER_OVERVIEW} > clusterName`;
+  const SUBJ_CLUSTER_NAME = `overviewTabsclusterName`;
 
   const SUBJ_ES_PANEL = `clusterItemContainerElasticsearch`;
   const SUBJ_ES_STATUS = `${SUBJ_ES_PANEL} > statusIcon`;

From 56a2e788ca90c15c734cb0fe8eb37c321fdd5b45 Mon Sep 17 00:00:00 2001
From: Angela Chuang <6295984+angorayc@users.noreply.github.com>
Date: Thu, 14 Oct 2021 15:17:28 +0100
Subject: [PATCH 56/71] [Security Solution] tgrid cellActions enhancement
 (#113419)

* Alerts cellAction enhancement

* styling

* fix types

* expandable topN

* fix types

* styling for filters

* styling

* rm getDefaultCellActions

* styling

* globalFilters for topN

* rm unused i18n keys

* unit test

* add i18n

* rename component

* fix types

* update i18n keys

* unit tests

* styling for reason row renderer

* rename file

* fix Circular Dependencies

* update wording/icons for show top N

* cell value text overflow

* reason in grid-view

* unit test

* default selected option for topN

* lint error

* configurable paddingSize and showLegend for topN

* update snapshot

* rename reason title

* fix cypress

* fix cypress

* fix unit tests

* fix default cell actions

* fix page crashing

* unit test

* add unit tests

* code review

* fix missing props

* fix expand ip button

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../alert_summary_view.test.tsx.snap          |   4 +-
 .../table/use_action_cell_data_provider.ts    |   2 +-
 .../components/formatted_date/index.tsx       |  32 +--
 .../__snapshots__/index.test.tsx.snap         |   6 +-
 .../components/header_section/index.tsx       |   8 +-
 .../hover_actions/actions/show_top_n.tsx      |  67 ++++--
 .../common/components/links/helpers.tsx       |  71 +++++++
 .../public/common/components/links/index.tsx  | 192 ++++++++++--------
 .../components/matrix_histogram/index.tsx     |   7 +-
 .../components/matrix_histogram/types.ts      |   1 +
 .../public/common/components/page/index.tsx   |  59 +++++-
 .../public/common/components/top_n/index.tsx  |   6 +
 .../public/common/components/top_n/top_n.tsx  |   8 +
 .../default_cell_actions.test.tsx             |  92 +++++++++
 .../lib/cell_actions/default_cell_actions.tsx | 181 +++++++++--------
 .../expanded_cell_value_actions.test.tsx      |  49 +++++
 .../expanded_cell_value_actions.tsx           | 125 ++++++++++++
 .../public/common/lib/cell_actions/helpers.ts |  65 ++++++
 .../common/lib/cell_actions/translations.ts   |  71 +++++++
 .../alerts_histogram.tsx                      |   7 +-
 .../alerts_histogram_panel/index.tsx          |  16 +-
 .../components/alerts_table/index.tsx         |  10 +-
 .../render_cell_value.tsx                     |  20 +-
 .../navigation/events_query_tab_body.tsx      |   2 +-
 .../public/network/components/port/helpers.ts |  19 ++
 .../public/network/components/port/index.tsx  |  31 ++-
 .../source_destination/index.test.tsx         |   2 +-
 .../source_destination_ip.test.tsx            |   2 +-
 .../source_destination_ip.tsx                 |   3 +-
 .../components/events_by_dataset/index.tsx    |   6 +
 .../components/signals_by_category/index.tsx  |  14 +-
 .../components/formatted_ip/index.tsx         |  92 ++++++++-
 .../components/netflow/index.test.tsx         |   2 +-
 .../body/renderers/column_renderer.ts         |  23 ++-
 .../body/renderers/formatted_field.tsx        |  51 ++++-
 .../renderers/formatted_field_helpers.tsx     | 100 +++++++--
 .../timeline/body/renderers/host_name.tsx     |  21 +-
 .../timeline/body/renderers/netflow.tsx       |   2 +-
 .../netflow/netflow_row_renderer.tsx          |   2 +-
 .../body/renderers/plain_column_renderer.tsx  |  12 +-
 .../renderers/reason_column_renderer.test.tsx |  45 ++--
 .../body/renderers/reason_column_renderer.tsx | 115 +++++------
 .../timeline/body/renderers/translations.ts   |   4 +-
 .../default_cell_renderer.test.tsx            |  59 +++++-
 .../cell_rendering/default_cell_renderer.tsx  |  82 +++++---
 .../common/types/timeline/cells/index.ts      |  13 +-
 .../common/types/timeline/columns/index.tsx   |   9 +-
 .../actions/filter_for_value.tsx              |   9 +-
 .../actions/filter_out_value.tsx              |   9 +-
 .../components/hover_actions/actions/types.ts |   2 +
 .../components/t_grid/body/index.test.tsx     | 121 +++++++++++
 .../public/components/t_grid/body/index.tsx   |  42 ++--
 .../t_grid/event_rendered_view/index.tsx      |  18 +-
 .../translations/translations/ja-JP.json      |   3 -
 .../translations/translations/zh-CN.json      |   3 -
 55 files changed, 1540 insertions(+), 477 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/common/components/links/helpers.tsx
 create mode 100644 x-pack/plugins/security_solution/public/common/lib/cell_actions/default_cell_actions.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/common/lib/cell_actions/expanded_cell_value_actions.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/common/lib/cell_actions/expanded_cell_value_actions.tsx
 create mode 100644 x-pack/plugins/security_solution/public/common/lib/cell_actions/helpers.ts
 create mode 100644 x-pack/plugins/security_solution/public/common/lib/cell_actions/translations.ts
 create mode 100644 x-pack/plugins/security_solution/public/network/components/port/helpers.ts

diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap
index 2904d8184261eb..d367c68586be1b 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap
@@ -210,7 +210,7 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
                   class="eventFieldsTable__fieldValue"
                 >
                   <span
-                    class="euiToolTipAnchor"
+                    class="euiToolTipAnchor eui-textTruncate eui-alignMiddle"
                   >
                     Nov 25, 2020 @ 15:42:39.417
                   </span>
@@ -872,7 +872,7 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
                   class="eventFieldsTable__fieldValue"
                 >
                   <span
-                    class="euiToolTipAnchor"
+                    class="euiToolTipAnchor eui-textTruncate eui-alignMiddle"
                   >
                     Nov 25, 2020 @ 15:42:39.417
                   </span>
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/table/use_action_cell_data_provider.ts b/x-pack/plugins/security_solution/public/common/components/event_details/table/use_action_cell_data_provider.ts
index 76ca5dfe53f4e9..23acd90183af4a 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/table/use_action_cell_data_provider.ts
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/table/use_action_cell_data_provider.ts
@@ -25,7 +25,7 @@ import {
 } from '../../../../timelines/components/timeline/body/renderers/constants';
 import { BYTES_FORMAT } from '../../../../timelines/components/timeline/body/renderers/bytes';
 import { EVENT_DURATION_FIELD_NAME } from '../../../../timelines/components/duration';
-import { PORT_NAMES } from '../../../../network/components/port';
+import { PORT_NAMES } from '../../../../network/components/port/helpers';
 import { INDICATOR_REFERENCE } from '../../../../../common/cti/constants';
 import { BrowserField } from '../../../containers/source';
 import { DataProvider, IS_OPERATOR } from '../../../../../common/types';
diff --git a/x-pack/plugins/security_solution/public/common/components/formatted_date/index.tsx b/x-pack/plugins/security_solution/public/common/components/formatted_date/index.tsx
index f6df6e132ebeeb..e525003660a85b 100644
--- a/x-pack/plugins/security_solution/public/common/components/formatted_date/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/formatted_date/index.tsx
@@ -92,23 +92,27 @@ PreferenceFormattedP1DTDate.displayName = 'PreferenceFormattedP1DTDate';
  * - a long representation of the date that includes the day of the week (e.g. Thursday, March 21, 2019 6:47pm)
  * - the raw date value (e.g. 2019-03-22T00:47:46Z)
  */
-export const FormattedDate = React.memo<{
+
+interface FormattedDateProps {
+  className?: string;
   fieldName: string;
   value?: string | number | null;
-  className?: string;
-}>(({ value, fieldName, className = '' }): JSX.Element => {
-  if (value == null) {
-    return getOrEmptyTagFromValue(value);
+}
+export const FormattedDate = React.memo<FormattedDateProps>(
+  ({ value, fieldName, className = '' }): JSX.Element => {
+    if (value == null) {
+      return getOrEmptyTagFromValue(value);
+    }
+    const maybeDate = getMaybeDate(value);
+    return maybeDate.isValid() ? (
+      <LocalizedDateTooltip date={maybeDate.toDate()} fieldName={fieldName} className={className}>
+        <PreferenceFormattedDate value={maybeDate.toDate()} />
+      </LocalizedDateTooltip>
+    ) : (
+      getOrEmptyTagFromValue(value)
+    );
   }
-  const maybeDate = getMaybeDate(value);
-  return maybeDate.isValid() ? (
-    <LocalizedDateTooltip date={maybeDate.toDate()} fieldName={fieldName} className={className}>
-      <PreferenceFormattedDate value={maybeDate.toDate()} />
-    </LocalizedDateTooltip>
-  ) : (
-    getOrEmptyTagFromValue(value)
-  );
-});
+);
 
 FormattedDate.displayName = 'FormattedDate';
 
diff --git a/x-pack/plugins/security_solution/public/common/components/header_section/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/header_section/__snapshots__/index.test.tsx.snap
index d3d20c71835707..fe589b1e253a9f 100644
--- a/x-pack/plugins/security_solution/public/common/components/header_section/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/header_section/__snapshots__/index.test.tsx.snap
@@ -6,23 +6,25 @@ exports[`HeaderSection it renders 1`] = `
 >
   <EuiFlexGroup
     alignItems="center"
+    gutterSize="none"
   >
     <EuiFlexItem
       grow={true}
     >
       <EuiFlexGroup
         alignItems="center"
+        gutterSize="none"
         responsive={false}
       >
         <EuiFlexItem>
           <EuiTitle
             size="m"
           >
-            <h2
+            <h4
               data-test-subj="header-section-title"
             >
               Test title
-            </h2>
+            </h4>
           </EuiTitle>
           <Subtitle
             data-test-subj="header-section-subtitle"
diff --git a/x-pack/plugins/security_solution/public/common/components/header_section/index.tsx b/x-pack/plugins/security_solution/public/common/components/header_section/index.tsx
index f733331bcd691e..21a3c4dc614cc4 100644
--- a/x-pack/plugins/security_solution/public/common/components/header_section/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/header_section/index.tsx
@@ -68,12 +68,12 @@ const HeaderSectionComponent: React.FC<HeaderSectionProps> = ({
   hideSubtitle = false,
 }) => (
   <Header data-test-subj="header-section" border={border} height={height}>
-    <EuiFlexGroup alignItems="center">
+    <EuiFlexGroup alignItems="center" gutterSize="none">
       <EuiFlexItem grow={growLeftSplit}>
-        <EuiFlexGroup alignItems="center" responsive={false}>
+        <EuiFlexGroup alignItems="center" responsive={false} gutterSize="none">
           <EuiFlexItem>
             <EuiTitle size={titleSize}>
-              <h2 data-test-subj="header-section-title">
+              <h4 data-test-subj="header-section-title">
                 {title}
                 {tooltip && (
                   <>
@@ -81,7 +81,7 @@ const HeaderSectionComponent: React.FC<HeaderSectionProps> = ({
                     <EuiIconTip color="subdued" content={tooltip} size="l" type="iInCircle" />
                   </>
                 )}
-              </h2>
+              </h4>
             </EuiTitle>
 
             {!hideSubtitle && (
diff --git a/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.tsx b/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.tsx
index e1546c5220e223..738103f02dcdf6 100644
--- a/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.tsx
@@ -30,33 +30,49 @@ const SHOW_TOP = (fieldName: string) =>
   });
 
 interface Props {
+  className?: string;
   /** When `Component` is used with `EuiDataGrid`; the grid keeps a reference to `Component` for show / hide functionality.
    * When `Component` is used with `EuiContextMenu`, we pass EuiContextMenuItem to render the right style.
    */
   Component?: typeof EuiButtonEmpty | typeof EuiButtonIcon | typeof EuiContextMenuItem;
   enablePopOver?: boolean;
   field: string;
+  flush?: 'left' | 'right' | 'both';
   globalFilters?: Filter[];
+  iconSide?: 'left' | 'right';
+  iconType?: string;
+  isExpandable?: boolean;
   onClick: () => void;
   onFilterAdded?: () => void;
   ownFocus: boolean;
+  paddingSize?: 's' | 'm' | 'l' | 'none';
   showTooltip?: boolean;
   showTopN: boolean;
+  showLegend?: boolean;
   timelineId?: string | null;
+  title?: string;
   value?: string[] | string | null;
 }
 
 export const ShowTopNButton: React.FC<Props> = React.memo(
   ({
+    className,
     Component,
     enablePopOver,
     field,
+    flush,
+    iconSide,
+    iconType,
+    isExpandable,
     onClick,
     onFilterAdded,
     ownFocus,
+    paddingSize,
+    showLegend,
     showTooltip = true,
     showTopN,
     timelineId,
+    title,
     value,
     globalFilters,
   }) => {
@@ -70,31 +86,36 @@ export const ShowTopNButton: React.FC<Props> = React.memo(
         ? SourcererScopeName.detections
         : SourcererScopeName.default;
     const { browserFields, indexPattern } = useSourcererScope(activeScope);
-
+    const icon = iconType ?? 'visBarVertical';
+    const side = iconSide ?? 'left';
+    const buttonTitle = title ?? SHOW_TOP(field);
     const basicButton = useMemo(
       () =>
         Component ? (
           <Component
-            aria-label={SHOW_TOP(field)}
+            aria-label={buttonTitle}
+            className={className}
             data-test-subj="show-top-field"
-            icon="visBarVertical"
-            iconType="visBarVertical"
+            icon={icon}
+            iconType={icon}
+            iconSide={side}
+            flush={flush}
             onClick={onClick}
-            title={SHOW_TOP(field)}
+            title={buttonTitle}
           >
-            {SHOW_TOP(field)}
+            {buttonTitle}
           </Component>
         ) : (
           <EuiButtonIcon
-            aria-label={SHOW_TOP(field)}
+            aria-label={buttonTitle}
             className="securitySolution__hoverActionButton"
             data-test-subj="show-top-field"
             iconSize="s"
-            iconType="visBarVertical"
+            iconType={icon}
             onClick={onClick}
           />
         ),
-      [Component, field, onClick]
+      [Component, buttonTitle, className, flush, icon, onClick, side]
     );
 
     const button = useMemo(
@@ -107,7 +128,7 @@ export const ShowTopNButton: React.FC<Props> = React.memo(
                   field,
                   value,
                 })}
-                content={SHOW_TOP(field)}
+                content={buttonTitle}
                 shortcut={SHOW_TOP_N_KEYBOARD_SHORTCUT}
                 showShortcut={ownFocus}
               />
@@ -118,7 +139,7 @@ export const ShowTopNButton: React.FC<Props> = React.memo(
         ) : (
           basicButton
         ),
-      [basicButton, field, ownFocus, showTooltip, showTopN, value]
+      [basicButton, buttonTitle, field, ownFocus, showTooltip, showTopN, value]
     );
 
     const topNPannel = useMemo(
@@ -128,15 +149,37 @@ export const ShowTopNButton: React.FC<Props> = React.memo(
           field={field}
           indexPattern={indexPattern}
           onFilterAdded={onFilterAdded}
+          paddingSize={paddingSize}
+          showLegend={showLegend}
           timelineId={timelineId ?? undefined}
           toggleTopN={onClick}
           value={value}
           globalFilters={globalFilters}
         />
       ),
-      [browserFields, field, indexPattern, onClick, onFilterAdded, timelineId, value, globalFilters]
+      [
+        browserFields,
+        field,
+        indexPattern,
+        onFilterAdded,
+        paddingSize,
+        showLegend,
+        timelineId,
+        onClick,
+        value,
+        globalFilters,
+      ]
     );
 
+    if (isExpandable) {
+      return (
+        <>
+          {basicButton}
+          {showTopN && topNPannel}
+        </>
+      );
+    }
+
     return showTopN ? (
       enablePopOver ? (
         <EuiPopover
diff --git a/x-pack/plugins/security_solution/public/common/components/links/helpers.tsx b/x-pack/plugins/security_solution/public/common/components/links/helpers.tsx
new file mode 100644
index 00000000000000..0504a17904a752
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/links/helpers.tsx
@@ -0,0 +1,71 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React, { SyntheticEvent } from 'react';
+import {
+  EuiButton,
+  EuiButtonEmpty,
+  EuiButtonIcon,
+  EuiButtonProps,
+  EuiLink,
+  EuiLinkProps,
+  PropsForAnchor,
+  PropsForButton,
+} from '@elastic/eui';
+import styled from 'styled-components';
+
+export const LinkButton: React.FC<PropsForButton<EuiButtonProps> | PropsForAnchor<EuiButtonProps>> =
+  ({ children, ...props }) => <EuiButton {...props}>{children}</EuiButton>;
+
+export const LinkAnchor: React.FC<EuiLinkProps> = ({ children, ...props }) => (
+  <EuiLink {...props}>{children}</EuiLink>
+);
+
+export const Comma = styled('span')`
+  margin-right: 5px;
+  margin-left: 5px;
+  &::after {
+    content: ' ,';
+  }
+`;
+
+Comma.displayName = 'Comma';
+
+const GenericLinkButtonComponent: React.FC<{
+  children?: React.ReactNode;
+  /** `Component` is only used with `EuiDataGrid`; the grid keeps a reference to `Component` for show / hide functionality */
+  Component?: typeof EuiButtonEmpty | typeof EuiButtonIcon;
+  dataTestSubj?: string;
+  href: string;
+  onClick?: (e: SyntheticEvent) => void;
+  title?: string;
+  iconType?: string;
+}> = ({ children, Component, dataTestSubj, href, onClick, title, iconType = 'expand' }) => {
+  return Component ? (
+    <Component
+      data-test-subj={dataTestSubj}
+      href={href}
+      iconType={iconType}
+      onClick={onClick}
+      title={title}
+    >
+      {title ?? children}
+    </Component>
+  ) : (
+    <LinkButton data-test-subj={dataTestSubj} href={href} onClick={onClick}>
+      {title ?? children}
+    </LinkButton>
+  );
+};
+
+export const GenericLinkButton = React.memo(GenericLinkButtonComponent);
+
+export const PortContainer = styled.div`
+  & svg {
+    position: relative;
+    top: -1px;
+  }
+`;
diff --git a/x-pack/plugins/security_solution/public/common/components/links/index.tsx b/x-pack/plugins/security_solution/public/common/components/links/index.tsx
index 7db6b0204b6498..c74791b8b3aa7a 100644
--- a/x-pack/plugins/security_solution/public/common/components/links/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/links/index.tsx
@@ -6,19 +6,15 @@
  */
 
 import {
-  EuiButton,
-  EuiButtonProps,
-  EuiLink,
-  EuiLinkProps,
-  EuiToolTip,
+  EuiButtonEmpty,
+  EuiButtonIcon,
   EuiFlexGroup,
   EuiFlexItem,
-  PropsForAnchor,
-  PropsForButton,
+  EuiLink,
+  EuiToolTip,
 } from '@elastic/eui';
 import React, { useMemo, useCallback, SyntheticEvent } from 'react';
 import { isNil } from 'lodash/fp';
-import styled from 'styled-components';
 
 import { IP_REPUTATION_LINKS_SETTING, APP_ID } from '../../../../common/constants';
 import {
@@ -43,22 +39,11 @@ import { isUrlInvalid } from '../../utils/validators';
 import * as i18n from './translations';
 import { SecurityPageName } from '../../../app/types';
 import { getUebaDetailsUrl } from '../link_to/redirect_to_ueba';
+import { LinkButton, LinkAnchor, GenericLinkButton, PortContainer, Comma } from './helpers';
 
-export const DEFAULT_NUMBER_OF_LINK = 5;
-
-export const LinkButton: React.FC<PropsForButton<EuiButtonProps> | PropsForAnchor<EuiButtonProps>> =
-  ({ children, ...props }) => <EuiButton {...props}>{children}</EuiButton>;
+export { LinkButton, LinkAnchor } from './helpers';
 
-export const LinkAnchor: React.FC<EuiLinkProps> = ({ children, ...props }) => (
-  <EuiLink {...props}>{children}</EuiLink>
-);
-
-export const PortContainer = styled.div`
-  & svg {
-    position: relative;
-    top: -1px;
-  }
-`;
+export const DEFAULT_NUMBER_OF_LINK = 5;
 
 // Internal Links
 const UebaDetailsLinkComponent: React.FC<{
@@ -102,10 +87,13 @@ export const UebaDetailsLink = React.memo(UebaDetailsLinkComponent);
 
 const HostDetailsLinkComponent: React.FC<{
   children?: React.ReactNode;
+  /** `Component` is only used with `EuiDataGrid`; the grid keeps a reference to `Component` for show / hide functionality */
+  Component?: typeof EuiButtonEmpty | typeof EuiButtonIcon;
   hostName: string;
   isButton?: boolean;
   onClick?: (e: SyntheticEvent) => void;
-}> = ({ children, hostName, isButton, onClick }) => {
+  title?: string;
+}> = ({ children, Component, hostName, isButton, onClick, title }) => {
   const { formatUrl, search } = useFormatUrl(SecurityPageName.hosts);
   const { navigateToApp } = useKibana().services.application;
   const goToHostDetails = useCallback(
@@ -118,19 +106,25 @@ const HostDetailsLinkComponent: React.FC<{
     },
     [hostName, navigateToApp, search]
   );
-
+  const href = useMemo(
+    () => formatUrl(getHostDetailsUrl(encodeURIComponent(hostName))),
+    [formatUrl, hostName]
+  );
   return isButton ? (
-    <LinkButton
+    <GenericLinkButton
+      Component={Component}
+      dataTestSubj="data-grid-host-details"
+      href={href}
+      iconType="expand"
       onClick={onClick ?? goToHostDetails}
-      href={formatUrl(getHostDetailsUrl(encodeURIComponent(hostName)))}
-      data-test-subj="host-details-button"
+      title={title ?? hostName}
     >
-      {children ? children : hostName}
-    </LinkButton>
+      {children}
+    </GenericLinkButton>
   ) : (
     <LinkAnchor
       onClick={onClick ?? goToHostDetails}
-      href={formatUrl(getHostDetailsUrl(encodeURIComponent(hostName)))}
+      href={href}
       data-test-subj="host-details-button"
     >
       {children ? children : hostName}
@@ -176,11 +170,14 @@ ExternalLink.displayName = 'ExternalLink';
 
 const NetworkDetailsLinkComponent: React.FC<{
   children?: React.ReactNode;
+  /** `Component` is only used with `EuiDataGrid`; the grid keeps a reference to `Component` for show / hide functionality */
+  Component?: typeof EuiButtonEmpty | typeof EuiButtonIcon;
   ip: string;
   flowTarget?: FlowTarget | FlowTargetSourceDest;
   isButton?: boolean;
   onClick?: (e: SyntheticEvent) => void | undefined;
-}> = ({ children, ip, flowTarget = FlowTarget.source, isButton, onClick }) => {
+  title?: string;
+}> = ({ Component, children, ip, flowTarget = FlowTarget.source, isButton, onClick, title }) => {
   const { formatUrl, search } = useFormatUrl(SecurityPageName.network);
   const { navigateToApp } = useKibana().services.application;
   const goToNetworkDetails = useCallback(
@@ -193,19 +190,25 @@ const NetworkDetailsLinkComponent: React.FC<{
     },
     [flowTarget, ip, navigateToApp, search]
   );
+  const href = useMemo(
+    () => formatUrl(getNetworkDetailsUrl(encodeURIComponent(encodeIpv6(ip)))),
+    [formatUrl, ip]
+  );
 
   return isButton ? (
-    <LinkButton
-      href={formatUrl(getNetworkDetailsUrl(encodeURIComponent(encodeIpv6(ip))))}
+    <GenericLinkButton
+      Component={Component}
+      dataTestSubj="data-grid-network-details"
       onClick={onClick ?? goToNetworkDetails}
-      data-test-subj="network-details"
+      href={href}
+      title={title ?? ip}
     >
-      {children ? children : ip}
-    </LinkButton>
+      {children}
+    </GenericLinkButton>
   ) : (
     <LinkAnchor
       onClick={onClick ?? goToNetworkDetails}
-      href={formatUrl(getNetworkDetailsUrl(encodeURIComponent(encodeIpv6(ip))))}
+      href={href}
       data-test-subj="network-details"
     >
       {children ? children : ip}
@@ -272,63 +275,84 @@ CreateCaseLink.displayName = 'CreateCaseLink';
 
 // External Links
 export const GoogleLink = React.memo<{ children?: React.ReactNode; link: string }>(
-  ({ children, link }) => (
-    <ExternalLink url={`https://www.google.com/search?q=${encodeURIComponent(link)}`}>
-      {children ? children : link}
-    </ExternalLink>
-  )
+  ({ children, link }) => {
+    const url = useMemo(
+      () => `https://www.google.com/search?q=${encodeURIComponent(link)}`,
+      [link]
+    );
+    return <ExternalLink url={url}>{children ? children : link}</ExternalLink>;
+  }
 );
 
 GoogleLink.displayName = 'GoogleLink';
 
 export const PortOrServiceNameLink = React.memo<{
   children?: React.ReactNode;
+  /** `Component` is only used with `EuiDataGrid`; the grid keeps a reference to `Component` for show / hide functionality */
+  Component?: typeof EuiButtonEmpty | typeof EuiButtonIcon;
   portOrServiceName: number | string;
-}>(({ children, portOrServiceName }) => (
-  <PortContainer>
-    <EuiLink
-      data-test-subj="port-or-service-name-link"
-      href={`https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=${encodeURIComponent(
+  onClick?: (e: SyntheticEvent) => void | undefined;
+  title?: string;
+}>(({ Component, title, children, portOrServiceName }) => {
+  const href = useMemo(
+    () =>
+      `https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=${encodeURIComponent(
         String(portOrServiceName)
-      )}`}
-      target="_blank"
+      )}`,
+    [portOrServiceName]
+  );
+  return Component ? (
+    <Component
+      href={href}
+      data-test-subj="data-grid-port-or-service-name-link"
+      title={title}
+      iconType="link"
     >
-      {children ? children : portOrServiceName}
-    </EuiLink>
-  </PortContainer>
-));
+      {title ?? children ?? portOrServiceName}
+    </Component>
+  ) : (
+    <PortContainer>
+      <EuiLink data-test-subj="port-or-service-name-link" href={href} target="_blank">
+        {children ? children : portOrServiceName}
+      </EuiLink>
+    </PortContainer>
+  );
+});
 
 PortOrServiceNameLink.displayName = 'PortOrServiceNameLink';
 
 export const Ja3FingerprintLink = React.memo<{
   children?: React.ReactNode;
   ja3Fingerprint: string;
-}>(({ children, ja3Fingerprint }) => (
-  <EuiLink
-    data-test-subj="ja3-fingerprint-link"
-    href={`https://sslbl.abuse.ch/ja3-fingerprints/${encodeURIComponent(ja3Fingerprint)}`}
-    target="_blank"
-  >
-    {children ? children : ja3Fingerprint}
-  </EuiLink>
-));
+}>(({ children, ja3Fingerprint }) => {
+  const href = useMemo(
+    () => `https://sslbl.abuse.ch/ja3-fingerprints/${encodeURIComponent(ja3Fingerprint)}`,
+    [ja3Fingerprint]
+  );
+  return (
+    <EuiLink data-test-subj="ja3-fingerprint-link" href={href} target="_blank">
+      {children ? children : ja3Fingerprint}
+    </EuiLink>
+  );
+});
 
 Ja3FingerprintLink.displayName = 'Ja3FingerprintLink';
 
 export const CertificateFingerprintLink = React.memo<{
   children?: React.ReactNode;
   certificateFingerprint: string;
-}>(({ children, certificateFingerprint }) => (
-  <EuiLink
-    data-test-subj="certificate-fingerprint-link"
-    href={`https://sslbl.abuse.ch/ssl-certificates/sha1/${encodeURIComponent(
-      certificateFingerprint
-    )}`}
-    target="_blank"
-  >
-    {children ? children : certificateFingerprint}
-  </EuiLink>
-));
+}>(({ children, certificateFingerprint }) => {
+  const href = useMemo(
+    () =>
+      `https://sslbl.abuse.ch/ssl-certificates/sha1/${encodeURIComponent(certificateFingerprint)}`,
+    [certificateFingerprint]
+  );
+  return (
+    <EuiLink data-test-subj="certificate-fingerprint-link" href={href} target="_blank">
+      {children ? children : certificateFingerprint}
+    </EuiLink>
+  );
+});
 
 CertificateFingerprintLink.displayName = 'CertificateFingerprintLink';
 
@@ -354,16 +378,6 @@ const isReputationLink = (
   (rowItem as ReputationLinkSetting).url_template !== undefined &&
   (rowItem as ReputationLinkSetting).name !== undefined;
 
-export const Comma = styled('span')`
-  margin-right: 5px;
-  margin-left: 5px;
-  &::after {
-    content: ' ,';
-  }
-`;
-
-Comma.displayName = 'Comma';
-
 const defaultNameMapping: Record<DefaultReputationLink, string> = {
   [DefaultReputationLink['virustotal.com']]: i18n.VIEW_VIRUS_TOTAL,
   [DefaultReputationLink['talosIntelligence.com']]: i18n.VIEW_TALOS_INTELLIGENCE,
@@ -463,11 +477,13 @@ ReputationLinkComponent.displayName = 'ReputationLinkComponent';
 export const ReputationLink = React.memo(ReputationLinkComponent);
 
 export const WhoIsLink = React.memo<{ children?: React.ReactNode; domain: string }>(
-  ({ children, domain }) => (
-    <ExternalLink url={`https://www.iana.org/whois?q=${encodeURIComponent(domain)}`}>
-      {children ? children : domain}
-    </ExternalLink>
-  )
+  ({ children, domain }) => {
+    const url = useMemo(
+      () => `https://www.iana.org/whois?q=${encodeURIComponent(domain)}`,
+      [domain]
+    );
+    return <ExternalLink url={url}>{children ? children : domain}</ExternalLink>;
+  }
 );
 
 WhoIsLink.displayName = 'WhoIsLink';
diff --git a/x-pack/plugins/security_solution/public/common/components/matrix_histogram/index.tsx b/x-pack/plugins/security_solution/public/common/components/matrix_histogram/index.tsx
index f25e8311ff8fee..7eac477741a5c4 100644
--- a/x-pack/plugins/security_solution/public/common/components/matrix_histogram/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/matrix_histogram/index.tsx
@@ -79,6 +79,7 @@ export const MatrixHistogramComponent: React.FC<MatrixHistogramComponentProps> =
   legendPosition,
   mapping,
   onError,
+  paddingSize = 'm',
   panelHeight = DEFAULT_PANEL_HEIGHT,
   setAbsoluteRangeDatePickerTarget = 'global',
   setQuery,
@@ -200,7 +201,11 @@ export const MatrixHistogramComponent: React.FC<MatrixHistogramComponentProps> =
   return (
     <>
       <InspectButtonContainer show={!isInitialLoading}>
-        <HistogramPanel data-test-subj={`${id}Panel`} height={panelHeight}>
+        <HistogramPanel
+          data-test-subj={`${id}Panel`}
+          height={panelHeight}
+          paddingSize={paddingSize}
+        >
           {loading && !isInitialLoading && (
             <EuiProgress
               data-test-subj="initialLoadingPanelMatrixOverTime"
diff --git a/x-pack/plugins/security_solution/public/common/components/matrix_histogram/types.ts b/x-pack/plugins/security_solution/public/common/components/matrix_histogram/types.ts
index 7cb4144e1acba4..b67505a66be440 100644
--- a/x-pack/plugins/security_solution/public/common/components/matrix_histogram/types.ts
+++ b/x-pack/plugins/security_solution/public/common/components/matrix_histogram/types.ts
@@ -52,6 +52,7 @@ interface MatrixHistogramBasicProps {
   legendPosition?: Position;
   mapping?: MatrixHistogramMappingTypes;
   panelHeight?: number;
+  paddingSize?: 's' | 'm' | 'l' | 'none';
   setQuery: GlobalTimeArgs['setQuery'];
   startDate: GlobalTimeArgs['from'];
   stackByOptions: MatrixHistogramOption[];
diff --git a/x-pack/plugins/security_solution/public/common/components/page/index.tsx b/x-pack/plugins/security_solution/public/common/components/page/index.tsx
index fca49bd4539ecd..9666a0837b0461 100644
--- a/x-pack/plugins/security_solution/public/common/components/page/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/page/index.tsx
@@ -31,13 +31,58 @@ export const AppGlobalStyle = createGlobalStyle<{ theme: { eui: { euiColorPrimar
     z-index: 9950 !important;
   }
 
+  .euiDataGridRowCell__expandButton .euiDataGridRowCell__actionButtonIcon {
+    display: none;
+
+    &:first-child,
+    &:nth-child(2),
+    &:nth-child(3) {
+      display: inline-flex;
+    }
+
+  }
+
   /*
     overrides the default styling of EuiDataGrid expand popover footer to
     make it a column of actions instead of the default actions row
   */
-  .euiDataGridRowCell__popover .euiPopoverFooter .euiFlexGroup {
-    flex-direction: column;
-    align-items: flex-start;
+
+  .euiDataGridRowCell__popover {
+
+    max-width: 815px !important;
+    max-height: none !important;
+    overflow: hidden;
+
+
+    .expandable-top-value-button {
+      &.euiButtonEmpty--primary:enabled:focus,
+      .euiButtonEmpty--primary:focus {
+        background-color: transparent;
+      }
+    }
+
+
+    &.euiPopover__panel.euiPopover__panel-isOpen {
+      padding: 8px 0;
+      min-width: 65px;
+    }
+
+
+    .euiPopoverFooter {
+      border: 0;
+      .euiFlexGroup {
+        flex-direction: column;
+
+        .euiButtonEmpty .euiButtonContent {
+          justify-content: left;
+        }
+
+        .euiFlexItem:first-child,
+        .euiFlexItem:nth-child(2) {
+            display: none;
+        }
+      }
+    }
   }
 
   /*
@@ -54,10 +99,14 @@ export const AppGlobalStyle = createGlobalStyle<{ theme: { eui: { euiColorPrimar
   }
 
   /* hide open draggable popovers when a modal is being displayed to prevent them from covering the modal */
-  body.euiBody-hasOverlayMask .withHoverActions__popover.euiPopover__panel-isOpen{
-    visibility: hidden !important;
+  body.euiBody-hasOverlayMask {
+    .euiDataGridRowCell__popover.euiPopover__panel-isOpen,
+    .withHoverActions__popover.euiPopover__panel-isOpen {
+      visibility: hidden !important;
+    }
   }
 
+
   /* ensure elastic charts tooltips appear above open euiPopovers */
   .echTooltip {
     z-index: 9950;
diff --git a/x-pack/plugins/security_solution/public/common/components/top_n/index.tsx b/x-pack/plugins/security_solution/public/common/components/top_n/index.tsx
index 1556f2d0f3d135..1eef44d587ed0f 100644
--- a/x-pack/plugins/security_solution/public/common/components/top_n/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/top_n/index.tsx
@@ -81,6 +81,8 @@ export interface OwnProps {
   timelineId?: string;
   toggleTopN: () => void;
   onFilterAdded?: () => void;
+  paddingSize?: 's' | 'm' | 'l' | 'none';
+  showLegend?: boolean;
   value?: string[] | string | null;
   globalFilters?: Filter[];
 }
@@ -101,6 +103,8 @@ const StatefulTopNComponent: React.FC<Props> = ({
   globalQuery = EMPTY_QUERY,
   kqlMode,
   onFilterAdded,
+  paddingSize,
+  showLegend,
   timelineId,
   toggleTopN,
   value,
@@ -160,7 +164,9 @@ const StatefulTopNComponent: React.FC<Props> = ({
       from={timelineId === TimelineId.active ? activeTimelineFrom : from}
       indexPattern={indexPattern}
       options={options}
+      paddingSize={paddingSize}
       query={timelineId === TimelineId.active ? EMPTY_QUERY : globalQuery}
+      showLegend={showLegend}
       setAbsoluteRangeDatePickerTarget={timelineId === TimelineId.active ? 'timeline' : 'global'}
       setQuery={setQuery}
       timelineId={timelineId}
diff --git a/x-pack/plugins/security_solution/public/common/components/top_n/top_n.tsx b/x-pack/plugins/security_solution/public/common/components/top_n/top_n.tsx
index 7335d6203697f7..f40ee8670171cb 100644
--- a/x-pack/plugins/security_solution/public/common/components/top_n/top_n.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/top_n/top_n.tsx
@@ -55,8 +55,10 @@ export interface Props extends Pick<GlobalTimeArgs, 'from' | 'to' | 'deleteQuery
   filters: Filter[];
   indexPattern: IIndexPattern;
   options: TopNOption[];
+  paddingSize?: 's' | 'm' | 'l' | 'none';
   query: Query;
   setAbsoluteRangeDatePickerTarget: InputsModelId;
+  showLegend?: boolean;
   timelineId?: string;
   toggleTopN: () => void;
   onFilterAdded?: () => void;
@@ -72,7 +74,9 @@ const TopNComponent: React.FC<Props> = ({
   from,
   indexPattern,
   options,
+  paddingSize,
   query,
+  showLegend,
   setAbsoluteRangeDatePickerTarget,
   setQuery,
   timelineId,
@@ -127,7 +131,9 @@ const TopNComponent: React.FC<Props> = ({
             indexPattern={indexPattern}
             indexNames={view === 'raw' ? rawIndices : allIndices}
             onlyField={field}
+            paddingSize={paddingSize}
             query={query}
+            showLegend={showLegend}
             setAbsoluteRangeDatePickerTarget={setAbsoluteRangeDatePickerTarget}
             setQuery={setQuery}
             showSpacer={false}
@@ -141,7 +147,9 @@ const TopNComponent: React.FC<Props> = ({
             filters={filters}
             headerChildren={headerChildren}
             onlyField={field}
+            paddingSize={paddingSize}
             query={query}
+            showLegend={showLegend}
             setAbsoluteRangeDatePickerTarget={setAbsoluteRangeDatePickerTarget}
             timelineId={timelineId}
           />
diff --git a/x-pack/plugins/security_solution/public/common/lib/cell_actions/default_cell_actions.test.tsx b/x-pack/plugins/security_solution/public/common/lib/cell_actions/default_cell_actions.test.tsx
new file mode 100644
index 00000000000000..a4e6f0a66dfc92
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/lib/cell_actions/default_cell_actions.test.tsx
@@ -0,0 +1,92 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { EuiDataGridColumn } from '@elastic/eui';
+import type {
+  BrowserFields,
+  TimelineNonEcsData,
+} from '../../../../../timelines/common/search_strategy';
+import { TGridCellAction } from '../../../../../timelines/common/types';
+import { Ecs } from '../../../../common/ecs';
+import { ColumnHeaderType } from '../../../timelines/store/timeline/model';
+
+import { defaultCellActions, EmptyComponent } from './default_cell_actions';
+import { COLUMNS_WITH_LINKS } from './helpers';
+
+describe('default cell actions', () => {
+  const browserFields: BrowserFields = {};
+  const data: TimelineNonEcsData[][] = [[]];
+  const ecsData: Ecs[] = [];
+  const timelineId = 'mockTimelineId';
+  const pageSize = 10;
+
+  test('columns without any link action (e.g.: signal.status) should return an empty component (not null or data grid would crash)', () => {
+    const columnHeaders = [
+      {
+        category: 'signal',
+        columnHeaderType: 'no-filtered' as ColumnHeaderType,
+        id: 'signal.status',
+        type: 'string',
+        aggregatable: true,
+        initialWidth: 105,
+      },
+    ];
+
+    const columnsWithCellActions: EuiDataGridColumn[] = columnHeaders.map((header) => {
+      const buildAction = (tGridCellAction: TGridCellAction) =>
+        tGridCellAction({
+          browserFields,
+          data,
+          ecsData,
+          header: columnHeaders.find((h) => h.id === header.id),
+          pageSize,
+          timelineId,
+        });
+
+      return {
+        ...header,
+        cellActions: defaultCellActions?.map(buildAction),
+      };
+    });
+
+    expect(columnsWithCellActions[0]?.cellActions?.length).toEqual(5);
+    expect(columnsWithCellActions[0]?.cellActions![4]).toEqual(EmptyComponent);
+  });
+
+  const columnHeadersToTest = COLUMNS_WITH_LINKS.map((c) => [
+    {
+      category: 'signal',
+      columnHeaderType: 'no-filtered' as ColumnHeaderType,
+      id: c.columnId,
+      type: c.fieldType,
+      aggregatable: true,
+      initialWidth: 105,
+    },
+  ]);
+  describe.each(columnHeadersToTest)('columns with a link action', (columnHeaders) => {
+    test(`${columnHeaders.id ?? columnHeaders.type}`, () => {
+      const columnsWithCellActions: EuiDataGridColumn[] = [columnHeaders].map((header) => {
+        const buildAction = (tGridCellAction: TGridCellAction) =>
+          tGridCellAction({
+            browserFields,
+            data,
+            ecsData,
+            header: [columnHeaders].find((h) => h.id === header.id),
+            pageSize,
+            timelineId,
+          });
+
+        return {
+          ...header,
+          cellActions: defaultCellActions?.map(buildAction),
+        };
+      });
+
+      expect(columnsWithCellActions[0]?.cellActions?.length).toEqual(5);
+      expect(columnsWithCellActions[0]?.cellActions![4]).not.toEqual(EmptyComponent);
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/common/lib/cell_actions/default_cell_actions.tsx b/x-pack/plugins/security_solution/public/common/lib/cell_actions/default_cell_actions.tsx
index 149a0c62b8b6ac..012b84e06ed825 100644
--- a/x-pack/plugins/security_solution/public/common/lib/cell_actions/default_cell_actions.tsx
+++ b/x-pack/plugins/security_solution/public/common/lib/cell_actions/default_cell_actions.tsx
@@ -5,21 +5,28 @@
  * 2.0.
  */
 
-import React, { useCallback, useState, useMemo } from 'react';
-import { Filter } from '../../../../../../../src/plugins/data/public';
+import { EuiDataGridColumnCellActionProps } from '@elastic/eui';
+import { head, getOr, get, isEmpty } from 'lodash/fp';
+import React, { useMemo } from 'react';
 
 import type {
   BrowserFields,
   TimelineNonEcsData,
 } from '../../../../../timelines/common/search_strategy';
-import { DataProvider, TGridCellAction } from '../../../../../timelines/common/types';
+import {
+  ColumnHeaderOptions,
+  DataProvider,
+  TGridCellAction,
+} from '../../../../../timelines/common/types';
 import { getPageRowIndex } from '../../../../../timelines/public';
+import { Ecs } from '../../../../common/ecs';
 import { getMappedNonEcsValue } from '../../../timelines/components/timeline/body/data_driven_columns';
+import { FormattedFieldValue } from '../../../timelines/components/timeline/body/renderers/formatted_field';
+import { parseValue } from '../../../timelines/components/timeline/body/renderers/parse_value';
 import { IS_OPERATOR } from '../../../timelines/components/timeline/data_providers/data_provider';
-import { allowTopN, escapeDataProviderId } from '../../components/drag_and_drop/helpers';
-import { ShowTopNButton } from '../../components/hover_actions/actions/show_top_n';
-import { getAllFieldsByName } from '../../containers/source';
+import { escapeDataProviderId } from '../../components/drag_and_drop/helpers';
 import { useKibana } from '../kibana';
+import { getLink } from './helpers';
 
 /** a noop required by the filter in / out buttons */
 const onFilterAdded = () => {};
@@ -36,15 +43,77 @@ const useKibanaServices = () => {
   return { timelines, filterManager };
 };
 
-/** the default actions shown in `EuiDataGrid` cells */
-export const defaultCellActions: TGridCellAction[] = [
+export const EmptyComponent = () => <></>;
+
+const cellActionLink = [
+  ({
+    browserFields,
+    data,
+    ecsData,
+    header,
+    timelineId,
+    pageSize,
+  }: {
+    browserFields: BrowserFields;
+    data: TimelineNonEcsData[][];
+    ecsData: Ecs[];
+    header?: ColumnHeaderOptions;
+    timelineId: string;
+    pageSize: number;
+  }) =>
+    getLink(header?.id, header?.type, header?.linkField)
+      ? ({ rowIndex, columnId, Component, closePopover }: EuiDataGridColumnCellActionProps) => {
+          const pageRowIndex = getPageRowIndex(rowIndex, pageSize);
+          const ecs = pageRowIndex < ecsData.length ? ecsData[pageRowIndex] : null;
+          const linkValues = header && getOr([], header.linkField ?? '', ecs);
+          const eventId = header && get('_id' ?? '', ecs);
+
+          if (pageRowIndex >= data.length) {
+            // data grid expects each cell action always return an element, it crashes if returns null
+            return <></>;
+          }
+
+          const values = getMappedNonEcsValue({
+            data: data[pageRowIndex],
+            fieldName: columnId,
+          });
+
+          const link = getLink(columnId, header?.type, header?.linkField);
+          const value = parseValue(head(values));
+
+          return link && eventId && values && !isEmpty(value) ? (
+            <FormattedFieldValue
+              Component={Component}
+              contextId={`expanded-value-${columnId}-row-${pageRowIndex}-${timelineId}`}
+              eventId={eventId}
+              fieldFormat={header?.format || ''}
+              fieldName={columnId}
+              fieldType={header?.type || ''}
+              isButton={true}
+              isDraggable={false}
+              value={value}
+              truncate={false}
+              title={values.length > 1 ? `${link?.label}: ${value}` : link?.label}
+              linkValue={head(linkValues)}
+              onClick={closePopover}
+            />
+          ) : (
+            // data grid expects each cell action always return an element, it crashes if returns null
+            <></>
+          );
+        }
+      : EmptyComponent,
+];
+
+export const cellActions: TGridCellAction[] = [
   ({ data, pageSize }: { data: TimelineNonEcsData[][]; pageSize: number }) =>
-    ({ rowIndex, columnId, Component }) => {
+    ({ rowIndex, columnId, Component }: EuiDataGridColumnCellActionProps) => {
       const { timelines, filterManager } = useKibanaServices();
 
       const pageRowIndex = getPageRowIndex(rowIndex, pageSize);
       if (pageRowIndex >= data.length) {
-        return null;
+        // data grid expects each cell action always return an element, it crashes if returns null
+        return <></>;
       }
 
       const value = getMappedNonEcsValue({
@@ -72,7 +141,8 @@ export const defaultCellActions: TGridCellAction[] = [
 
       const pageRowIndex = getPageRowIndex(rowIndex, pageSize);
       if (pageRowIndex >= data.length) {
-        return null;
+        // data grid expects each cell action always return an element, it crashes if returns null
+        return <></>;
       }
 
       const value = getMappedNonEcsValue({
@@ -100,34 +170,8 @@ export const defaultCellActions: TGridCellAction[] = [
 
       const pageRowIndex = getPageRowIndex(rowIndex, pageSize);
       if (pageRowIndex >= data.length) {
-        return null;
-      }
-
-      const value = getMappedNonEcsValue({
-        data: data[pageRowIndex],
-        fieldName: columnId,
-      });
-
-      return (
-        <>
-          {timelines.getHoverActions().getCopyButton({
-            Component,
-            field: columnId,
-            isHoverAction: false,
-            ownFocus: false,
-            showTooltip: false,
-            value,
-          })}
-        </>
-      );
-    },
-  ({ data, pageSize }: { data: TimelineNonEcsData[][]; pageSize: number }) =>
-    ({ rowIndex, columnId, Component }) => {
-      const { timelines } = useKibanaServices();
-
-      const pageRowIndex = getPageRowIndex(rowIndex, pageSize);
-      if (pageRowIndex >= data.length) {
-        return null;
+        // data grid expects each cell action always return an element, it crashes if returns null
+        return <></>;
       }
 
       const value = getMappedNonEcsValue({
@@ -165,26 +209,14 @@ export const defaultCellActions: TGridCellAction[] = [
         </>
       );
     },
-  ({
-      browserFields,
-      data,
-      globalFilters,
-      timelineId,
-      pageSize,
-    }: {
-      browserFields: BrowserFields;
-      data: TimelineNonEcsData[][];
-      globalFilters?: Filter[];
-      timelineId: string;
-      pageSize: number;
-    }) =>
+  ({ data, pageSize }: { data: TimelineNonEcsData[][]; pageSize: number }) =>
     ({ rowIndex, columnId, Component }) => {
-      const [showTopN, setShowTopN] = useState(false);
-      const onClick = useCallback(() => setShowTopN(!showTopN), [showTopN]);
+      const { timelines } = useKibanaServices();
 
       const pageRowIndex = getPageRowIndex(rowIndex, pageSize);
       if (pageRowIndex >= data.length) {
-        return null;
+        // data grid expects each cell action always return an element, it crashes if returns null
+        return <></>;
       }
 
       const value = getMappedNonEcsValue({
@@ -192,31 +224,20 @@ export const defaultCellActions: TGridCellAction[] = [
         fieldName: columnId,
       });
 
-      const showButton = useMemo(
-        () =>
-          allowTopN({
-            browserField: getAllFieldsByName(browserFields)[columnId],
-            fieldName: columnId,
-            hideTopN: false,
-          }),
-        [columnId]
+      return (
+        <>
+          {timelines.getHoverActions().getCopyButton({
+            Component,
+            field: columnId,
+            isHoverAction: false,
+            ownFocus: false,
+            showTooltip: false,
+            value,
+          })}
+        </>
       );
-
-      return showButton ? (
-        <ShowTopNButton
-          Component={Component}
-          enablePopOver
-          data-test-subj="hover-actions-show-top-n"
-          field={columnId}
-          globalFilters={globalFilters}
-          onClick={onClick}
-          onFilterAdded={onFilterAdded}
-          ownFocus={false}
-          showTopN={showTopN}
-          showTooltip={false}
-          timelineId={timelineId}
-          value={value}
-        />
-      ) : null;
     },
 ];
+
+/** the default actions shown in `EuiDataGrid` cells */
+export const defaultCellActions = [...cellActions, ...cellActionLink];
diff --git a/x-pack/plugins/security_solution/public/common/lib/cell_actions/expanded_cell_value_actions.test.tsx b/x-pack/plugins/security_solution/public/common/lib/cell_actions/expanded_cell_value_actions.test.tsx
new file mode 100644
index 00000000000000..c818b16ac1f4f0
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/lib/cell_actions/expanded_cell_value_actions.test.tsx
@@ -0,0 +1,49 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { shallow } from 'enzyme';
+import React from 'react';
+import { ExpandedCellValueActions } from './expanded_cell_value_actions';
+
+jest.mock('../kibana');
+
+describe('ExpandedCellValueActions', () => {
+  const props = {
+    browserFields: {
+      host: {
+        fields: {
+          'host.name': {
+            aggregatable: true,
+            category: 'host',
+            description:
+              'Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.',
+            type: 'string',
+            name: 'host.name',
+          },
+        },
+      },
+    },
+    field: 'host.name',
+    globalFilters: [],
+    onFilterAdded: () => {},
+    timelineId: 'mockTimelineId',
+    value: ['mock value'],
+  };
+  const wrapper = shallow(<ExpandedCellValueActions {...props} />);
+
+  test('renders show topN button', () => {
+    expect(wrapper.find('[data-test-subj="data-grid-expanded-show-top-n"]').exists()).toBeTruthy();
+  });
+
+  test('renders filter in button', () => {
+    expect(wrapper.find('EuiFlexItem').first().html()).toContain('Filter button');
+  });
+
+  test('renders filter out button', () => {
+    expect(wrapper.find('EuiFlexItem').last().html()).toContain('Filter out button');
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/common/lib/cell_actions/expanded_cell_value_actions.tsx b/x-pack/plugins/security_solution/public/common/lib/cell_actions/expanded_cell_value_actions.tsx
new file mode 100644
index 00000000000000..4b50fff48fe062
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/lib/cell_actions/expanded_cell_value_actions.tsx
@@ -0,0 +1,125 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiButtonEmpty, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { noop } from 'lodash/fp';
+import React, { useMemo, useState, useCallback } from 'react';
+import styled from 'styled-components';
+import { Filter } from '../../../../../../../src/plugins/data/public';
+import { BrowserFields } from '../../../../../timelines/common/search_strategy';
+import { allowTopN } from '../../components/drag_and_drop/helpers';
+import { ShowTopNButton } from '../../components/hover_actions/actions/show_top_n';
+import { getAllFieldsByName } from '../../containers/source';
+import { useKibana } from '../kibana';
+import { SHOW_TOP_VALUES, HIDE_TOP_VALUES } from './translations';
+
+interface Props {
+  browserFields: BrowserFields;
+  field: string;
+  globalFilters?: Filter[];
+  timelineId: string;
+  value: string[] | undefined;
+  onFilterAdded?: () => void;
+}
+
+const StyledFlexGroup = styled(EuiFlexGroup)`
+  border-top: 1px solid #d3dae6;
+  border-bottom: 1px solid #d3dae6;
+  margin-top: 2px;
+`;
+
+export const StyledContent = styled.div<{ $isDetails: boolean }>`
+  padding: ${({ $isDetails }) => ($isDetails ? '0 8px' : undefined)};
+`;
+
+const ExpandedCellValueActionsComponent: React.FC<Props> = ({
+  browserFields,
+  field,
+  globalFilters,
+  onFilterAdded,
+  timelineId,
+  value,
+}) => {
+  const {
+    timelines,
+    data: {
+      query: { filterManager },
+    },
+  } = useKibana().services;
+  const showButton = useMemo(
+    () =>
+      allowTopN({
+        browserField: getAllFieldsByName(browserFields)[field],
+        fieldName: field,
+        hideTopN: false,
+      }),
+    [browserFields, field]
+  );
+
+  const [showTopN, setShowTopN] = useState(false);
+  const onClick = useCallback(() => setShowTopN(!showTopN), [showTopN]);
+
+  return (
+    <>
+      <StyledContent $isDetails data-test-subj="data-grid-expanded-cell-value-actions">
+        {showButton ? (
+          <ShowTopNButton
+            className="eui-displayBlock expandable-top-value-button"
+            Component={EuiButtonEmpty}
+            data-test-subj="data-grid-expanded-show-top-n"
+            field={field}
+            flush="both"
+            globalFilters={globalFilters}
+            iconSide="right"
+            iconType={showTopN ? 'arrowUp' : 'arrowDown'}
+            isExpandable
+            onClick={onClick}
+            onFilterAdded={onFilterAdded ?? noop}
+            ownFocus={false}
+            paddingSize="none"
+            showLegend
+            showTopN={showTopN}
+            showTooltip={false}
+            timelineId={timelineId}
+            title={showTopN ? HIDE_TOP_VALUES : SHOW_TOP_VALUES}
+            value={value}
+          />
+        ) : null}
+      </StyledContent>
+      <StyledFlexGroup gutterSize="s">
+        <EuiFlexItem>
+          {timelines.getHoverActions().getFilterForValueButton({
+            Component: EuiButtonEmpty,
+            field,
+            filterManager,
+            onFilterAdded,
+            ownFocus: false,
+            size: 's',
+            showTooltip: false,
+            value,
+          })}
+        </EuiFlexItem>
+        <EuiFlexItem>
+          {timelines.getHoverActions().getFilterOutValueButton({
+            Component: EuiButtonEmpty,
+            field,
+            filterManager,
+            onFilterAdded,
+            ownFocus: false,
+            size: 's',
+            showTooltip: false,
+            value,
+          })}
+        </EuiFlexItem>
+      </StyledFlexGroup>
+    </>
+  );
+};
+
+ExpandedCellValueActionsComponent.displayName = 'ExpandedCellValueActionsComponent';
+
+export const ExpandedCellValueActions = React.memo(ExpandedCellValueActionsComponent);
diff --git a/x-pack/plugins/security_solution/public/common/lib/cell_actions/helpers.ts b/x-pack/plugins/security_solution/public/common/lib/cell_actions/helpers.ts
new file mode 100644
index 00000000000000..1c40d8df48bfe2
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/lib/cell_actions/helpers.ts
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as i18n from './translations';
+import {
+  EVENT_URL_FIELD_NAME,
+  HOST_NAME_FIELD_NAME,
+  REFERENCE_URL_FIELD_NAME,
+  RULE_REFERENCE_FIELD_NAME,
+  SIGNAL_RULE_NAME_FIELD_NAME,
+} from '../../../timelines/components/timeline/body/renderers/constants';
+import { INDICATOR_REFERENCE } from '../../../../common/cti/constants';
+import { IP_FIELD_TYPE } from '../../../network/components/ip';
+import { PORT_NAMES } from '../../../network/components/port/helpers';
+
+export const COLUMNS_WITH_LINKS = [
+  {
+    columnId: HOST_NAME_FIELD_NAME,
+    label: i18n.VIEW_HOST_SUMMARY,
+  },
+  {
+    columnId: 'source.ip',
+    fieldType: IP_FIELD_TYPE,
+    label: i18n.EXPAND_IP_DETAILS,
+  },
+  {
+    columnId: 'destination.ip',
+    fieldType: IP_FIELD_TYPE,
+    label: i18n.EXPAND_IP_DETAILS,
+  },
+  {
+    columnId: SIGNAL_RULE_NAME_FIELD_NAME,
+    label: i18n.VIEW_RULE_DETAILS,
+  },
+  ...PORT_NAMES.map((p) => ({
+    columnId: p,
+    label: i18n.VIEW_PORT_DETAILS,
+  })),
+  {
+    columnId: RULE_REFERENCE_FIELD_NAME,
+    label: i18n.VIEW_RULE_REFERENCE,
+  },
+  {
+    columnId: REFERENCE_URL_FIELD_NAME,
+    label: i18n.VIEW_RULE_REFERENCE,
+  },
+  {
+    columnId: EVENT_URL_FIELD_NAME,
+    label: i18n.VIEW_EVENT_REFERENCE,
+  },
+  {
+    columnId: INDICATOR_REFERENCE,
+    label: i18n.VIEW_INDICATOR_REFERENCE,
+  },
+];
+
+export const getLink = (cId?: string, fieldType?: string, linkField?: string) =>
+  cId &&
+  COLUMNS_WITH_LINKS.find(
+    (c) => c.columnId === cId || (c.fieldType && fieldType === c.fieldType && linkField != null)
+  );
diff --git a/x-pack/plugins/security_solution/public/common/lib/cell_actions/translations.ts b/x-pack/plugins/security_solution/public/common/lib/cell_actions/translations.ts
new file mode 100644
index 00000000000000..527cc14c323b2f
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/lib/cell_actions/translations.ts
@@ -0,0 +1,71 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const SHOW_TOP_VALUES = i18n.translate(
+  'xpack.securitySolution.expandedValue.showTopN.showTopValues',
+  {
+    defaultMessage: 'Show top values',
+  }
+);
+
+export const HIDE_TOP_VALUES = i18n.translate(
+  'xpack.securitySolution.expandedValue.hideTopValues.HideTopValues',
+  {
+    defaultMessage: 'Hide top values',
+  }
+);
+
+export const VIEW_HOST_SUMMARY = i18n.translate(
+  'xpack.securitySolution.expandedValue.links.viewHostSummary',
+  {
+    defaultMessage: 'View host summary',
+  }
+);
+
+export const EXPAND_IP_DETAILS = i18n.translate(
+  'xpack.securitySolution.expandedValue.links.expandIpDetails',
+  {
+    defaultMessage: 'Expand ip details',
+  }
+);
+
+export const VIEW_RULE_DETAILS = i18n.translate(
+  'xpack.securitySolution.expandedValue.links.viewRuleDetails',
+  {
+    defaultMessage: 'View rule details',
+  }
+);
+
+export const VIEW_PORT_DETAILS = i18n.translate(
+  'xpack.securitySolution.expandedValue.links.viewPortDetails',
+  {
+    defaultMessage: 'View port details',
+  }
+);
+
+export const VIEW_RULE_REFERENCE = i18n.translate(
+  'xpack.securitySolution.expandedValue.links.viewRuleReference',
+  {
+    defaultMessage: 'View rule reference',
+  }
+);
+
+export const VIEW_EVENT_REFERENCE = i18n.translate(
+  'xpack.securitySolution.expandedValue.links.viewEventReference',
+  {
+    defaultMessage: 'View event reference',
+  }
+);
+
+export const VIEW_INDICATOR_REFERENCE = i18n.translate(
+  'xpack.securitySolution.expandedValue.links.viewIndicatorReference',
+  {
+    defaultMessage: 'View indicator reference',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/alerts_histogram.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/alerts_histogram.tsx
index 09d8d522716740..d09d33ce5aded2 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/alerts_histogram.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/alerts_histogram.tsx
@@ -31,6 +31,7 @@ interface AlertsHistogramProps {
   legendItems: LegendItem[];
   legendPosition?: Position;
   loading: boolean;
+  showLegend?: boolean;
   to: string;
   data: HistogramData[];
   updateDateRange: UpdateDateRange;
@@ -43,6 +44,7 @@ export const AlertsHistogram = React.memo<AlertsHistogramProps>(
     legendItems,
     legendPosition = 'right',
     loading,
+    showLegend,
     to,
     updateDateRange,
   }) => {
@@ -73,8 +75,9 @@ export const AlertsHistogram = React.memo<AlertsHistogramProps>(
               <Settings
                 legendPosition={legendPosition}
                 onBrushEnd={updateDateRange}
-                showLegend={legendItems.length === 0}
-                showLegendExtra
+                // showLegend controls the default legend coming from Elastic chart, we show them when our customised legend items doesn't exist (but we still want to show legend).
+                showLegend={showLegend && legendItems.length === 0}
+                showLegendExtra={showLegend}
                 theme={theme}
               />
 
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/index.tsx
index 280b7f29262765..0613c619d89b93 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/index.tsx
@@ -63,10 +63,12 @@ interface AlertsHistogramPanelProps {
   headerChildren?: React.ReactNode;
   /** Override all defaults, and only display this field */
   onlyField?: AlertsStackByField;
+  paddingSize?: 's' | 'm' | 'l' | 'none';
   titleSize?: EuiTitleSize;
   query?: Query;
   legendPosition?: Position;
   signalIndexName: string | null;
+  showLegend?: boolean;
   showLinkToAlerts?: boolean;
   showTotalAlertsCount?: boolean;
   showStackBy?: boolean;
@@ -85,9 +87,11 @@ export const AlertsHistogramPanel = memo<AlertsHistogramPanelProps>(
     filters,
     headerChildren,
     onlyField,
+    paddingSize = 'm',
     query,
     legendPosition = 'right',
     signalIndexName,
+    showLegend = true,
     showLinkToAlerts = false,
     showTotalAlertsCount = false,
     showStackBy = true,
@@ -154,7 +158,7 @@ export const AlertsHistogramPanel = memo<AlertsHistogramPanelProps>(
 
     const legendItems: LegendItem[] = useMemo(
       () =>
-        alertsData?.aggregations?.alertsByGrouping?.buckets != null
+        showLegend && alertsData?.aggregations?.alertsByGrouping?.buckets != null
           ? alertsData.aggregations.alertsByGrouping.buckets.map((bucket, i) => ({
               color: i < defaultLegendColors.length ? defaultLegendColors[i] : undefined,
               dataProviderId: escapeDataProviderId(
@@ -165,7 +169,12 @@ export const AlertsHistogramPanel = memo<AlertsHistogramPanelProps>(
               value: bucket.key,
             }))
           : NO_LEGEND_DATA,
-      [alertsData, selectedStackByOption, timelineId]
+      [
+        alertsData?.aggregations?.alertsByGrouping.buckets,
+        selectedStackByOption,
+        showLegend,
+        timelineId,
+      ]
     );
 
     useEffect(() => {
@@ -254,7 +263,7 @@ export const AlertsHistogramPanel = memo<AlertsHistogramPanelProps>(
 
     return (
       <InspectButtonContainer data-test-subj="alerts-histogram-panel" show={!isInitialLoading}>
-        <KpiPanel height={PANEL_HEIGHT} hasBorder>
+        <KpiPanel height={PANEL_HEIGHT} hasBorder paddingSize={paddingSize}>
           <HeaderSection
             id={uniqueQueryId}
             title={titleText}
@@ -288,6 +297,7 @@ export const AlertsHistogramPanel = memo<AlertsHistogramPanelProps>(
               legendPosition={legendPosition}
               loading={isLoadingAlerts}
               to={to}
+              showLegend={showLegend}
               updateDateRange={updateDateRange}
             />
           )}
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
index 89d0fd2e4dbd0d..d7c48c4f18bc8d 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
@@ -375,21 +375,21 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
 
   return (
     <StatefulEventsViewer
-      pageFilters={defaultFiltersMemo}
+      additionalFilters={additionalFiltersComponent}
+      currentFilter={filterGroup}
       defaultCellActions={defaultCellActions}
       defaultModel={defaultTimelineModel}
-      entityType="events"
       end={to}
-      currentFilter={filterGroup}
+      entityType="events"
+      hasAlertsCrud={hasIndexWrite && hasIndexMaintenance}
       id={timelineId}
       onRuleChange={onRuleChange}
+      pageFilters={defaultFiltersMemo}
       renderCellValue={RenderCellValue}
       rowRenderers={defaultRowRenderers}
       scopeId={SourcererScopeName.detections}
       start={from}
       utilityBar={utilityBarCallback}
-      additionalFilters={additionalFiltersComponent}
-      hasAlertsCrud={hasIndexWrite && hasIndexMaintenance}
     />
   );
 };
diff --git a/x-pack/plugins/security_solution/public/detections/configurations/security_solution_detections/render_cell_value.tsx b/x-pack/plugins/security_solution/public/detections/configurations/security_solution_detections/render_cell_value.tsx
index d9cdc4e0d09123..54cd26e9cdc541 100644
--- a/x-pack/plugins/security_solution/public/detections/configurations/security_solution_detections/render_cell_value.tsx
+++ b/x-pack/plugins/security_solution/public/detections/configurations/security_solution_detections/render_cell_value.tsx
@@ -18,37 +18,41 @@ import { DefaultCellRenderer } from '../../../timelines/components/timeline/cell
  */
 export const RenderCellValue: React.FC<EuiDataGridCellValueElementProps & CellValueElementProps> =
   ({
+    browserFields,
     columnId,
     data,
+    ecsData,
     eventId,
-    isDraggable,
+    globalFilters,
     header,
     isDetails,
+    isDraggable,
     isExpandable,
     isExpanded,
     linkValues,
     rowIndex,
+    rowRenderers,
     setCellProps,
     timelineId,
-    ecsData,
-    rowRenderers,
-    browserFields,
+    truncate,
   }) => (
     <DefaultCellRenderer
+      browserFields={browserFields}
       columnId={columnId}
       data={data}
+      ecsData={ecsData}
       eventId={eventId}
-      isDraggable={isDraggable}
+      globalFilters={globalFilters}
       header={header}
       isDetails={isDetails}
+      isDraggable={isDraggable}
       isExpandable={isExpandable}
       isExpanded={isExpanded}
       linkValues={linkValues}
       rowIndex={rowIndex}
+      rowRenderers={rowRenderers}
       setCellProps={setCellProps}
       timelineId={timelineId}
-      ecsData={ecsData}
-      rowRenderers={rowRenderers}
-      browserFields={browserFields}
+      truncate={truncate}
     />
   );
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/navigation/events_query_tab_body.tsx b/x-pack/plugins/security_solution/public/hosts/pages/navigation/events_query_tab_body.tsx
index fb3e22260bd840..3a27f8c2f3ba6d 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/navigation/events_query_tab_body.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/navigation/events_query_tab_body.tsx
@@ -115,11 +115,11 @@ const EventsQueryTabBodyComponent: React.FC<HostsComponentsQueryProps> = ({
         end={endDate}
         entityType="events"
         id={TimelineId.hostsPageEvents}
+        pageFilters={pageFilters}
         renderCellValue={DefaultCellRenderer}
         rowRenderers={defaultRowRenderers}
         scopeId={SourcererScopeName.default}
         start={startDate}
-        pageFilters={pageFilters}
         unit={unit}
       />
     </>
diff --git a/x-pack/plugins/security_solution/public/network/components/port/helpers.ts b/x-pack/plugins/security_solution/public/network/components/port/helpers.ts
new file mode 100644
index 00000000000000..e162fb3f90968e
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/components/port/helpers.ts
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+export const CLIENT_PORT_FIELD_NAME = 'client.port';
+export const DESTINATION_PORT_FIELD_NAME = 'destination.port';
+export const SERVER_PORT_FIELD_NAME = 'server.port';
+export const SOURCE_PORT_FIELD_NAME = 'source.port';
+export const URL_PORT_FIELD_NAME = 'url.port';
+
+export const PORT_NAMES = [
+  CLIENT_PORT_FIELD_NAME,
+  DESTINATION_PORT_FIELD_NAME,
+  SERVER_PORT_FIELD_NAME,
+  SOURCE_PORT_FIELD_NAME,
+  URL_PORT_FIELD_NAME,
+];
diff --git a/x-pack/plugins/security_solution/public/network/components/port/index.tsx b/x-pack/plugins/security_solution/public/network/components/port/index.tsx
index 4afd9bc7b892a5..769aa7300d138c 100644
--- a/x-pack/plugins/security_solution/public/network/components/port/index.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/port/index.tsx
@@ -5,33 +5,22 @@
  * 2.0.
  */
 
+import { EuiButtonEmpty, EuiButtonIcon } from '@elastic/eui';
 import React from 'react';
 
 import { DefaultDraggable } from '../../../common/components/draggables';
 import { getEmptyValue } from '../../../common/components/empty_value';
 import { PortOrServiceNameLink } from '../../../common/components/links';
 
-export const CLIENT_PORT_FIELD_NAME = 'client.port';
-export const DESTINATION_PORT_FIELD_NAME = 'destination.port';
-export const SERVER_PORT_FIELD_NAME = 'server.port';
-export const SOURCE_PORT_FIELD_NAME = 'source.port';
-export const URL_PORT_FIELD_NAME = 'url.port';
-
-export const PORT_NAMES = [
-  CLIENT_PORT_FIELD_NAME,
-  DESTINATION_PORT_FIELD_NAME,
-  SERVER_PORT_FIELD_NAME,
-  SOURCE_PORT_FIELD_NAME,
-  URL_PORT_FIELD_NAME,
-];
-
 export const Port = React.memo<{
   contextId: string;
+  Component?: typeof EuiButtonEmpty | typeof EuiButtonIcon;
   eventId: string;
   fieldName: string;
   isDraggable?: boolean;
+  title?: string;
   value: string | undefined | null;
-}>(({ contextId, eventId, fieldName, isDraggable, value }) =>
+}>(({ Component, contextId, eventId, fieldName, isDraggable, title, value }) =>
   isDraggable ? (
     <DefaultDraggable
       data-test-subj="port"
@@ -41,10 +30,18 @@ export const Port = React.memo<{
       tooltipContent={fieldName}
       value={value}
     >
-      <PortOrServiceNameLink portOrServiceName={value || getEmptyValue()} />
+      <PortOrServiceNameLink
+        portOrServiceName={value || getEmptyValue()}
+        Component={Component}
+        title={title}
+      />
     </DefaultDraggable>
   ) : (
-    <PortOrServiceNameLink portOrServiceName={value || getEmptyValue()} />
+    <PortOrServiceNameLink
+      portOrServiceName={value || getEmptyValue()}
+      Component={Component}
+      title={title}
+    />
   )
 );
 
diff --git a/x-pack/plugins/security_solution/public/network/components/source_destination/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/source_destination/index.test.tsx
index 3da5ec6d4b2188..3332111d14f8b6 100644
--- a/x-pack/plugins/security_solution/public/network/components/source_destination/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/source_destination/index.test.tsx
@@ -18,7 +18,7 @@ import { TestProviders } from '../../../common/mock/test_providers';
 import { ID_FIELD_NAME } from '../../../common/components/event_details/event_id';
 import { useMountAppended } from '../../../common/utils/use_mount_appended';
 import { DESTINATION_IP_FIELD_NAME, SOURCE_IP_FIELD_NAME } from '../ip';
-import { DESTINATION_PORT_FIELD_NAME, SOURCE_PORT_FIELD_NAME } from '../port';
+import { DESTINATION_PORT_FIELD_NAME, SOURCE_PORT_FIELD_NAME } from '../port/helpers';
 import {
   DESTINATION_BYTES_FIELD_NAME,
   DESTINATION_PACKETS_FIELD_NAME,
diff --git a/x-pack/plugins/security_solution/public/network/components/source_destination/source_destination_ip.test.tsx b/x-pack/plugins/security_solution/public/network/components/source_destination/source_destination_ip.test.tsx
index 824b9fd11f2429..f16cd7dbb109f2 100644
--- a/x-pack/plugins/security_solution/public/network/components/source_destination/source_destination_ip.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/source_destination/source_destination_ip.test.tsx
@@ -15,7 +15,7 @@ import '../../../common/mock/match_media';
 import { TestProviders } from '../../../common/mock/test_providers';
 import { ID_FIELD_NAME } from '../../../common/components/event_details/event_id';
 import { DESTINATION_IP_FIELD_NAME, SOURCE_IP_FIELD_NAME } from '../ip';
-import { DESTINATION_PORT_FIELD_NAME, SOURCE_PORT_FIELD_NAME } from '../port';
+import { DESTINATION_PORT_FIELD_NAME, SOURCE_PORT_FIELD_NAME } from '../port/helpers';
 import * as i18n from '../../../timelines/components/timeline/body/renderers/translations';
 import { useMountAppended } from '../../../common/utils/use_mount_appended';
 
diff --git a/x-pack/plugins/security_solution/public/network/components/source_destination/source_destination_ip.tsx b/x-pack/plugins/security_solution/public/network/components/source_destination/source_destination_ip.tsx
index 31bae6880fcbe4..2be1c5f50406fa 100644
--- a/x-pack/plugins/security_solution/public/network/components/source_destination/source_destination_ip.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/source_destination/source_destination_ip.tsx
@@ -11,7 +11,8 @@ import React from 'react';
 import deepEqual from 'fast-deep-equal';
 
 import { DESTINATION_IP_FIELD_NAME, SOURCE_IP_FIELD_NAME } from '../ip';
-import { DESTINATION_PORT_FIELD_NAME, SOURCE_PORT_FIELD_NAME, Port } from '../port';
+import { Port } from '../port';
+import { DESTINATION_PORT_FIELD_NAME, SOURCE_PORT_FIELD_NAME } from '../port/helpers';
 import * as i18n from '../../../timelines/components/timeline/body/renderers/translations';
 
 import { GeoFields } from './geo_fields';
diff --git a/x-pack/plugins/security_solution/public/overview/components/events_by_dataset/index.tsx b/x-pack/plugins/security_solution/public/overview/components/events_by_dataset/index.tsx
index 5cea3fa98eeb7e..7de1d9d9f40c1f 100644
--- a/x-pack/plugins/security_solution/public/overview/components/events_by_dataset/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/events_by_dataset/index.tsx
@@ -49,8 +49,10 @@ interface Props extends Pick<GlobalTimeArgs, 'from' | 'to' | 'deleteQuery' | 'se
   indexPattern: IIndexPattern;
   indexNames: string[];
   onlyField?: string;
+  paddingSize?: 's' | 'm' | 'l' | 'none';
   query: Query;
   setAbsoluteRangeDatePickerTarget?: InputsModelId;
+  showLegend?: boolean;
   showSpacer?: boolean;
   timelineId?: string;
   toggleTopN?: () => void;
@@ -70,9 +72,11 @@ const EventsByDatasetComponent: React.FC<Props> = ({
   indexPattern,
   indexNames,
   onlyField,
+  paddingSize,
   query,
   setAbsoluteRangeDatePickerTarget,
   setQuery,
+  showLegend,
   showSpacer = true,
   timelineId,
   to,
@@ -177,9 +181,11 @@ const EventsByDatasetComponent: React.FC<Props> = ({
       id={uniqueQueryId}
       indexNames={indexNames}
       onError={toggleTopN}
+      paddingSize={paddingSize}
       setAbsoluteRangeDatePickerTarget={setAbsoluteRangeDatePickerTarget}
       setQuery={setQuery}
       showSpacer={showSpacer}
+      showLegend={showLegend}
       skip={filterQuery === undefined}
       startDate={from}
       timelineId={timelineId}
diff --git a/x-pack/plugins/security_solution/public/overview/components/signals_by_category/index.tsx b/x-pack/plugins/security_solution/public/overview/components/signals_by_category/index.tsx
index 76116f2261118c..321e6d00b5301e 100644
--- a/x-pack/plugins/security_solution/public/overview/components/signals_by_category/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/signals_by_category/index.tsx
@@ -23,8 +23,10 @@ interface Props {
   headerChildren?: React.ReactNode;
   /** Override all defaults, and only display this field */
   onlyField?: AlertsStackByField;
+  paddingSize?: 's' | 'm' | 'l' | 'none';
   query?: Query;
   setAbsoluteRangeDatePickerTarget?: InputsModelId;
+  showLegend?: boolean;
   timelineId?: string;
 }
 
@@ -33,7 +35,9 @@ const SignalsByCategoryComponent: React.FC<Props> = ({
   filters,
   headerChildren,
   onlyField,
+  paddingSize,
   query,
+  showLegend,
   setAbsoluteRangeDatePickerTarget = 'global',
   timelineId,
 }) => {
@@ -61,16 +65,18 @@ const SignalsByCategoryComponent: React.FC<Props> = ({
       combinedQueries={combinedQueries}
       filters={filters}
       headerChildren={headerChildren}
+      legendPosition={'right'}
       onlyField={onlyField}
-      titleSize={onlyField == null ? 'm' : 's'}
+      paddingSize={paddingSize}
       query={query}
-      signalIndexName={signalIndexName}
-      showTotalAlertsCount={true}
+      showLegend={showLegend}
       showLinkToAlerts={onlyField == null ? true : false}
       showStackBy={onlyField == null}
-      legendPosition={'right'}
+      showTotalAlertsCount={true}
+      signalIndexName={signalIndexName}
       timelineId={timelineId}
       title={i18n.ALERT_COUNT}
+      titleSize={onlyField == null ? 'm' : 's'}
       updateDateRange={updateDateRangeCallback}
     />
   );
diff --git a/x-pack/plugins/security_solution/public/timelines/components/formatted_ip/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/formatted_ip/index.tsx
index 913a0f7ed200bc..e1f0954683e043 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/formatted_ip/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/formatted_ip/index.tsx
@@ -10,6 +10,7 @@ import React, { useCallback, useMemo, useContext } from 'react';
 import { useDispatch } from 'react-redux';
 import deepEqual from 'fast-deep-equal';
 
+import { EuiButtonEmpty, EuiButtonIcon } from '@elastic/eui';
 import { FlowTarget } from '../../../../common/search_strategy/security_solution/network';
 import {
   DragEffects,
@@ -145,11 +146,15 @@ interface AddressLinksItemProps extends Omit<AddressLinksProps, 'addresses'> {
 
 const AddressLinksItemComponent: React.FC<AddressLinksItemProps> = ({
   address,
+  Component,
   contextId,
   eventId,
   fieldName,
+  isButton,
   isDraggable,
+  onClick,
   truncate,
+  title,
 }) => {
   const key = `address-links-draggable-wrapper-${getUniqueId({
     contextId,
@@ -171,6 +176,10 @@ const AddressLinksItemComponent: React.FC<AddressLinksItemProps> = ({
   const openNetworkDetailsSidePanel = useCallback(
     (e) => {
       e.preventDefault();
+      if (onClick) {
+        onClick();
+      }
+
       if (eventContext && isInTimelineContext) {
         const { tabType, timelineID } = eventContext;
         const updatedExpandedDetail: TimelineExpandedDetailType = {
@@ -196,22 +205,41 @@ const AddressLinksItemComponent: React.FC<AddressLinksItemProps> = ({
         }
       }
     },
-    [eventContext, isInTimelineContext, address, fieldName, dispatch]
+    [onClick, eventContext, isInTimelineContext, address, fieldName, dispatch]
   );
 
   // The below is explicitly defined this way as the onClick takes precedence when it and the href are both defined
   // When this component is used outside of timeline/alerts table (i.e. in the flyout) we would still like it to link to the IP Overview page
   const content = useMemo(
-    () => (
-      <Content field={fieldName} tooltipContent={fieldName}>
+    () =>
+      Component ? (
         <NetworkDetailsLink
+          Component={Component}
           ip={address}
-          isButton={false}
+          isButton={isButton}
           onClick={isInTimelineContext ? openNetworkDetailsSidePanel : undefined}
+          title={title}
         />
-      </Content>
-    ),
-    [address, fieldName, isInTimelineContext, openNetworkDetailsSidePanel]
+      ) : (
+        <Content field={fieldName} tooltipContent={fieldName}>
+          <NetworkDetailsLink
+            Component={Component}
+            ip={address}
+            isButton={isButton}
+            onClick={isInTimelineContext ? openNetworkDetailsSidePanel : undefined}
+            title={title}
+          />
+        </Content>
+      ),
+    [
+      Component,
+      address,
+      fieldName,
+      isButton,
+      isInTimelineContext,
+      openNetworkDetailsSidePanel,
+      title,
+    ]
   );
 
   const render = useCallback(
@@ -245,20 +273,28 @@ const AddressLinksItem = React.memo(AddressLinksItemComponent);
 
 interface AddressLinksProps {
   addresses: string[];
+  Component?: typeof EuiButtonEmpty | typeof EuiButtonIcon;
   contextId: string;
   eventId: string;
   fieldName: string;
+  isButton?: boolean;
   isDraggable: boolean;
+  onClick?: () => void;
   truncate?: boolean;
+  title?: string;
 }
 
 const AddressLinksComponent: React.FC<AddressLinksProps> = ({
   addresses,
+  Component,
   contextId,
   eventId,
   fieldName,
+  isButton,
   isDraggable,
+  onClick,
   truncate,
+  title,
 }) => {
   const uniqAddresses = useMemo(() => uniq(addresses), [addresses]);
 
@@ -268,14 +304,29 @@ const AddressLinksComponent: React.FC<AddressLinksProps> = ({
         <AddressLinksItem
           key={address}
           address={address}
+          Component={Component}
           contextId={contextId}
           eventId={eventId}
           fieldName={fieldName}
+          isButton={isButton}
           isDraggable={isDraggable}
+          onClick={onClick}
           truncate={truncate}
+          title={title}
         />
       )),
-    [contextId, eventId, fieldName, isDraggable, truncate, uniqAddresses]
+    [
+      Component,
+      contextId,
+      eventId,
+      fieldName,
+      isButton,
+      isDraggable,
+      onClick,
+      title,
+      truncate,
+      uniqAddresses,
+    ]
   );
 
   return <>{content}</>;
@@ -293,13 +344,28 @@ const AddressLinks = React.memo(
 );
 
 const FormattedIpComponent: React.FC<{
+  Component?: typeof EuiButtonEmpty | typeof EuiButtonIcon;
   contextId: string;
   eventId: string;
   fieldName: string;
+  isButton?: boolean;
   isDraggable: boolean;
+  onClick?: () => void;
+  title?: string;
   truncate?: boolean;
   value: string | object | null | undefined;
-}> = ({ contextId, eventId, fieldName, isDraggable, truncate, value }) => {
+}> = ({
+  Component,
+  contextId,
+  eventId,
+  fieldName,
+  isDraggable,
+  isButton,
+  onClick,
+  title,
+  truncate,
+  value,
+}) => {
   if (isString(value) && !isEmpty(value)) {
     try {
       const addresses = JSON.parse(value);
@@ -307,10 +373,14 @@ const FormattedIpComponent: React.FC<{
         return (
           <AddressLinks
             addresses={addresses}
+            Component={Component}
             contextId={contextId}
             eventId={eventId}
             fieldName={fieldName}
+            isButton={isButton}
             isDraggable={isDraggable}
+            onClick={onClick}
+            title={title}
             truncate={truncate}
           />
         );
@@ -323,11 +393,15 @@ const FormattedIpComponent: React.FC<{
     return (
       <AddressLinks
         addresses={[value]}
+        Component={Component}
         contextId={contextId}
         eventId={eventId}
+        isButton={isButton}
         isDraggable={isDraggable}
+        onClick={onClick}
         fieldName={fieldName}
         truncate={truncate}
+        title={title}
       />
     );
   } else {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/netflow/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/netflow/index.test.tsx
index 5392b382d6c82f..23a52b878472f1 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/netflow/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/netflow/index.test.tsx
@@ -25,7 +25,7 @@ import { JA3_HASH_FIELD_NAME } from '../ja3_fingerprint';
 import {
   DESTINATION_PORT_FIELD_NAME,
   SOURCE_PORT_FIELD_NAME,
-} from '../../../network/components/port';
+} from '../../../network/components/port/helpers';
 import {
   DESTINATION_GEO_CITY_NAME_FIELD_NAME,
   DESTINATION_GEO_CONTINENT_NAME_FIELD_NAME,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/column_renderer.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/column_renderer.ts
index 1e6f613999ece3..0ec974f8768943 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/column_renderer.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/column_renderer.ts
@@ -6,33 +6,44 @@
  */
 
 import type React from 'react';
+import { Filter } from '../../../../../../../../../src/plugins/data/public';
+import { BrowserFields } from '../../../../../../../timelines/common/search_strategy';
 
-import { BrowserFields, ColumnHeaderOptions, RowRenderer } from '../../../../../../common';
+import { ColumnHeaderOptions, RowRenderer } from '../../../../../../common';
 import { Ecs } from '../../../../../../common/ecs';
 import { TimelineNonEcsData } from '../../../../../../common/search_strategy/timeline';
 
 export interface ColumnRenderer {
   isInstance: (columnName: string, data: TimelineNonEcsData[]) => boolean;
   renderColumn: ({
+    browserFields,
+    className,
     columnName,
     eventId,
     field,
+    globalFilters,
+    isDetails,
     isDraggable,
+    linkValues,
+    rowRenderers,
     timelineId,
     truncate,
     values,
-    linkValues,
   }: {
+    asPlainText?: boolean;
+    browserFields?: BrowserFields;
+    className?: string;
     columnName: string;
+    ecsData?: Ecs;
     eventId: string;
     field: ColumnHeaderOptions;
+    globalFilters?: Filter[];
+    isDetails?: boolean;
     isDraggable?: boolean;
+    linkValues?: string[] | null | undefined;
+    rowRenderers?: RowRenderer[];
     timelineId: string;
     truncate?: boolean;
     values: string[] | null | undefined;
-    linkValues?: string[] | null | undefined;
-    ecsData?: Ecs;
-    rowRenderers?: RowRenderer[];
-    browserFields?: BrowserFields;
   }) => React.ReactNode;
 }
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field.tsx
index 5eec4ef66f39c2..63e7e164854df2 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field.tsx
@@ -7,7 +7,7 @@
 
 /* eslint-disable complexity */
 
-import { EuiFlexGroup, EuiFlexItem, EuiToolTip } from '@elastic/eui';
+import { EuiButtonEmpty, EuiButtonIcon, EuiFlexGroup, EuiFlexItem, EuiToolTip } from '@elastic/eui';
 import { isNumber, isEmpty } from 'lodash/fp';
 import React from 'react';
 
@@ -19,7 +19,8 @@ import { getOrEmptyTagFromValue } from '../../../../../common/components/empty_v
 import { FormattedDate } from '../../../../../common/components/formatted_date';
 import { FormattedIp } from '../../../../components/formatted_ip';
 
-import { Port, PORT_NAMES } from '../../../../../network/components/port';
+import { Port } from '../../../../../network/components/port';
+import { PORT_NAMES } from '../../../../../network/components/port/helpers';
 import { TruncatableText } from '../../../../../common/components/truncatable_text';
 import {
   DATE_FIELD_TYPE,
@@ -44,44 +45,60 @@ import { AgentStatuses } from './agent_statuses';
 const columnNamesNotDraggable = [MESSAGE_FIELD_NAME];
 
 const FormattedFieldValueComponent: React.FC<{
+  asPlainText?: boolean;
+  /** `Component` is only used with `EuiDataGrid`; the grid keeps a reference to `Component` for show / hide functionality */
+  Component?: typeof EuiButtonEmpty | typeof EuiButtonIcon;
   contextId: string;
   eventId: string;
   isObjectArray?: boolean;
   fieldFormat?: string;
   fieldName: string;
   fieldType?: string;
+  isButton?: boolean;
   isDraggable?: boolean;
+  onClick?: () => void;
+  title?: string;
   truncate?: boolean;
   value: string | number | undefined | null;
   linkValue?: string | null | undefined;
 }> = ({
+  asPlainText,
+  Component,
   contextId,
   eventId,
   fieldFormat,
   fieldName,
   fieldType,
+  isButton,
   isObjectArray = false,
   isDraggable = true,
-  truncate,
+  onClick,
+  title,
+  truncate = true,
   value,
   linkValue,
 }) => {
-  if (isObjectArray) {
-    return <>{value}</>;
+  if (isObjectArray || asPlainText) {
+    return <span data-test-subj={`formatted-field-${fieldName}`}>{value}</span>;
   } else if (fieldType === IP_FIELD_TYPE) {
     return (
       <FormattedIp
+        Component={Component}
         eventId={eventId}
         contextId={contextId}
         fieldName={fieldName}
+        isButton={isButton}
         isDraggable={isDraggable}
         value={!isNumber(value) ? value : String(value)}
+        onClick={onClick}
+        title={title}
         truncate={truncate}
       />
     );
   } else if (fieldType === GEO_FIELD_TYPE) {
     return <>{value}</>;
   } else if (fieldType === DATE_FIELD_TYPE) {
+    const classNames = truncate ? 'eui-textTruncate eui-alignMiddle' : undefined;
     return isDraggable ? (
       <DefaultDraggable
         field={fieldName}
@@ -90,18 +107,20 @@ const FormattedFieldValueComponent: React.FC<{
         tooltipContent={null}
         value={`${value}`}
       >
-        <FormattedDate fieldName={fieldName} value={value} />
+        <FormattedDate className={classNames} fieldName={fieldName} value={value} />
       </DefaultDraggable>
     ) : (
-      <FormattedDate fieldName={fieldName} value={value} />
+      <FormattedDate className={classNames} fieldName={fieldName} value={value} />
     );
   } else if (PORT_NAMES.some((portName) => fieldName === portName)) {
     return (
       <Port
+        Component={Component}
         contextId={contextId}
         eventId={eventId}
         fieldName={fieldName}
         isDraggable={isDraggable}
+        title={title}
         value={`${value}`}
       />
     );
@@ -118,10 +137,14 @@ const FormattedFieldValueComponent: React.FC<{
   } else if (fieldName === HOST_NAME_FIELD_NAME) {
     return (
       <HostName
+        Component={Component}
         contextId={contextId}
         eventId={eventId}
         fieldName={fieldName}
         isDraggable={isDraggable}
+        isButton={isButton}
+        onClick={onClick}
+        title={title}
         value={value}
       />
     );
@@ -138,11 +161,13 @@ const FormattedFieldValueComponent: React.FC<{
   } else if (fieldName === SIGNAL_RULE_NAME_FIELD_NAME) {
     return (
       <RenderRuleName
+        Component={Component}
         contextId={contextId}
         eventId={eventId}
         fieldName={fieldName}
         isDraggable={isDraggable}
         linkValue={linkValue}
+        title={title}
         truncate={truncate}
         value={value}
       />
@@ -185,7 +210,17 @@ const FormattedFieldValueComponent: React.FC<{
       INDICATOR_REFERENCE,
     ].includes(fieldName)
   ) {
-    return renderUrl({ contextId, eventId, fieldName, linkValue, isDraggable, truncate, value });
+    return renderUrl({
+      contextId,
+      Component,
+      eventId,
+      fieldName,
+      linkValue,
+      isDraggable,
+      truncate,
+      title,
+      value,
+    });
   } else if (columnNamesNotDraggable.includes(fieldName) || !isDraggable) {
     return truncate && !isEmpty(value) ? (
       <TruncatableText data-test-subj="truncatable-message">
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field_helpers.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field_helpers.tsx
index 3343882e0071a8..cda196fd796342 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field_helpers.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field_helpers.tsx
@@ -5,9 +5,17 @@
  * 2.0.
  */
 
-import { EuiLink, EuiFlexGroup, EuiFlexItem, EuiIcon, EuiToolTip } from '@elastic/eui';
+import {
+  EuiButtonEmpty,
+  EuiButtonIcon,
+  EuiLink,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiIcon,
+  EuiToolTip,
+} from '@elastic/eui';
 import { isString, isEmpty } from 'lodash/fp';
-import React, { useCallback } from 'react';
+import React, { SyntheticEvent, useCallback, useMemo } from 'react';
 import styled from 'styled-components';
 
 import { DefaultDraggable } from '../../../../../common/components/draggables';
@@ -30,22 +38,26 @@ const EventModuleFlexItem = styled(EuiFlexItem)`
 `;
 
 interface RenderRuleNameProps {
+  Component?: typeof EuiButtonEmpty | typeof EuiButtonIcon;
   contextId: string;
   eventId: string;
   fieldName: string;
   isDraggable: boolean;
   linkValue: string | null | undefined;
   truncate?: boolean;
+  title?: string;
   value: string | number | null | undefined;
 }
 
 export const RenderRuleName: React.FC<RenderRuleNameProps> = ({
+  Component,
   contextId,
   eventId,
   fieldName,
   isDraggable,
   linkValue,
   truncate,
+  title,
   value,
 }) => {
   const ruleName = `${value}`;
@@ -69,15 +81,29 @@ export const RenderRuleName: React.FC<RenderRuleNameProps> = ({
     [navigateToApp, ruleId, search]
   );
 
+  const href = useMemo(
+    () =>
+      getUrlForApp(APP_ID, {
+        deepLinkId: SecurityPageName.rules,
+        path: getRuleDetailsUrl(ruleId ?? '', search),
+      }),
+    [getUrlForApp, ruleId, search]
+  );
+  const id = `event-details-value-default-draggable-${contextId}-${eventId}-${fieldName}-${value}-${ruleId}`;
+
   if (isString(value) && ruleName.length > 0 && ruleId != null) {
-    const link = (
-      <LinkAnchor
+    const link = Component ? (
+      <Component
+        aria-label={title}
+        data-test-subj={`view-${fieldName}`}
+        iconType="link"
         onClick={goToRuleDetails}
-        href={getUrlForApp(APP_ID, {
-          deepLinkId: SecurityPageName.rules,
-          path: getRuleDetailsUrl(ruleId, search),
-        })}
+        title={title}
       >
+        {title ?? value}
+      </Component>
+    ) : (
+      <LinkAnchor onClick={goToRuleDetails} href={href}>
         {content}
       </LinkAnchor>
     );
@@ -85,7 +111,7 @@ export const RenderRuleName: React.FC<RenderRuleNameProps> = ({
     return isDraggable ? (
       <DefaultDraggable
         field={fieldName}
-        id={`event-details-value-default-draggable-${contextId}-${eventId}-${fieldName}-${value}-${ruleId}`}
+        id={id}
         isDraggable={isDraggable}
         tooltipContent={value}
         value={value}
@@ -99,7 +125,7 @@ export const RenderRuleName: React.FC<RenderRuleNameProps> = ({
     return isDraggable ? (
       <DefaultDraggable
         field={fieldName}
-        id={`event-details-value-default-draggable-${contextId}-${eventId}-${fieldName}-${value}-${ruleId}`}
+        id={id}
         isDraggable={isDraggable}
         tooltipContent={value}
         value={`${value}`}
@@ -189,35 +215,71 @@ export const renderEventModule = ({
   );
 };
 
+const GenericLinkComponent: React.FC<{
+  children?: React.ReactNode;
+  /** `Component` is only used with `EuiDataGrid`; the grid keeps a reference to `Component` for show / hide functionality */
+  Component?: typeof EuiButtonEmpty | typeof EuiButtonIcon;
+  dataTestSubj?: string;
+  href: string;
+  onClick?: (e: SyntheticEvent) => void;
+  title?: string;
+  iconType?: string;
+}> = ({ children, Component, dataTestSubj, href, onClick, title, iconType = 'link' }) => {
+  return Component ? (
+    <Component
+      data-test-subj={dataTestSubj}
+      href={href}
+      iconType={iconType}
+      onClick={onClick}
+      title={title}
+    >
+      {title ?? children}
+    </Component>
+  ) : (
+    <EuiLink data-test-subj={dataTestSubj} target="_blank" href={href}>
+      {title ?? children}
+    </EuiLink>
+  );
+};
+
+const GenericLink = React.memo(GenericLinkComponent);
+
 export const renderUrl = ({
   contextId,
+  Component,
   eventId,
   fieldName,
   isDraggable,
   linkValue,
   truncate,
+  title,
   value,
 }: {
   contextId: string;
+  /** `Component` is only used with `EuiDataGrid`; the grid keeps a reference to `Component` for show / hide functionality */
+  Component?: typeof EuiButtonEmpty | typeof EuiButtonIcon;
   eventId: string;
   fieldName: string;
   isDraggable: boolean;
   linkValue: string | null | undefined;
   truncate?: boolean;
+  title?: string;
   value: string | number | null | undefined;
 }) => {
   const urlName = `${value}`;
+  const isUrlValid = !isUrlInvalid(urlName);
 
   const formattedValue = truncate ? <TruncatableText>{value}</TruncatableText> : value;
-  const content = (
-    <>
-      {!isUrlInvalid(urlName) && (
-        <EuiLink target="_blank" href={urlName}>
-          {formattedValue}
-        </EuiLink>
-      )}
-      {isUrlInvalid(urlName) && <>{formattedValue}</>}
-    </>
+  const content = isUrlValid ? (
+    <GenericLink
+      Component={Component}
+      href={urlName}
+      dataTestSubj="ata-grid-url"
+      title={title}
+      iconType="link"
+    />
+  ) : (
+    <>{formattedValue}</>
   );
 
   return isString(value) && urlName.length > 0 ? (
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/host_name.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/host_name.tsx
index c183d71212540b..5864e144a681eb 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/host_name.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/host_name.tsx
@@ -6,6 +6,7 @@
  */
 
 import React, { useCallback, useContext, useMemo } from 'react';
+import { EuiButtonEmpty, EuiButtonIcon } from '@elastic/eui';
 import { useDispatch } from 'react-redux';
 import { isString } from 'lodash/fp';
 import { HostDetailsLink } from '../../../../../common/components/links';
@@ -23,17 +24,25 @@ import { StatefulEventContext } from '../../../../../../../timelines/public';
 
 interface Props {
   contextId: string;
+  Component?: typeof EuiButtonEmpty | typeof EuiButtonIcon;
   eventId: string;
   fieldName: string;
   isDraggable: boolean;
+  isButton?: boolean;
+  onClick?: () => void;
   value: string | number | undefined | null;
+  title?: string;
 }
 
 const HostNameComponent: React.FC<Props> = ({
   fieldName,
+  Component,
   contextId,
   eventId,
   isDraggable,
+  isButton,
+  onClick,
+  title,
   value,
 }) => {
   const dispatch = useDispatch();
@@ -44,6 +53,10 @@ const HostNameComponent: React.FC<Props> = ({
   const openHostDetailsSidePanel = useCallback(
     (e) => {
       e.preventDefault();
+
+      if (onClick) {
+        onClick();
+      }
       if (eventContext && isInTimelineContext) {
         const { timelineID, tabType } = eventContext;
         const updatedExpandedDetail: TimelineExpandedDetailType = {
@@ -66,7 +79,7 @@ const HostNameComponent: React.FC<Props> = ({
         }
       }
     },
-    [dispatch, eventContext, isInTimelineContext, hostName]
+    [onClick, eventContext, isInTimelineContext, hostName, dispatch]
   );
 
   // The below is explicitly defined this way as the onClick takes precedence when it and the href are both defined
@@ -74,14 +87,16 @@ const HostNameComponent: React.FC<Props> = ({
   const content = useMemo(
     () => (
       <HostDetailsLink
+        Component={Component}
         hostName={hostName}
-        isButton={false}
+        isButton={isButton}
         onClick={isInTimelineContext ? openHostDetailsSidePanel : undefined}
+        title={title}
       >
         <TruncatableText data-test-subj="draggable-truncatable-content">{hostName}</TruncatableText>
       </HostDetailsLink>
     ),
-    [hostName, isInTimelineContext, openHostDetailsSidePanel]
+    [Component, hostName, isButton, isInTimelineContext, openHostDetailsSidePanel, title]
   );
 
   return isString(value) && hostName.length > 0 ? (
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow.tsx
index d6ea939c966ac7..acc88ef3ee111e 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow.tsx
@@ -29,7 +29,7 @@ import {
 import {
   DESTINATION_PORT_FIELD_NAME,
   SOURCE_PORT_FIELD_NAME,
-} from '../../../../../network/components/port';
+} from '../../../../../network/components/port/helpers';
 import {
   DESTINATION_GEO_CITY_NAME_FIELD_NAME,
   DESTINATION_GEO_CONTINENT_NAME_FIELD_NAME,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow/netflow_row_renderer.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow/netflow_row_renderer.tsx
index f38304e7186758..e36e347fc0cc3a 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow/netflow_row_renderer.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow/netflow_row_renderer.tsx
@@ -34,7 +34,7 @@ import {
 import {
   DESTINATION_PORT_FIELD_NAME,
   SOURCE_PORT_FIELD_NAME,
-} from '../../../../../../network/components/port';
+} from '../../../../../../network/components/port/helpers';
 import {
   NETWORK_BYTES_FIELD_NAME,
   NETWORK_COMMUNITY_ID_FIELD_NAME,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/plain_column_renderer.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/plain_column_renderer.tsx
index 8509e7be0d22bf..2f0653826d11bd 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/plain_column_renderer.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/plain_column_renderer.tsx
@@ -7,6 +7,7 @@
 
 import { head } from 'lodash/fp';
 import React from 'react';
+import { Filter } from '../../../../../../../../../src/plugins/data/public';
 
 import { ColumnHeaderOptions } from '../../../../../../common';
 import { TimelineNonEcsData } from '../../../../../../common/search_strategy/timeline';
@@ -21,8 +22,8 @@ export const dataExistsAtColumn = (columnName: string, data: TimelineNonEcsData[
 export const plainColumnRenderer: ColumnRenderer = {
   isInstance: (columnName: string, data: TimelineNonEcsData[]) =>
     dataExistsAtColumn(columnName, data),
-
   renderColumn: ({
+    asPlainText,
     columnName,
     eventId,
     field,
@@ -32,9 +33,11 @@ export const plainColumnRenderer: ColumnRenderer = {
     values,
     linkValues,
   }: {
+    asPlainText?: boolean;
     columnName: string;
     eventId: string;
     field: ColumnHeaderOptions;
+    globalFilters?: Filter[];
     isDraggable?: boolean;
     timelineId: string;
     truncate?: boolean;
@@ -44,16 +47,17 @@ export const plainColumnRenderer: ColumnRenderer = {
     values != null
       ? values.map((value, i) => (
           <FormattedFieldValue
-            key={`plain-column-renderer-formatted-field-value-${timelineId}-${columnName}-${eventId}-${field.id}-${value}-${i}`}
+            asPlainText={asPlainText}
             contextId={`plain-column-renderer-formatted-field-value-${timelineId}`}
             eventId={eventId}
             fieldFormat={field.format || ''}
             fieldName={columnName}
             fieldType={field.type || ''}
             isDraggable={isDraggable}
-            value={parseValue(value)}
-            truncate={truncate}
+            key={`plain-column-renderer-formatted-field-value-${timelineId}-${columnName}-${eventId}-${field.id}-${value}-${i}`}
             linkValue={head(linkValues)}
+            truncate={truncate}
+            value={parseValue(value)}
           />
         ))
       : getEmptyTagValue(),
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/reason_column_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/reason_column_renderer.test.tsx
index 9d711b9593622a..8fdd6483a14f88 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/reason_column_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/reason_column_renderer.test.tsx
@@ -19,7 +19,7 @@ import {
   RowRenderer,
   RowRendererId,
 } from '../../../../../../common';
-import { fireEvent, render } from '@testing-library/react';
+import { render } from '@testing-library/react';
 import { TestProviders } from '../../../../../../../timelines/public/mock';
 import { useDraggableKeyboardWrapper as mockUseDraggableKeyboardWrapper } from '../../../../../../../timelines/public/components';
 import { cloneDeep } from 'lodash';
@@ -92,9 +92,10 @@ describe('reasonColumnRenderer', () => {
       expect(plainColumnRenderer.renderColumn).toBeCalledTimes(1);
     });
 
-    it("doesn't call `plainColumnRenderer.renderColumn` when ecsData, rowRenderers or browserFields fields are not empty", () => {
+    it("doesn't call `plainColumnRenderer.renderColumn` in expanded value when ecsData, rowRenderers or browserFields fields are not empty", () => {
       reasonColumnRenderer.renderColumn({
         ...defaultProps,
+        isDetails: true,
         ecsData: invalidEcs,
         rowRenderers,
         browserFields,
@@ -103,50 +104,36 @@ describe('reasonColumnRenderer', () => {
       expect(plainColumnRenderer.renderColumn).toBeCalledTimes(0);
     });
 
-    it("doesn't render popover button when getRowRenderer doesn't find a rowRenderer", () => {
-      const renderedColumn = reasonColumnRenderer.renderColumn({
+    it('call `plainColumnRenderer.renderColumn` in cell value', () => {
+      reasonColumnRenderer.renderColumn({
         ...defaultProps,
+        isDetails: false,
         ecsData: invalidEcs,
         rowRenderers,
         browserFields,
       });
 
-      const wrapper = render(<TestProviders>{renderedColumn}</TestProviders>);
-
-      expect(wrapper.queryByTestId('reason-cell-button')).not.toBeInTheDocument();
-    });
-
-    it('render popover button when getRowRenderer finds a rowRenderer', () => {
-      const renderedColumn = reasonColumnRenderer.renderColumn({
-        ...defaultProps,
-        ecsData: validEcs,
-        rowRenderers,
-        browserFields,
-      });
-
-      const wrapper = render(<TestProviders>{renderedColumn}</TestProviders>);
-
-      expect(wrapper.queryByTestId('reason-cell-button')).toBeInTheDocument();
+      expect(plainColumnRenderer.renderColumn).toBeCalledTimes(1);
     });
 
-    it('render rowRender inside a popover when reson field button is clicked', () => {
+    it("doesn't render reason renderers button when getRowRenderer doesn't find a rowRenderer", () => {
       const renderedColumn = reasonColumnRenderer.renderColumn({
         ...defaultProps,
-        ecsData: validEcs,
+        isDetails: true,
+        ecsData: invalidEcs,
         rowRenderers,
         browserFields,
       });
 
       const wrapper = render(<TestProviders>{renderedColumn}</TestProviders>);
 
-      fireEvent.click(wrapper.getByTestId('reason-cell-button'));
-
-      expect(wrapper.queryByTestId('test-row-render')).toBeInTheDocument();
+      expect(wrapper.queryByTestId('reason-cell-button')).not.toBeInTheDocument();
     });
 
-    it('the popover always contains a class that hides it when an overlay (e.g. the inspect modal) is displayed', () => {
+    it('render reason renderers when getRowRenderer finds a rowRenderer', () => {
       const renderedColumn = reasonColumnRenderer.renderColumn({
         ...defaultProps,
+        isDetails: true,
         ecsData: validEcs,
         rowRenderers,
         browserFields,
@@ -154,11 +141,7 @@ describe('reasonColumnRenderer', () => {
 
       const wrapper = render(<TestProviders>{renderedColumn}</TestProviders>);
 
-      fireEvent.click(wrapper.getByTestId('reason-cell-button'));
-
-      expect(wrapper.getByRole('dialog')).toHaveClass(
-        'euiPanel euiPanel--paddingMedium euiPanel--borderRadiusMedium euiPanel--plain euiPanel--noShadow euiPopover__panel euiPopover__panel--right withHoverActions__popover'
-      );
+      expect(wrapper.queryByTestId('reason-cell-renderer')).toBeInTheDocument();
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/reason_column_renderer.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/reason_column_renderer.tsx
index 52483b4853cbc3..b3f145beb886b0 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/reason_column_renderer.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/reason_column_renderer.tsx
@@ -5,11 +5,10 @@
  * 2.0.
  */
 
-import { EuiButtonEmpty, EuiPopover, EuiPopoverTitle } from '@elastic/eui';
+import { EuiSpacer, EuiPanel } from '@elastic/eui';
 import { isEqual } from 'lodash/fp';
-import React, { useCallback, useMemo, useState } from 'react';
+import React, { useMemo } from 'react';
 
-import styled from 'styled-components';
 import { BrowserFields, ColumnHeaderOptions, RowRenderer } from '../../../../../../common';
 import { Ecs } from '../../../../../../common/ecs';
 import { eventRendererNames } from '../../../row_renderers_browser/catalog/constants';
@@ -23,58 +22,59 @@ export const reasonColumnRenderer: ColumnRenderer = {
   isInstance: isEqual(REASON_FIELD_NAME),
 
   renderColumn: ({
+    browserFields,
     columnName,
+    ecsData,
     eventId,
     field,
+    isDetails,
     isDraggable = true,
+    linkValues,
+    rowRenderers = [],
     timelineId,
     truncate,
     values,
-    linkValues,
-    ecsData,
-    rowRenderers = [],
-    browserFields,
   }: {
+    browserFields?: BrowserFields;
     columnName: string;
+    ecsData?: Ecs;
     eventId: string;
     field: ColumnHeaderOptions;
+    isDetails?: boolean;
     isDraggable?: boolean;
+    linkValues?: string[] | null | undefined;
+    rowRenderers?: RowRenderer[];
     timelineId: string;
     truncate?: boolean;
     values: string[] | undefined | null;
-    linkValues?: string[] | null | undefined;
-
-    ecsData?: Ecs;
-    rowRenderers?: RowRenderer[];
-    browserFields?: BrowserFields;
-  }) =>
-    values != null && ecsData && rowRenderers?.length > 0 && browserFields
-      ? values.map((value, i) => (
-          <ReasonCell
-            key={`reason-column-renderer-value-${timelineId}-${columnName}-${eventId}-${field.id}-${value}-${i}`}
-            timelineId={timelineId}
-            value={value}
-            ecsData={ecsData}
-            rowRenderers={rowRenderers}
-            browserFields={browserFields}
-          />
-        ))
-      : plainColumnRenderer.renderColumn({
-          columnName,
-          eventId,
-          field,
-          isDraggable,
-          timelineId,
-          truncate,
-          values,
-          linkValues,
-        }),
+  }) => {
+    if (isDetails && values && ecsData && rowRenderers && browserFields) {
+      return values.map((value, i) => (
+        <ReasonCell
+          browserFields={browserFields}
+          ecsData={ecsData}
+          key={`reason-column-renderer-value-${timelineId}-${columnName}-${eventId}-${field.id}-${value}-${i}`}
+          rowRenderers={rowRenderers}
+          timelineId={timelineId}
+          value={value}
+        />
+      ));
+    } else {
+      return plainColumnRenderer.renderColumn({
+        columnName,
+        eventId,
+        field,
+        isDetails,
+        isDraggable,
+        linkValues,
+        timelineId,
+        truncate,
+        values,
+      });
+    }
+  },
 };
 
-const StyledEuiButtonEmpty = styled(EuiButtonEmpty)`
-  font-weight: ${(props) => props.theme.eui.euiFontWeightRegular};
-`;
-
 const ReasonCell: React.FC<{
   value: string | number | undefined | null;
   timelineId: string;
@@ -82,8 +82,6 @@ const ReasonCell: React.FC<{
   rowRenderers: RowRenderer[];
   browserFields: BrowserFields;
 }> = ({ ecsData, rowRenderers, browserFields, timelineId, value }) => {
-  const [isOpen, setIsOpen] = useState(false);
-
   const rowRenderer = useMemo(() => getRowRenderer(ecsData, rowRenderers), [ecsData, rowRenderers]);
 
   const rowRender = useMemo(() => {
@@ -98,38 +96,17 @@ const ReasonCell: React.FC<{
     );
   }, [rowRenderer, browserFields, ecsData, timelineId]);
 
-  const handleTogglePopOver = useCallback(() => setIsOpen(!isOpen), [setIsOpen, isOpen]);
-  const handleClosePopOver = useCallback(() => setIsOpen(false), [setIsOpen]);
-
-  const button = useMemo(
-    () => (
-      <StyledEuiButtonEmpty
-        data-test-subj="reason-cell-button"
-        size="xs"
-        flush="left"
-        onClick={handleTogglePopOver}
-      >
-        {value}
-      </StyledEuiButtonEmpty>
-    ),
-    [value, handleTogglePopOver]
-  );
-
   return (
     <>
       {rowRenderer && rowRender ? (
-        <EuiPopover
-          isOpen={isOpen}
-          anchorPosition="rightCenter"
-          closePopover={handleClosePopOver}
-          panelClassName="withHoverActions__popover"
-          button={button}
-        >
-          <EuiPopoverTitle paddingSize="s">
-            {i18n.EVENT_RENDERER_POPOVER_TITLE(eventRendererNames[rowRenderer.id] ?? '')}
-          </EuiPopoverTitle>
-          {rowRender}
-        </EuiPopover>
+        <>
+          {value}
+          <h4>{i18n.REASON_RENDERER_TITLE(eventRendererNames[rowRenderer.id] ?? '')}</h4>
+          <EuiSpacer size="xs" />
+          <EuiPanel color="subdued" className="eui-xScroll" data-test-subj="reason-cell-renderer">
+            <div className="eui-displayInlineBlock">{rowRender}</div>
+          </EuiPanel>
+        </>
       ) : (
         value
       )}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/translations.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/translations.ts
index a703c7afdaf7bc..53cffa7d3708d0 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/translations.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/translations.ts
@@ -52,8 +52,8 @@ export const EMPTY_STATUS = i18n.translate(
   }
 );
 
-export const EVENT_RENDERER_POPOVER_TITLE = (eventRendererName: string) =>
-  i18n.translate('xpack.securitySolution.event.reason.eventRenderPopoverTitle', {
+export const REASON_RENDERER_TITLE = (eventRendererName: string) =>
+  i18n.translate('xpack.securitySolution.event.reason.reasonRendererTitle', {
     values: { eventRendererName },
     defaultMessage: 'Event renderer: {eventRendererName} ',
   });
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.test.tsx
index 5282276f8bb51e..ef8fa01a63465f 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.test.tsx
@@ -16,6 +16,8 @@ import { DroppableWrapper } from '../../../../common/components/drag_and_drop/dr
 import { mockBrowserFields } from '../../../../common/containers/source/mock';
 import { defaultHeaders, mockTimelineData, TestProviders } from '../../../../common/mock';
 import { DefaultCellRenderer } from './default_cell_renderer';
+import { BrowserFields } from '../../../../../../timelines/common/search_strategy';
+import { Ecs } from '../../../../../common/ecs';
 
 jest.mock('../../../../common/lib/kibana');
 
@@ -26,15 +28,16 @@ const mockImplementation = {
 };
 
 describe('DefaultCellRenderer', () => {
-  const columnId = 'signal.rule.risk_score';
+  const columnId = '@timestamp';
   const eventId = '_id-123';
-  const isDetails = true;
   const isExpandable = true;
   const isExpanded = true;
   const linkValues = ['foo', 'bar', '@baz'];
   const rowIndex = 3;
   const setCellProps = jest.fn();
   const timelineId = 'test';
+  const ecsData = {} as Ecs;
+  const browserFields = {} as BrowserFields;
 
   beforeEach(() => {
     jest.clearAllMocks();
@@ -44,14 +47,17 @@ describe('DefaultCellRenderer', () => {
   test('it invokes `getColumnRenderer` with the expected arguments', () => {
     const data = cloneDeep(mockTimelineData[0].data);
     const header = cloneDeep(defaultHeaders[0]);
+    const isDetails = true;
 
     mount(
       <TestProviders>
         <DragDropContextWrapper browserFields={mockBrowserFields}>
           <DroppableWrapper droppableId="testing">
             <DefaultCellRenderer
+              browserFields={browserFields}
               columnId={columnId}
               data={data}
+              ecsData={ecsData}
               eventId={eventId}
               header={header}
               isDetails={isDetails}
@@ -71,17 +77,21 @@ describe('DefaultCellRenderer', () => {
     expect(getColumnRenderer).toBeCalledWith(header.id, columnRenderers, data);
   });
 
-  test('it invokes `renderColumn` with the expected arguments', () => {
+  test('if in tgrid expanded value, it invokes `renderColumn` with the expected arguments', () => {
     const data = cloneDeep(mockTimelineData[0].data);
     const header = cloneDeep(defaultHeaders[0]);
+    const isDetails = true;
+    const truncate = isDetails ? false : true;
 
     mount(
       <TestProviders>
         <DragDropContextWrapper browserFields={mockBrowserFields}>
           <DroppableWrapper droppableId="testing">
             <DefaultCellRenderer
+              browserFields={browserFields}
               columnId={columnId}
               data={data}
+              ecsData={ecsData}
               eventId={eventId}
               header={header}
               isDetails={isDetails}
@@ -92,6 +102,7 @@ describe('DefaultCellRenderer', () => {
               rowIndex={rowIndex}
               setCellProps={setCellProps}
               timelineId={timelineId}
+              truncate={truncate}
             />
           </DroppableWrapper>
         </DragDropContextWrapper>
@@ -99,14 +110,54 @@ describe('DefaultCellRenderer', () => {
     );
 
     expect(mockImplementation.renderColumn).toBeCalledWith({
+      asPlainText: false,
+      browserFields,
       columnName: header.id,
+      ecsData,
       eventId,
       field: header,
+      isDetails,
       isDraggable: true,
       linkValues,
+      rowRenderers: undefined,
       timelineId,
-      truncate: true,
+      truncate,
       values: ['2018-11-05T19:03:25.937Z'],
     });
   });
+
+  test('if in tgrid expanded value, it renders ExpandedCellValueActions', () => {
+    const data = cloneDeep(mockTimelineData[0].data);
+    const header = cloneDeep(defaultHeaders[1]);
+    const isDetails = true;
+    const id = 'event.severity';
+    const wrapper = mount(
+      <TestProviders>
+        <DragDropContextWrapper browserFields={mockBrowserFields}>
+          <DroppableWrapper droppableId="testing">
+            <DefaultCellRenderer
+              browserFields={browserFields}
+              columnId={id}
+              ecsData={ecsData}
+              data={data}
+              eventId={eventId}
+              header={header}
+              isDetails={isDetails}
+              isDraggable={true}
+              isExpandable={isExpandable}
+              isExpanded={isExpanded}
+              linkValues={linkValues}
+              rowIndex={rowIndex}
+              setCellProps={setCellProps}
+              timelineId={timelineId}
+            />
+          </DroppableWrapper>
+        </DragDropContextWrapper>
+      </TestProviders>
+    );
+
+    expect(
+      wrapper.find('[data-test-subj="data-grid-expanded-cell-value-actions"]').exists()
+    ).toBeTruthy();
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.tsx
index d45c8103d1cca5..5b9fee621b4171 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.tsx
@@ -12,36 +12,70 @@ import { columnRenderers } from '../body/renderers';
 import { getColumnRenderer } from '../body/renderers/get_column_renderer';
 
 import { CellValueElementProps } from '.';
+import { getLink } from '../../../../common/lib/cell_actions/helpers';
+import {
+  ExpandedCellValueActions,
+  StyledContent,
+} from '../../../../common/lib/cell_actions/expanded_cell_value_actions';
+
+const FIELDS_WITHOUT_CELL_ACTIONS = ['@timestamp', 'signal.rule.risk_score', 'signal.reason'];
+const hasCellActions = (columnId?: string) => {
+  return columnId && FIELDS_WITHOUT_CELL_ACTIONS.indexOf(columnId) < 0;
+};
 
 export const DefaultCellRenderer: React.FC<CellValueElementProps> = ({
-  columnId,
+  browserFields,
   data,
+  ecsData,
   eventId,
+  globalFilters,
   header,
+  isDetails,
   isDraggable,
   linkValues,
+  rowRenderers,
   setCellProps,
   timelineId,
-  rowRenderers,
-  browserFields,
-  ecsData,
-}) => (
-  <>
-    {getColumnRenderer(header.id, columnRenderers, data).renderColumn({
-      columnName: header.id,
-      eventId,
-      field: header,
-      isDraggable,
-      linkValues,
-      timelineId,
-      truncate: true,
-      values: getMappedNonEcsValue({
-        data,
-        fieldName: header.id,
-      }),
-      rowRenderers,
-      browserFields,
-      ecsData,
-    })}
-  </>
-);
+  truncate,
+}) => {
+  const values = getMappedNonEcsValue({
+    data,
+    fieldName: header.id,
+  });
+  const styledContentClassName = isDetails
+    ? 'eui-textBreakWord'
+    : 'eui-displayInlineBlock eui-textTruncate';
+  return (
+    <>
+      <StyledContent className={styledContentClassName} $isDetails={isDetails}>
+        {getColumnRenderer(header.id, columnRenderers, data).renderColumn({
+          asPlainText: !!getLink(header.id, header.type), // we want to render value with links as plain text but keep other formatters like badge.
+          browserFields,
+          columnName: header.id,
+          ecsData,
+          eventId,
+          field: header,
+          isDetails,
+          isDraggable,
+          linkValues,
+          rowRenderers,
+          timelineId,
+          truncate,
+          values: getMappedNonEcsValue({
+            data,
+            fieldName: header.id,
+          }),
+        })}
+      </StyledContent>
+      {isDetails && browserFields && hasCellActions(header.id) && (
+        <ExpandedCellValueActions
+          browserFields={browserFields}
+          field={header.id}
+          globalFilters={globalFilters}
+          timelineId={timelineId}
+          value={values}
+        />
+      )}
+    </>
+  );
+};
diff --git a/x-pack/plugins/timelines/common/types/timeline/cells/index.ts b/x-pack/plugins/timelines/common/types/timeline/cells/index.ts
index 354a8b45e914d8..ce22d87c0a59a2 100644
--- a/x-pack/plugins/timelines/common/types/timeline/cells/index.ts
+++ b/x-pack/plugins/timelines/common/types/timeline/cells/index.ts
@@ -7,21 +7,26 @@
 
 import { EuiDataGridCellValueElementProps } from '@elastic/eui';
 import { RowRenderer } from '../../..';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { Filter } from '../../../../../../../src/plugins/data/public';
 import { Ecs } from '../../../ecs';
 import { BrowserFields, TimelineNonEcsData } from '../../../search_strategy';
 import { ColumnHeaderOptions } from '../columns';
 
 /** The following props are provided to the function called by `renderCellValue` */
 export type CellValueElementProps = EuiDataGridCellValueElementProps & {
+  asPlainText?: boolean;
+  browserFields?: BrowserFields;
   data: TimelineNonEcsData[];
+  ecsData?: Ecs;
   eventId: string; // _id
+  globalFilters?: Filter[];
   header: ColumnHeaderOptions;
   isDraggable: boolean;
   linkValues: string[] | undefined;
-  timelineId: string;
+  rowRenderers?: RowRenderer[];
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   setFlyoutAlert?: (data: any) => void;
-  ecsData?: Ecs;
-  rowRenderers?: RowRenderer[];
-  browserFields?: BrowserFields;
+  timelineId: string;
+  truncate?: boolean;
 };
diff --git a/x-pack/plugins/timelines/common/types/timeline/columns/index.tsx b/x-pack/plugins/timelines/common/types/timeline/columns/index.tsx
index 644b38d551337f..bd4cd2d7192df5 100644
--- a/x-pack/plugins/timelines/common/types/timeline/columns/index.tsx
+++ b/x-pack/plugins/timelines/common/types/timeline/columns/index.tsx
@@ -8,9 +8,10 @@
 import { ReactNode } from 'react';
 
 import { EuiDataGridColumn, EuiDataGridColumnCellActionProps } from '@elastic/eui';
-import { Filter, IFieldSubType } from '../../../../../../../src/plugins/data/common';
+import { IFieldSubType } from '../../../../../../../src/plugins/data/common';
 import { BrowserFields } from '../../../search_strategy/index_fields';
 import { TimelineNonEcsData } from '../../../search_strategy/timeline';
+import { Ecs } from '../../../ecs';
 
 export type ColumnHeaderType = 'not-filtered' | 'text-filter';
 
@@ -45,14 +46,16 @@ export type ColumnId = string;
 export type TGridCellAction = ({
   browserFields,
   data,
-  globalFilters,
+  ecsData,
+  header,
   pageSize,
   timelineId,
 }: {
   browserFields: BrowserFields;
   /** each row of data is represented as one TimelineNonEcsData[] */
   data: TimelineNonEcsData[][];
-  globalFilters?: Filter[];
+  ecsData: Ecs[];
+  header?: ColumnHeaderOptions;
   pageSize: number;
   timelineId: string;
 }) => (props: EuiDataGridColumnCellActionProps) => ReactNode;
diff --git a/x-pack/plugins/timelines/public/components/hover_actions/actions/filter_for_value.tsx b/x-pack/plugins/timelines/public/components/hover_actions/actions/filter_for_value.tsx
index 549c2da0d76720..7b8ecdb0f582fd 100644
--- a/x-pack/plugins/timelines/public/components/hover_actions/actions/filter_for_value.tsx
+++ b/x-pack/plugins/timelines/public/components/hover_actions/actions/filter_for_value.tsx
@@ -14,8 +14,8 @@ import { TooltipWithKeyboardShortcut } from '../../tooltip_with_keyboard_shortcu
 import { createFilter, getAdditionalScreenReaderOnlyContext } from '../utils';
 import { HoverActionComponentProps, FilterValueFnArgs } from './types';
 
-export const FILTER_FOR_VALUE = i18n.translate('xpack.timelines.hoverActions.filterForValue', {
-  defaultMessage: 'Filter for value',
+export const FILTER_FOR_VALUE = i18n.translate('xpack.timelines.hoverActions.filterIn', {
+  defaultMessage: 'Filter In',
 });
 export const FILTER_FOR_VALUE_KEYBOARD_SHORTCUT = 'f';
 
@@ -31,6 +31,7 @@ const FilterForValueButton: React.FC<FilterForValueProps> = React.memo(
     onFilterAdded,
     ownFocus,
     onClick,
+    size,
     showTooltip = false,
     value,
   }) => {
@@ -74,6 +75,7 @@ const FilterForValueButton: React.FC<FilterForValueProps> = React.memo(
             data-test-subj="filter-for-value"
             iconType="plusInCircle"
             onClick={filterForValueFn}
+            size={size}
             title={FILTER_FOR_VALUE}
           >
             {FILTER_FOR_VALUE}
@@ -87,9 +89,10 @@ const FilterForValueButton: React.FC<FilterForValueProps> = React.memo(
             iconSize="s"
             iconType="plusInCircle"
             onClick={filterForValueFn}
+            size={size}
           />
         ),
-      [Component, defaultFocusedButtonRef, filterForValueFn]
+      [Component, defaultFocusedButtonRef, filterForValueFn, size]
     );
 
     return showTooltip ? (
diff --git a/x-pack/plugins/timelines/public/components/hover_actions/actions/filter_out_value.tsx b/x-pack/plugins/timelines/public/components/hover_actions/actions/filter_out_value.tsx
index 51f2943ff051e4..04fbbab76d8501 100644
--- a/x-pack/plugins/timelines/public/components/hover_actions/actions/filter_out_value.tsx
+++ b/x-pack/plugins/timelines/public/components/hover_actions/actions/filter_out_value.tsx
@@ -14,8 +14,8 @@ import { TooltipWithKeyboardShortcut } from '../../tooltip_with_keyboard_shortcu
 import { createFilter, getAdditionalScreenReaderOnlyContext } from '../utils';
 import { HoverActionComponentProps, FilterValueFnArgs } from './types';
 
-export const FILTER_OUT_VALUE = i18n.translate('xpack.timelines.hoverActions.filterOutValue', {
-  defaultMessage: 'Filter out value',
+export const FILTER_OUT_VALUE = i18n.translate('xpack.timelines.hoverActions.filterOut', {
+  defaultMessage: 'Filter Out',
 });
 
 export const FILTER_OUT_VALUE_KEYBOARD_SHORTCUT = 'o';
@@ -30,6 +30,7 @@ const FilterOutValueButton: React.FC<HoverActionComponentProps & FilterValueFnAr
     onFilterAdded,
     ownFocus,
     onClick,
+    size,
     showTooltip = false,
     value,
   }) => {
@@ -74,6 +75,7 @@ const FilterOutValueButton: React.FC<HoverActionComponentProps & FilterValueFnAr
             data-test-subj="filter-out-value"
             iconType="minusInCircle"
             onClick={filterOutValueFn}
+            size={size}
             title={FILTER_OUT_VALUE}
           >
             {FILTER_OUT_VALUE}
@@ -87,9 +89,10 @@ const FilterOutValueButton: React.FC<HoverActionComponentProps & FilterValueFnAr
             iconSize="s"
             iconType="minusInCircle"
             onClick={filterOutValueFn}
+            size={size}
           />
         ),
-      [Component, defaultFocusedButtonRef, filterOutValueFn]
+      [Component, defaultFocusedButtonRef, filterOutValueFn, size]
     );
 
     return showTooltip ? (
diff --git a/x-pack/plugins/timelines/public/components/hover_actions/actions/types.ts b/x-pack/plugins/timelines/public/components/hover_actions/actions/types.ts
index 5be8fd8904f1af..b6c9e794625e4d 100644
--- a/x-pack/plugins/timelines/public/components/hover_actions/actions/types.ts
+++ b/x-pack/plugins/timelines/public/components/hover_actions/actions/types.ts
@@ -18,11 +18,13 @@ export interface FilterValueFnArgs {
 }
 
 export interface HoverActionComponentProps {
+  className?: string;
   defaultFocusedButtonRef?: EuiButtonIconPropsForButton['buttonRef'];
   field: string;
   keyboardEvent?: React.KeyboardEvent;
   ownFocus: boolean;
   onClick?: () => void;
+  size?: 'xs' | 's' | 'm';
   showTooltip?: boolean;
   value?: string[] | string | null;
 }
diff --git a/x-pack/plugins/timelines/public/components/t_grid/body/index.test.tsx b/x-pack/plugins/timelines/public/components/t_grid/body/index.test.tsx
index 8fbb7f0e62b9ca..50764af3c7f2fc 100644
--- a/x-pack/plugins/timelines/public/components/t_grid/body/index.test.tsx
+++ b/x-pack/plugins/timelines/public/components/t_grid/body/index.test.tsx
@@ -15,6 +15,8 @@ import { defaultHeaders, mockBrowserFields, mockTimelineData, TestProviders } fr
 import { TimelineTabs } from '../../../../common/types/timeline';
 import { TestCellRenderer } from '../../../mock/cell_renderer';
 import { mockGlobalState } from '../../../mock/global_state';
+import { EuiDataGridColumn } from '@elastic/eui';
+import { defaultColumnHeaderType } from '../../../store/t_grid/defaults';
 
 const mockSort: Sort[] = [
   {
@@ -151,5 +153,124 @@ describe('Body', () => {
           .text()
       ).toEqual(mockTimelineData[0].ecs.timestamp);
     });
+
+    test("timestamp column doesn't render cell actions", () => {
+      const headersJustTimestamp = defaultHeaders.filter((h) => h.id === '@timestamp');
+      const testProps = {
+        ...props,
+        columnHeaders: headersJustTimestamp,
+        data: mockTimelineData.slice(0, 1),
+      };
+      const wrapper = mount(
+        <TestProviders>
+          <BodyComponent {...testProps} />
+        </TestProviders>
+      );
+      wrapper.update();
+
+      expect(
+        wrapper
+          .find('[data-test-subj="body-data-grid"]')
+          .first()
+          .prop<EuiDataGridColumn[]>('columns')
+          .find((c) => c.id === '@timestamp')?.cellActions
+      ).toBeUndefined();
+    });
+
+    test("signal.rule.risk_score column doesn't render cell actions", () => {
+      const columnHeaders = [
+        {
+          category: 'signal',
+          columnHeaderType: defaultColumnHeaderType,
+          id: 'signal.rule.risk_score',
+          type: 'number',
+          aggregatable: true,
+          initialWidth: 105,
+        },
+      ];
+      const testProps = {
+        ...props,
+        columnHeaders,
+        data: mockTimelineData.slice(0, 1),
+      };
+      const wrapper = mount(
+        <TestProviders>
+          <BodyComponent {...testProps} />
+        </TestProviders>
+      );
+      wrapper.update();
+
+      expect(
+        wrapper
+          .find('[data-test-subj="body-data-grid"]')
+          .first()
+          .prop<EuiDataGridColumn[]>('columns')
+          .find((c) => c.id === 'signal.rule.risk_score')?.cellActions
+      ).toBeUndefined();
+    });
+
+    test("signal.reason column doesn't render cell actions", () => {
+      const columnHeaders = [
+        {
+          category: 'signal',
+          columnHeaderType: defaultColumnHeaderType,
+          id: 'signal.reason',
+          type: 'string',
+          aggregatable: true,
+          initialWidth: 450,
+        },
+      ];
+      const testProps = {
+        ...props,
+        columnHeaders,
+        data: mockTimelineData.slice(0, 1),
+      };
+      const wrapper = mount(
+        <TestProviders>
+          <BodyComponent {...testProps} />
+        </TestProviders>
+      );
+      wrapper.update();
+
+      expect(
+        wrapper
+          .find('[data-test-subj="body-data-grid"]')
+          .first()
+          .prop<EuiDataGridColumn[]>('columns')
+          .find((c) => c.id === 'signal.reason')?.cellActions
+      ).toBeUndefined();
+    });
+  });
+
+  test("signal.rule.risk_score column doesn't render cell actions", () => {
+    const columnHeaders = [
+      {
+        category: 'signal',
+        columnHeaderType: defaultColumnHeaderType,
+        id: 'signal.rule.risk_score',
+        type: 'number',
+        aggregatable: true,
+        initialWidth: 105,
+      },
+    ];
+    const testProps = {
+      ...props,
+      columnHeaders,
+      data: mockTimelineData.slice(0, 1),
+    };
+    const wrapper = mount(
+      <TestProviders>
+        <BodyComponent {...testProps} />
+      </TestProviders>
+    );
+    wrapper.update();
+
+    expect(
+      wrapper
+        .find('[data-test-subj="body-data-grid"]')
+        .first()
+        .prop<EuiDataGridColumn[]>('columns')
+        .find((c) => c.id === 'signal.rule.risk_score')?.cellActions
+    ).toBeUndefined();
   });
 });
diff --git a/x-pack/plugins/timelines/public/components/t_grid/body/index.tsx b/x-pack/plugins/timelines/public/components/t_grid/body/index.tsx
index 83079e0cdc2fea..619571a0c8e81e 100644
--- a/x-pack/plugins/timelines/public/components/t_grid/body/index.tsx
+++ b/x-pack/plugins/timelines/public/components/t_grid/body/index.tsx
@@ -145,6 +145,9 @@ const EuiDataGridContainer = styled.div<{ hideLastPage: boolean }>`
   }
 `;
 
+const FIELDS_WITHOUT_CELL_ACTIONS = ['@timestamp', 'signal.rule.risk_score', 'signal.reason'];
+const hasCellActions = (columnId?: string) =>
+  columnId && FIELDS_WITHOUT_CELL_ACTIONS.indexOf(columnId) < 0;
 const transformControlColumns = ({
   actionColumnsWidth,
   columnHeaders,
@@ -636,7 +639,6 @@ export const BodyComponent = React.memo<StatefulBodyProps>(
       setEventsDeleted,
       hasAlertsCrudPermissions,
     ]);
-
     const columnsWithCellActions: EuiDataGridColumn[] = useMemo(
       () =>
         columnHeaders.map((header) => {
@@ -644,18 +646,24 @@ export const BodyComponent = React.memo<StatefulBodyProps>(
             tGridCellAction({
               browserFields,
               data: data.map((row) => row.data),
-              globalFilters: filters,
+              ecsData: data.map((row) => row.ecs),
+              header: columnHeaders.find((h) => h.id === header.id),
               pageSize,
               timelineId: id,
             });
 
           return {
             ...header,
-            cellActions:
-              header.tGridCellActions?.map(buildAction) ?? defaultCellActions?.map(buildAction),
+            ...(hasCellActions(header.id)
+              ? {
+                  cellActions:
+                    header.tGridCellActions?.map(buildAction) ??
+                    defaultCellActions?.map(buildAction),
+                }
+              : {}),
           };
         }),
-      [browserFields, columnHeaders, data, defaultCellActions, id, pageSize, filters]
+      [columnHeaders, defaultCellActions, browserFields, data, pageSize, id]
     );
 
     const renderTGridCellValue = useMemo(() => {
@@ -663,9 +671,9 @@ export const BodyComponent = React.memo<StatefulBodyProps>(
         columnId,
         rowIndex,
         setCellProps,
+        isDetails,
       }): React.ReactElement | null => {
         const pageRowIndex = getPageRowIndex(rowIndex, pageSize);
-
         const rowData = pageRowIndex < data.length ? data[pageRowIndex].data : null;
         const header = columnHeaders.find((h) => h.id === columnId);
         const eventId = pageRowIndex < data.length ? data[pageRowIndex]._id : null;
@@ -687,34 +695,36 @@ export const BodyComponent = React.memo<StatefulBodyProps>(
         }
 
         return renderCellValue({
+          browserFields,
           columnId: header.id,
-          eventId,
           data: rowData,
+          ecsData: ecs,
+          eventId,
+          globalFilters: filters,
           header,
+          isDetails,
           isDraggable: false,
           isExpandable: true,
           isExpanded: false,
-          isDetails: false,
           linkValues: getOr([], header.linkField ?? '', ecs),
           rowIndex,
-          setCellProps,
-          timelineId: tabType != null ? `${id}-${tabType}` : id,
-          ecsData: ecs,
-          browserFields,
           rowRenderers,
+          setCellProps,
+          timelineId: id,
+          truncate: isDetails ? false : true,
         }) as React.ReactElement;
       };
       return Cell;
     }, [
+      browserFields,
       columnHeaders,
       data,
+      filters,
       id,
+      pageSize,
       renderCellValue,
-      tabType,
-      theme,
-      browserFields,
       rowRenderers,
-      pageSize,
+      theme,
     ]);
 
     const onChangeItemsPerPage = useCallback(
diff --git a/x-pack/plugins/timelines/public/components/t_grid/event_rendered_view/index.tsx b/x-pack/plugins/timelines/public/components/t_grid/event_rendered_view/index.tsx
index 6f69c54233858b..91bb6ad1dac0b8 100644
--- a/x-pack/plugins/timelines/public/components/t_grid/event_rendered_view/index.tsx
+++ b/x-pack/plugins/timelines/public/components/t_grid/event_rendered_view/index.tsx
@@ -180,19 +180,21 @@ const EventRenderedViewComponent = ({
             rowRenderer.isInstance(ecsData)
           );
           return (
-            <EuiFlexGroup gutterSize="none" direction="column">
+            <EuiFlexGroup gutterSize="none" direction="column" className="eui-fullWidth">
               {reason && <EuiFlexItem>{reason}</EuiFlexItem>}
               {rowRenderersValid.length > 0 &&
                 rowRenderersValid.map((rowRenderer) => (
                   <>
                     <EuiHorizontalRule size="half" margin="xs" />
-                    <EventRenderedFlexItem>
-                      {rowRenderer.renderRow({
-                        browserFields,
-                        data: ecsData,
-                        isDraggable: false,
-                        timelineId: 'NONE',
-                      })}
+                    <EventRenderedFlexItem className="eui-xScroll">
+                      <div className="eui-displayInlineBlock">
+                        {rowRenderer.renderRow({
+                          browserFields,
+                          data: ecsData,
+                          isDraggable: false,
+                          timelineId: 'NONE',
+                        })}
+                      </div>
                     </EventRenderedFlexItem>
                   </>
                 ))}
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 482a493865a478..9652e016f73a5e 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -22164,7 +22164,6 @@
     "xpack.securitySolution.enpdoint.resolver.panelutils.invaliddate": "無効な日付",
     "xpack.securitySolution.enpdoint.resolver.panelutils.noTimestampRetrieved": "タイムスタンプが取得されていません",
     "xpack.securitySolution.event.module.linkToElasticEndpointSecurityDescription": "Endpoint Securityで開く",
-    "xpack.securitySolution.event.reason.eventRenderPopoverTitle": "イベントレンダラー：{eventRendererName} ",
     "xpack.securitySolution.eventDetails.blank": " ",
     "xpack.securitySolution.eventDetails.copyToClipboard": "クリップボードにコピー",
     "xpack.securitySolution.eventDetails.copyToClipboardTooltip": "クリップボードにコピー",
@@ -24427,8 +24426,6 @@
     "xpack.timelines.hoverActions.addToTimeline.addedFieldMessage": "{fieldOrValue}をタイムラインに追加しました",
     "xpack.timelines.hoverActions.columnToggleLabel": "表の{field}列を切り替える",
     "xpack.timelines.hoverActions.fieldLabel": "フィールド",
-    "xpack.timelines.hoverActions.filterForValue": "値でフィルター",
-    "xpack.timelines.hoverActions.filterOutValue": "値を除外",
     "xpack.timelines.hoverActions.moreActions": "さらにアクションを表示",
     "xpack.timelines.hoverActions.nestedColumnToggleLabel": "{field}フィールドはオブジェクトであり、列として追加できるネストされたフィールドに分解されます",
     "xpack.timelines.hoverActions.tooltipWithKeyboardShortcut.pressTooltipLabel": "プレス",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 2322f6213149ff..404ef9ad673b72 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -22512,7 +22512,6 @@
     "xpack.securitySolution.enpdoint.resolver.panelutils.invaliddate": "日期无效",
     "xpack.securitySolution.enpdoint.resolver.panelutils.noTimestampRetrieved": "未检索时间戳",
     "xpack.securitySolution.event.module.linkToElasticEndpointSecurityDescription": "在 Endpoint Security 中打开",
-    "xpack.securitySolution.event.reason.eventRenderPopoverTitle": "事件渲染器：{eventRendererName} ",
     "xpack.securitySolution.eventDetails.blank": " ",
     "xpack.securitySolution.eventDetails.copyToClipboard": "复制到剪贴板",
     "xpack.securitySolution.eventDetails.copyToClipboardTooltip": "复制到剪贴板",
@@ -24840,8 +24839,6 @@
     "xpack.timelines.hoverActions.addToTimeline.addedFieldMessage": "已将 {fieldOrValue} 添加到时间线",
     "xpack.timelines.hoverActions.columnToggleLabel": "在表中切换 {field} 列",
     "xpack.timelines.hoverActions.fieldLabel": "字段",
-    "xpack.timelines.hoverActions.filterForValue": "筛留值",
-    "xpack.timelines.hoverActions.filterOutValue": "筛除值",
     "xpack.timelines.hoverActions.moreActions": "更多操作",
     "xpack.timelines.hoverActions.nestedColumnToggleLabel": "{field} 字段是对象，并分解为可以添加为列的嵌套字段",
     "xpack.timelines.hoverActions.tooltipWithKeyboardShortcut.pressTooltipLabel": "按",

From 864e6f1a74f7594b545b5a53ccbb9d8407b67c84 Mon Sep 17 00:00:00 2001
From: Clint Andrew Hall <clint.hall@elastic.co>
Date: Thu, 14 Oct 2021 09:18:01 -0500
Subject: [PATCH 57/71] [fleet] Adjust unified integration view to have better
 UI controls (#114692)

* [fleet] Adjust Package Cards to horizontal layout

* Fix responsive shifting

* Addressing feedback

* cleanup layout for integrations view

* i18n

* Fix type errors

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Dave Snider <dave.snider@gmail.com>
Co-authored-by: Josh Dover <1813008+joshdover@users.noreply.github.com>
---
 src/core/public/rendering/_base.scss          |   6 +
 .../integrations/layouts/default.tsx          |  57 +------
 .../epm/components/package_card.stories.tsx   |   2 +-
 .../sections/epm/components/package_card.tsx  |  34 +++--
 .../epm/components/package_list_grid.tsx      | 142 ++++++++++--------
 .../epm/screens/home/available_packages.tsx   |  38 +++--
 .../epm/screens/home/category_facets.tsx      |   2 +-
 .../fleet/public/components/package_icon.tsx  |   4 +-
 .../translations/translations/ja-JP.json      |   4 -
 .../translations/translations/zh-CN.json      |   4 -
 10 files changed, 132 insertions(+), 161 deletions(-)

diff --git a/src/core/public/rendering/_base.scss b/src/core/public/rendering/_base.scss
index 18e564abf822f8..32a297a4066d9c 100644
--- a/src/core/public/rendering/_base.scss
+++ b/src/core/public/rendering/_base.scss
@@ -42,6 +42,12 @@
   #app-fixed-viewport {
     top: $headerHeight;
   }
+
+  .kbnStickyMenu {
+    position: sticky;
+    max-height: calc(100vh - #{$headerHeight + $euiSize});
+    top: $headerHeight + $euiSize;
+  }
 }
 
 .kbnBody {
diff --git a/x-pack/plugins/fleet/public/applications/integrations/layouts/default.tsx b/x-pack/plugins/fleet/public/applications/integrations/layouts/default.tsx
index 8ced172e696aab..0c46e1af301cf6 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/layouts/default.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/layouts/default.tsx
@@ -5,20 +5,12 @@
  * 2.0.
  */
 import React, { memo } from 'react';
-import { EuiFlexGroup, EuiFlexItem, EuiImage, EuiSpacer, EuiText, EuiLink } from '@elastic/eui';
+import { EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiText } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 
-import { i18n } from '@kbn/i18n';
-
-import styled, { useTheme } from 'styled-components';
-
-import type { EuiTheme } from 'src/plugins/kibana_react/common';
-
 import { useLink } from '../../../hooks';
 import type { Section } from '../sections';
 
-import { useLinks, useStartServices } from '../hooks';
-
 import { WithHeaderLayout } from './';
 
 interface Props {
@@ -26,45 +18,11 @@ interface Props {
   children?: React.ReactNode;
 }
 
-const Illustration = styled(EuiImage)`
-  margin-bottom: -77px;
-  position: relative;
-  top: -16px;
-  width: 395px;
-`;
-
-const Hero = styled.div`
-  text-align: right;
-`;
-
-const HeroImage = memo(() => {
-  const { toSharedAssets } = useLinks();
-  const theme = useTheme() as EuiTheme;
-  const IS_DARK_THEME = theme.darkMode;
-
-  return (
-    <Hero>
-      <Illustration
-        alt={i18n.translate('xpack.fleet.epm.illustrationAltText', {
-          defaultMessage: 'Illustration of an integration',
-        })}
-        url={
-          IS_DARK_THEME
-            ? toSharedAssets('illustration_integrations_darkmode.svg')
-            : toSharedAssets('illustration_integrations_lightmode.svg')
-        }
-      />
-    </Hero>
-  );
-});
-
 export const DefaultLayout: React.FunctionComponent<Props> = memo(({ section, children }) => {
   const { getHref } = useLink();
-  const { docLinks } = useStartServices();
 
   return (
     <WithHeaderLayout
-      rightColumn={<HeroImage />}
       leftColumn={
         <EuiFlexGroup direction="column" gutterSize="none" justifyContent="center">
           <EuiText>
@@ -79,20 +37,11 @@ export const DefaultLayout: React.FunctionComponent<Props> = memo(({ section, ch
           <EuiSpacer size="s" />
 
           <EuiFlexItem grow={false}>
-            <EuiText size="m" color="subdued">
+            <EuiText size="s" color="subdued">
               <p>
                 <FormattedMessage
                   id="xpack.fleet.epm.pageSubtitle"
-                  defaultMessage="Collect data from popular applications and services.  To learn more about Integrations, view {link}"
-                  values={{
-                    link: (
-                      <EuiLink target="_blank" href={docLinks.links.elasticStackGetStarted}>
-                        {i18n.translate('xpack.fleet.epm.pageSubtitleLinkText', {
-                          defaultMessage: 'Getting started with Elastic Stack',
-                        })}
-                      </EuiLink>
-                    ),
-                  }}
+                  defaultMessage="Choose an integration to start collecting and analyzing your data"
                 />
               </p>
             </EuiText>
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_card.stories.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_card.stories.tsx
index 94370587ddec82..86bac94bc50cd5 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_card.stories.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_card.stories.tsx
@@ -22,7 +22,7 @@ export default {
 type Args = Omit<PackageCardProps, 'status'> & { width: number };
 
 const args: Args = {
-  width: 250,
+  width: 280,
   title: 'Title',
   description: 'Description',
   name: 'beats',
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_card.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_card.tsx
index a68499dbd8dd04..091eb4c97183de 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_card.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_card.tsx
@@ -7,7 +7,7 @@
 
 import React from 'react';
 import styled from 'styled-components';
-import { EuiCard } from '@elastic/eui';
+import { EuiCard, EuiFlexItem, EuiBadge, EuiToolTip, EuiSpacer } from '@elastic/eui';
 
 import { CardIcon } from '../../../../../components/package_icon';
 import type { IntegrationCardItem } from '../../../../../../common/types/models/epm';
@@ -16,10 +16,10 @@ import { RELEASE_BADGE_DESCRIPTION, RELEASE_BADGE_LABEL } from './release_badge'
 
 export type PackageCardProps = IntegrationCardItem;
 
-// adding the `href` causes EuiCard to use a `a` instead of a `button`
-// `a` tags use `euiLinkColor` which results in blueish Badge text
+// Min-height is roughly 3 lines of content.
+// This keeps the cards from looking overly unbalanced because of content differences.
 const Card = styled(EuiCard)`
-  color: inherit;
+  min-height: 127px;
 `;
 
 export function PackageCard({
@@ -32,14 +32,28 @@ export function PackageCard({
   url,
   release,
 }: PackageCardProps) {
-  const betaBadgeLabel = release && release !== 'ga' ? RELEASE_BADGE_LABEL[release] : undefined;
-  const betaBadgeLabelTooltipContent =
-    release && release !== 'ga' ? RELEASE_BADGE_DESCRIPTION[release] : undefined;
+  let releaseBadge: React.ReactNode | null = null;
+
+  if (release && release !== 'ga') {
+    releaseBadge = (
+      <EuiFlexItem grow={false}>
+        <EuiSpacer size="xs" />
+        <span>
+          <EuiToolTip display="inlineBlock" content={RELEASE_BADGE_DESCRIPTION[release]}>
+            <EuiBadge color="hollow">{RELEASE_BADGE_LABEL[release]}</EuiBadge>
+          </EuiToolTip>
+        </span>
+      </EuiFlexItem>
+    );
+  }
 
   return (
     <Card
+      layout="horizontal"
       title={title || ''}
+      titleSize="xs"
       description={description}
+      hasBorder
       icon={
         <CardIcon
           icons={icons}
@@ -50,9 +64,9 @@ export function PackageCard({
         />
       }
       href={url}
-      betaBadgeLabel={betaBadgeLabel}
-      betaBadgeTooltipContent={betaBadgeLabelTooltipContent}
       target={url.startsWith('http') || url.startsWith('https') ? '_blank' : undefined}
-    />
+    >
+      {releaseBadge}
+    </Card>
   );
 }
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_list_grid.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_list_grid.tsx
index 2a4cb84f1e6ce1..00adb2a7b4ffba 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_list_grid.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_list_grid.tsx
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
-import type { ReactNode } from 'react';
-import React, { Fragment, useCallback, useState } from 'react';
+import type { ReactNode, FunctionComponent } from 'react';
+import React, { useCallback, useState, useRef, useEffect } from 'react';
 import {
   EuiFlexGrid,
   EuiFlexGroup,
@@ -20,7 +20,6 @@ import {
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 
-import { useStartServices } from '../../../../../hooks';
 import { Loading } from '../../../components';
 import { useLocalSearch, searchIdField } from '../../../hooks';
 
@@ -31,7 +30,7 @@ import { PackageCard } from './package_card';
 export interface Props {
   isLoading?: boolean;
   controls?: ReactNode | ReactNode[];
-  title: string;
+  title?: string;
   list: IntegrationCardItem[];
   initialSearch?: string;
   setSelectedCategory: (category: string) => void;
@@ -40,7 +39,7 @@ export interface Props {
   callout?: JSX.Element | null;
 }
 
-export function PackageListGrid({
+export const PackageListGrid: FunctionComponent<Props> = ({
   isLoading,
   controls,
   title,
@@ -50,9 +49,23 @@ export function PackageListGrid({
   setSelectedCategory,
   showMissingIntegrationMessage = false,
   callout,
-}: Props) {
+}) => {
   const [searchTerm, setSearchTerm] = useState(initialSearch || '');
   const localSearchRef = useLocalSearch(list);
+  const menuRef = useRef<HTMLDivElement>(null);
+  const [isSticky, setIsSticky] = useState(false);
+  const [windowScrollY] = useState(window.scrollY);
+
+  useEffect(() => {
+    const menuRefCurrent = menuRef.current;
+    const onScroll = () => {
+      if (menuRefCurrent) {
+        setIsSticky(menuRefCurrent?.getBoundingClientRect().top < 110);
+      }
+    };
+    window.addEventListener('scroll', onScroll);
+    return () => window.removeEventListener('scroll', onScroll);
+  }, [windowScrollY, isSticky]);
 
   const onQueryChange = ({
     queryText: userInput,
@@ -71,7 +84,7 @@ export function PackageListGrid({
     setSearchTerm('');
   };
 
-  const controlsContent = <ControlsColumn title={title} controls={controls} />;
+  const controlsContent = <ControlsColumn title={title} controls={controls} sticky={isSticky} />;
   let gridContent: JSX.Element;
 
   if (isLoading || !localSearchRef.current) {
@@ -93,58 +106,68 @@ export function PackageListGrid({
   }
 
   return (
-    <EuiFlexGroup alignItems="flexStart">
-      <EuiFlexItem grow={1}>{controlsContent}</EuiFlexItem>
-      <EuiFlexItem grow={3}>
-        <EuiSearchBar
-          query={searchTerm || undefined}
-          box={{
-            placeholder: i18n.translate('xpack.fleet.epmList.searchPackagesPlaceholder', {
-              defaultMessage: 'Search for integrations',
-            }),
-            incremental: true,
-          }}
-          onChange={onQueryChange}
-        />
-        {callout ? (
-          <>
-            <EuiSpacer />
-            {callout}
-          </>
-        ) : null}
-        <EuiSpacer />
-        {gridContent}
-        {showMissingIntegrationMessage && (
-          <>
-            <EuiSpacer size="xxl" />
-            <MissingIntegrationContent
-              resetQuery={resetQuery}
-              setSelectedCategory={setSelectedCategory}
-            />
-          </>
-        )}
-      </EuiFlexItem>
-    </EuiFlexGroup>
+    <div ref={menuRef}>
+      <EuiFlexGroup alignItems="flexStart" gutterSize="xl">
+        <EuiFlexItem grow={1} className={isSticky ? 'kbnStickyMenu' : ''}>
+          {controlsContent}
+        </EuiFlexItem>
+        <EuiFlexItem grow={5}>
+          <EuiSearchBar
+            query={searchTerm || undefined}
+            box={{
+              placeholder: i18n.translate('xpack.fleet.epmList.searchPackagesPlaceholder', {
+                defaultMessage: 'Search for integrations',
+              }),
+              incremental: true,
+            }}
+            onChange={onQueryChange}
+          />
+          {callout ? (
+            <>
+              <EuiSpacer />
+              {callout}
+            </>
+          ) : null}
+          <EuiSpacer />
+          {gridContent}
+          {showMissingIntegrationMessage && (
+            <>
+              <EuiSpacer />
+              <MissingIntegrationContent
+                resetQuery={resetQuery}
+                setSelectedCategory={setSelectedCategory}
+              />
+            </>
+          )}
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    </div>
   );
-}
+};
 
 interface ControlsColumnProps {
   controls: ReactNode;
-  title: string;
+  title: string | undefined;
+  sticky: boolean;
 }
 
-function ControlsColumn({ controls, title }: ControlsColumnProps) {
+function ControlsColumn({ controls, title, sticky }: ControlsColumnProps) {
+  let titleContent;
+  if (title) {
+    titleContent = (
+      <>
+        <EuiTitle size="s">
+          <h2>{title}</h2>
+        </EuiTitle>
+        <EuiSpacer size="l" />
+      </>
+    );
+  }
   return (
-    <Fragment>
-      <EuiTitle size="s">
-        <h2>{title}</h2>
-      </EuiTitle>
-      <EuiSpacer size="l" />
-      <EuiFlexGroup>
-        <EuiFlexItem grow={4}>{controls}</EuiFlexItem>
-        <EuiFlexItem grow={1} />
-      </EuiFlexGroup>
-    </Fragment>
+    <EuiFlexGroup direction="column" className={sticky ? 'kbnStickyMenu' : ''} gutterSize="none">
+      {titleContent}
+      {controls}
+    </EuiFlexGroup>
   );
 }
 
@@ -196,20 +219,17 @@ function MissingIntegrationContent({
   resetQuery,
   setSelectedCategory,
 }: MissingIntegrationContentProps) {
-  const {
-    application: { getUrlForApp },
-  } = useStartServices();
   const handleCustomInputsLinkClick = useCallback(() => {
     resetQuery();
     setSelectedCategory('custom');
   }, [resetQuery, setSelectedCategory]);
 
   return (
-    <EuiText>
+    <EuiText size="s" color="subdued">
       <p>
         <FormattedMessage
           id="xpack.fleet.integrations.missing"
-          defaultMessage="Don't see an integration? Collect any logs or metrics using our {customInputsLink}, or add data using {beatsTutorialLink}. Request new integrations using our {discussForumLink}."
+          defaultMessage="Don't see an integration? Collect any logs or metrics using our {customInputsLink}. Request new integrations using our {discussForumLink}."
           values={{
             customInputsLink: (
               <EuiLink onClick={handleCustomInputsLinkClick}>
@@ -227,14 +247,6 @@ function MissingIntegrationContent({
                 />
               </EuiLink>
             ),
-            beatsTutorialLink: (
-              <EuiLink href={getUrlForApp('home', { path: '#/tutorial_directory' })}>
-                <FormattedMessage
-                  id="xpack.fleet.integrations.beatsModulesLink"
-                  defaultMessage="Beats modules"
-                />
-              </EuiLink>
-            ),
           }}
         />
       </p>
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/available_packages.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/available_packages.tsx
index 40f89346c25bf3..91b557d0db5b67 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/available_packages.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/available_packages.tsx
@@ -7,9 +7,8 @@
 
 import React, { memo, useMemo, useState } from 'react';
 import { useLocation, useHistory, useParams } from 'react-router-dom';
-import { i18n } from '@kbn/i18n';
 import _ from 'lodash';
-import { EuiHorizontalRule } from '@elastic/eui';
+import { EuiHorizontalRule, EuiFlexItem } from '@elastic/eui';
 
 import { pagePathGetters } from '../../../../constants';
 import {
@@ -93,10 +92,6 @@ const packageListToIntegrationsList = (packages: PackageList): PackageList => {
   }, []);
 };
 
-const title = i18n.translate('xpack.fleet.epmList.allTitle', {
-  defaultMessage: 'Browse by category',
-});
-
 // TODO: clintandrewhall - this component is hard to test due to the hooks, particularly those that use `http`
 // or `location` to load data.  Ideally, we'll split this into "connected" and "pure" components.
 export const AvailablePackages: React.FC = memo(() => {
@@ -121,9 +116,7 @@ export const AvailablePackages: React.FC = memo(() => {
 
   function setSearchTerm(search: string) {
     // Use .replace so the browser's back button is not tied to single keystroke
-    history.replace(
-      pagePathGetters.integrations_all({ category: selectedCategory, searchTerm: search })[1]
-    );
+    history.replace(pagePathGetters.integrations_all({ searchTerm: search })[1]);
   }
 
   const { data: eprPackages, isLoading: isLoadingAllPackages } = useGetPackages({
@@ -186,20 +179,26 @@ export const AvailablePackages: React.FC = memo(() => {
   }
 
   let controls = [
-    <EuiHorizontalRule />,
-    <IntegrationPreference initialType={preference} onChange={setPreference} />,
+    <EuiFlexItem grow={false}>
+      <EuiHorizontalRule margin="m" />
+      <IntegrationPreference initialType={preference} onChange={setPreference} />,
+    </EuiFlexItem>,
   ];
 
   if (categories) {
     controls = [
-      <CategoryFacets
-        isLoading={isLoadingCategories || isLoadingAllPackages || isLoadingAppendCustomIntegrations}
-        categories={categories}
-        selectedCategory={selectedCategory}
-        onCategoryChange={({ id }) => {
-          setSelectedCategory(id);
-        }}
-      />,
+      <EuiFlexItem className="eui-yScrollWithShadows">
+        <CategoryFacets
+          isLoading={
+            isLoadingCategories || isLoadingAllPackages || isLoadingAppendCustomIntegrations
+          }
+          categories={categories}
+          selectedCategory={selectedCategory}
+          onCategoryChange={({ id }) => {
+            setSelectedCategory(id);
+          }}
+        />
+      </EuiFlexItem>,
       ...controls,
     ];
   }
@@ -214,7 +213,6 @@ export const AvailablePackages: React.FC = memo(() => {
   return (
     <PackageListGrid
       isLoading={isLoadingAllPackages}
-      title={title}
       controls={controls}
       initialSearch={searchParam}
       list={filteredCards}
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/category_facets.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/category_facets.tsx
index 9407e243c7ab58..0b17d17e19343f 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/category_facets.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/category_facets.tsx
@@ -21,7 +21,7 @@ export interface CategoryFacet {
 export const ALL_CATEGORY = {
   id: '',
   title: i18n.translate('xpack.fleet.epmList.allPackagesFilterLinkText', {
-    defaultMessage: 'All',
+    defaultMessage: 'All categories',
   }),
 };
 
diff --git a/x-pack/plugins/fleet/public/components/package_icon.tsx b/x-pack/plugins/fleet/public/components/package_icon.tsx
index 7a2a9f10913019..b77a7bd082d9ac 100644
--- a/x-pack/plugins/fleet/public/components/package_icon.tsx
+++ b/x-pack/plugins/fleet/public/components/package_icon.tsx
@@ -23,9 +23,9 @@ export const CardIcon: React.FunctionComponent<UsePackageIconType & Omit<EuiIcon
 ) => {
   const { icons } = props;
   if (icons && icons.length === 1 && icons[0].type === 'eui') {
-    return <EuiIcon size={'xl'} type={icons[0].src} />;
+    return <EuiIcon size={'xl'} type={icons[0].src} {...props} />;
   } else if (icons && icons.length === 1 && icons[0].type === 'svg') {
-    return <EuiIcon size={'xl'} type={icons[0].src} />;
+    return <EuiIcon size={'xl'} type={icons[0].src} {...props} />;
   } else {
     return <PackageIcon {...props} />;
   }
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 9652e016f73a5e..ab62d33fce5f58 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -10720,7 +10720,6 @@
     "xpack.fleet.epm.detailsTitle": "詳細",
     "xpack.fleet.epm.errorLoadingNotice": "NOTICE.txtの読み込みエラー",
     "xpack.fleet.epm.featuresLabel": "機能",
-    "xpack.fleet.epm.illustrationAltText": "統合の例",
     "xpack.fleet.epm.install.packageInstallError": "{pkgName} {pkgVersion}のインストールエラー",
     "xpack.fleet.epm.install.packageUpdateError": "{pkgName} {pkgVersion}の更新エラー",
     "xpack.fleet.epm.licenseLabel": "ライセンス",
@@ -10755,7 +10754,6 @@
     "xpack.fleet.epm.usedByLabel": "エージェントポリシー",
     "xpack.fleet.epm.versionLabel": "バージョン",
     "xpack.fleet.epmList.allPackagesFilterLinkText": "すべて",
-    "xpack.fleet.epmList.allTitle": "カテゴリで参照",
     "xpack.fleet.epmList.installedTitle": "インストールされている統合",
     "xpack.fleet.epmList.missingIntegrationPlaceholder": "検索用語と一致する統合が見つかりませんでした。別のキーワードを試すか、左側のカテゴリを使用して参照してください。",
     "xpack.fleet.epmList.noPackagesFoundPlaceholder": "パッケージが見つかりません",
@@ -10829,12 +10827,10 @@
     "xpack.fleet.homeIntegration.tutorialModule.noticeText.notePrefix": "注：",
     "xpack.fleet.hostsInput.addRow": "行の追加",
     "xpack.fleet.initializationErrorMessageTitle": "Fleet を初期化できません",
-    "xpack.fleet.integrations.beatsModulesLink": "Beatsモジュール",
     "xpack.fleet.integrations.customInputsLink": "カスタム入力",
     "xpack.fleet.integrations.discussForumLink": "ディスカッションフォーラム",
     "xpack.fleet.integrations.installPackage.installingPackageButtonLabel": "{title} アセットをインストールしています",
     "xpack.fleet.integrations.installPackage.installPackageButtonLabel": "{title}アセットをインストール",
-    "xpack.fleet.integrations.missing": "統合が表示されない場合{customInputsLink}を使用してログまたはメトリックを収集するか、{beatsTutorialLink}を使用してデータを追加してください。{discussForumLink}を使用して新しい統合を要求してください。",
     "xpack.fleet.integrations.packageInstallErrorDescription": "このパッケージのインストール中に問題が発生しました。しばらくたってから再試行してください。",
     "xpack.fleet.integrations.packageInstallErrorTitle": "{title}パッケージをインストールできませんでした",
     "xpack.fleet.integrations.packageInstallSuccessDescription": "正常に{title}をインストールしました",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 404ef9ad673b72..1271e3a32a0d3e 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -10834,7 +10834,6 @@
     "xpack.fleet.epm.detailsTitle": "详情",
     "xpack.fleet.epm.errorLoadingNotice": "加载 NOTICE.txt 时出错",
     "xpack.fleet.epm.featuresLabel": "功能",
-    "xpack.fleet.epm.illustrationAltText": "集成的图示",
     "xpack.fleet.epm.install.packageInstallError": "安装 {pkgName} {pkgVersion} 时出错",
     "xpack.fleet.epm.install.packageUpdateError": "将 {pkgName} 更新到 {pkgVersion} 时出错",
     "xpack.fleet.epm.licenseLabel": "许可证",
@@ -10869,7 +10868,6 @@
     "xpack.fleet.epm.usedByLabel": "代理策略",
     "xpack.fleet.epm.versionLabel": "版本",
     "xpack.fleet.epmList.allPackagesFilterLinkText": "全部",
-    "xpack.fleet.epmList.allTitle": "按类别浏览",
     "xpack.fleet.epmList.installedTitle": "已安装集成",
     "xpack.fleet.epmList.missingIntegrationPlaceholder": "我们未找到任何匹配搜索词的集成。请重试其他关键字，或使用左侧的类别浏览。",
     "xpack.fleet.epmList.noPackagesFoundPlaceholder": "未找到任何软件包",
@@ -10943,12 +10941,10 @@
     "xpack.fleet.homeIntegration.tutorialModule.noticeText.notePrefix": "注意：",
     "xpack.fleet.hostsInput.addRow": "添加行",
     "xpack.fleet.initializationErrorMessageTitle": "无法初始化 Fleet",
-    "xpack.fleet.integrations.beatsModulesLink": "Beats 模板",
     "xpack.fleet.integrations.customInputsLink": "定制输入",
     "xpack.fleet.integrations.discussForumLink": "讨论论坛",
     "xpack.fleet.integrations.installPackage.installingPackageButtonLabel": "正在安装 {title} 资产",
     "xpack.fleet.integrations.installPackage.installPackageButtonLabel": "安装 {title} 资产",
-    "xpack.fleet.integrations.missing": "未看到集成？使用我们的{customInputsLink}收集任何日志或指标或使用 {beatsTutorialLink} 添加数据。使用{discussForumLink}请求新的集成。",
     "xpack.fleet.integrations.packageInstallErrorDescription": "尝试安装此软件包时出现问题。请稍后重试。",
     "xpack.fleet.integrations.packageInstallErrorTitle": "无法安装 {title} 软件包",
     "xpack.fleet.integrations.packageInstallSuccessDescription": "已成功安装 {title}",

From 55a444b17a935094375e9fffb30d5b63bb705066 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20S=C3=A1nchez?= <davidsansol92@gmail.com>
Date: Thu, 14 Oct 2021 16:25:17 +0200
Subject: [PATCH 58/71] Small adjustments in policy page (#114957)

---
 .../trusted_apps/flyout/policy_trusted_apps_flyout.tsx    | 2 +-
 .../view/components/trusted_apps_grid/index.tsx           | 8 +++++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.tsx
index 63c7d5375476cc..8728104aee637b 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.tsx
@@ -249,7 +249,7 @@ export const PolicyTrustedAppsFlyout = React.memo(() => {
             >
               <FormattedMessage
                 id="xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.confirm"
-                defaultMessage="Assing to {policyName}"
+                defaultMessage="Assign to {policyName}"
                 values={{
                   policyName,
                 }}
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/trusted_apps_grid/index.tsx b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/trusted_apps_grid/index.tsx
index 948b454f9cc003..6967c07db20b10 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/trusted_apps_grid/index.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/trusted_apps_grid/index.tsx
@@ -54,7 +54,7 @@ const RootWrapper = styled.div`
 
 const BACK_TO_TRUSTED_APPS_LABEL = i18n.translate(
   'xpack.securitySolution.trustedapps.grid.policyDetailsLinkBackLabel',
-  { defaultMessage: 'Back to trusted Applications' }
+  { defaultMessage: 'Back to trusted applications' }
 );
 
 const EDIT_TRUSTED_APP_ACTION_LABEL = i18n.translate(
@@ -120,6 +120,12 @@ export const TrustedAppsGrid = memo(() => {
               ],
               href: getAppUrl({ path: currentPagePath }),
             },
+            onCancelNavigateTo: [
+              APP_ID,
+              {
+                path: currentPagePath,
+              },
+            ],
           };
 
           policyToNavOptionsMap[policyId] = {

From c5e23b6a5b32beb23b509248c66f3aff5a23f48f Mon Sep 17 00:00:00 2001
From: Tim Sullivan <tsullivan@users.noreply.github.com>
Date: Thu, 14 Oct 2021 07:37:15 -0700
Subject: [PATCH 59/71] [Reporting] Functional test structure & improvements
 (#114298)

* [Reporting] Functional test structure & improvements

* show the error of the report generation failure in the test failure

* update snapshot

* remove import to non-existent functional app test

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 vars/kibanaPipeline.groovy                    |  1 -
 .../__snapshots__/stream_handler.test.ts.snap |  1 +
 .../reporting/public/notifier/job_failure.tsx |  1 +
 .../test/functional/apps/reporting/README.md  | 18 ++++++
 .../test/functional/apps/reporting/index.ts   | 14 -----
 .../functional/apps/reporting/reporting.ts    | 55 -------------------
 x-pack/test/functional/config.js              |  1 -
 .../functional/page_objects/reporting_page.ts | 25 ++++++---
 8 files changed, 36 insertions(+), 80 deletions(-)
 create mode 100644 x-pack/test/functional/apps/reporting/README.md
 delete mode 100644 x-pack/test/functional/apps/reporting/index.ts
 delete mode 100644 x-pack/test/functional/apps/reporting/reporting.ts

diff --git a/vars/kibanaPipeline.groovy b/vars/kibanaPipeline.groovy
index 21e41ce55781f1..daf6ca7a8e993f 100644
--- a/vars/kibanaPipeline.groovy
+++ b/vars/kibanaPipeline.groovy
@@ -203,7 +203,6 @@ def withGcsArtifactUpload(workerName, closure) {
     'x-pack/test/**/screenshots/diff/*.png',
     'x-pack/test/**/screenshots/failure/*.png',
     'x-pack/test/**/screenshots/session/*.png',
-    'x-pack/test/functional/apps/reporting/reports/session/*.pdf',
     'x-pack/test/functional/failure_debug/html/*.html',
     '.es/**/*.hprof'
   ]
diff --git a/x-pack/plugins/reporting/public/lib/__snapshots__/stream_handler.test.ts.snap b/x-pack/plugins/reporting/public/lib/__snapshots__/stream_handler.test.ts.snap
index 3d49e8e695f9ba..9c72de2bf0ed83 100644
--- a/x-pack/plugins/reporting/public/lib/__snapshots__/stream_handler.test.ts.snap
+++ b/x-pack/plugins/reporting/public/lib/__snapshots__/stream_handler.test.ts.snap
@@ -82,6 +82,7 @@ Array [
       "reactNode": <React.Fragment>
         <EuiCallOut
           color="danger"
+          data-test-errorText="this is the failed report error"
           iconType="alert"
           size="m"
           title="The reporting job failed"
diff --git a/x-pack/plugins/reporting/public/notifier/job_failure.tsx b/x-pack/plugins/reporting/public/notifier/job_failure.tsx
index e892a1f93a7c25..7775afc4d9f829 100644
--- a/x-pack/plugins/reporting/public/notifier/job_failure.tsx
+++ b/x-pack/plugins/reporting/public/notifier/job_failure.tsx
@@ -35,6 +35,7 @@ export const getFailureToast = (
           })}
           color="danger"
           iconType="alert"
+          data-test-errorText={errorText}
         >
           {errorText}
         </EuiCallOut>
diff --git a/x-pack/test/functional/apps/reporting/README.md b/x-pack/test/functional/apps/reporting/README.md
new file mode 100644
index 00000000000000..ec9bba8b883417
--- /dev/null
+++ b/x-pack/test/functional/apps/reporting/README.md
@@ -0,0 +1,18 @@
+## Reporting functional tests
+
+Functional tests on report generation are under the applications that use reporting.
+
+**PDF/PNG Report testing:**
+ - `x-pack/test/functional/apps/canvas/reports.ts`
+ - `x-pack/test/functional/apps/dashboard/reporting/screenshots.ts`
+ - `x-pack/test/functional/apps/lens/lens_reporting.ts`
+ - `x-pack/test/functional/apps/visualize/reporting.ts`
+
+**CSV Report testing:**
+ - `x-pack/test/functional/apps/dashboard/reporting/download_csv.ts`
+ - `x-pack/test/functional/apps/discover/reporting.ts`
+
+Reporting Management app tests are in `functional/apps/reporting_management`.
+
+**Manage reports testing:**
+ - `x-pack/test/functional/apps/reporting_management` 
diff --git a/x-pack/test/functional/apps/reporting/index.ts b/x-pack/test/functional/apps/reporting/index.ts
deleted file mode 100644
index 286693f01ac52d..00000000000000
--- a/x-pack/test/functional/apps/reporting/index.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { FtrProviderContext } from '../../ftr_provider_context';
-
-export default function ({ loadTestFile }: FtrProviderContext) {
-  describe('Reporting', function () {
-    loadTestFile(require.resolve('./reporting'));
-  });
-}
diff --git a/x-pack/test/functional/apps/reporting/reporting.ts b/x-pack/test/functional/apps/reporting/reporting.ts
deleted file mode 100644
index 0d8034f046e024..00000000000000
--- a/x-pack/test/functional/apps/reporting/reporting.ts
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import expect from '@kbn/expect';
-import { FtrProviderContext } from '../../ftr_provider_context';
-
-export default function ({ getService, getPageObjects }: FtrProviderContext) {
-  const pageObjects = getPageObjects(['dashboard', 'common', 'reporting']);
-  const es = getService('es');
-  const kibanaServer = getService('kibanaServer');
-
-  const retry = getService('retry');
-
-  describe('Reporting', function () {
-    this.tags(['smoke', 'ciGroup2']);
-    before(async () => {
-      await kibanaServer.importExport.load(
-        'x-pack/test/functional/fixtures/kbn_archiver/packaging'
-      );
-    });
-
-    after(async () => {
-      await kibanaServer.importExport.unload(
-        'x-pack/test/functional/fixtures/kbn_archiver/packaging'
-      );
-      await es.deleteByQuery({
-        index: '.reporting-*',
-        refresh: true,
-        body: { query: { match_all: {} } },
-      });
-    });
-
-    it('downloaded PDF has OK status', async function () {
-      this.timeout(180000);
-
-      await pageObjects.common.navigateToApp('dashboards');
-      await retry.waitFor('dashboard landing page', async () => {
-        return await pageObjects.dashboard.onDashboardLandingPage();
-      });
-      await pageObjects.dashboard.loadSavedDashboard('dashboard');
-      await pageObjects.reporting.openPdfReportingPanel();
-      await pageObjects.reporting.clickGenerateReportButton();
-
-      const url = await pageObjects.reporting.getReportURL(60000);
-      const res = await pageObjects.reporting.getResponse(url);
-
-      expect(res.status).to.equal(200);
-      expect(res.get('content-type')).to.equal('application/pdf');
-    });
-  });
-}
diff --git a/x-pack/test/functional/config.js b/x-pack/test/functional/config.js
index 04622c5f21face..2abd91fd0433a8 100644
--- a/x-pack/test/functional/config.js
+++ b/x-pack/test/functional/config.js
@@ -56,7 +56,6 @@ export default async function ({ readConfigFile }) {
       resolve(__dirname, './apps/transform'),
       resolve(__dirname, './apps/reporting_management'),
       resolve(__dirname, './apps/management'),
-      resolve(__dirname, './apps/reporting'),
       resolve(__dirname, './apps/lens'), // smokescreen tests cause flakiness in other tests
 
       // This license_management file must be last because it is destructive.
diff --git a/x-pack/test/functional/page_objects/reporting_page.ts b/x-pack/test/functional/page_objects/reporting_page.ts
index 552d2c9c831bd5..039f4ff0fbc571 100644
--- a/x-pack/test/functional/page_objects/reporting_page.ts
+++ b/x-pack/test/functional/page_objects/reporting_page.ts
@@ -19,6 +19,7 @@ export class ReportingPageObject extends FtrService {
   private readonly retry = this.ctx.getService('retry');
   private readonly security = this.ctx.getService('security');
   private readonly testSubjects = this.ctx.getService('testSubjects');
+  private readonly find = this.ctx.getService('find');
   private readonly share = this.ctx.getPageObject('share');
   private readonly timePicker = this.ctx.getPageObject('timePicker');
 
@@ -33,15 +34,21 @@ export class ReportingPageObject extends FtrService {
   async getReportURL(timeout: number) {
     this.log.debug('getReportURL');
 
-    const url = await this.testSubjects.getAttribute(
-      'downloadCompletedReportButton',
-      'href',
-      timeout
-    );
-
-    this.log.debug(`getReportURL got url: ${url}`);
-
-    return url;
+    try {
+      const url = await this.testSubjects.getAttribute(
+        'downloadCompletedReportButton',
+        'href',
+        timeout
+      );
+      this.log.debug(`getReportURL got url: ${url}`);
+
+      return url;
+    } catch (err) {
+      const errorTextEl = await this.find.byCssSelector('[data-test-errorText]');
+      const errorText = await errorTextEl.getAttribute('data-test-errorText');
+      const newError = new Error(`Test report failed: ${errorText}: ${err}`);
+      throw newError;
+    }
   }
 
   async removeForceSharedItemsContainerSize() {

From 3899046313dfed73c406aea78531ada9caabba78 Mon Sep 17 00:00:00 2001
From: Jonathan Budzenski <jon@budzenski.me>
Date: Thu, 14 Oct 2021 09:51:46 -0500
Subject: [PATCH 60/71] skip flaky suite.  #113890

---
 .../functional/apps/transform/creation_runtime_mappings.ts    | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/x-pack/test/functional/apps/transform/creation_runtime_mappings.ts b/x-pack/test/functional/apps/transform/creation_runtime_mappings.ts
index 5fe9d02c58dc77..e244c907a76d67 100644
--- a/x-pack/test/functional/apps/transform/creation_runtime_mappings.ts
+++ b/x-pack/test/functional/apps/transform/creation_runtime_mappings.ts
@@ -33,7 +33,9 @@ export default function ({ getService }: FtrProviderContext) {
       script: "emit(doc['responsetime'].value * 2.0)",
     },
   };
-  describe('creation with runtime mappings', function () {
+
+  // FLAKY https://github.com/elastic/kibana/issues/113890
+  describe.skip('creation with runtime mappings', function () {
     before(async () => {
       await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/ml/farequote');
       await transform.testResources.createIndexPatternIfNeeded('ft_farequote', '@timestamp');

From 0b2012a90864abb72f1fca6f39eba68b6c31efed Mon Sep 17 00:00:00 2001
From: ymao1 <ying.mao@elastic.co>
Date: Thu, 14 Oct 2021 11:34:52 -0400
Subject: [PATCH 61/71] Setting displayname for alerting sos (#114916)

---
 x-pack/plugins/actions/server/saved_objects/index.ts  | 1 +
 x-pack/plugins/alerting/server/saved_objects/index.ts | 1 +
 2 files changed, 2 insertions(+)

diff --git a/x-pack/plugins/actions/server/saved_objects/index.ts b/x-pack/plugins/actions/server/saved_objects/index.ts
index 14b425d20af135..c3598df809bcf8 100644
--- a/x-pack/plugins/actions/server/saved_objects/index.ts
+++ b/x-pack/plugins/actions/server/saved_objects/index.ts
@@ -40,6 +40,7 @@ export function setupSavedObjects(
     mappings: mappings.action as SavedObjectsTypeMappingDefinition,
     migrations: getActionsMigrations(encryptedSavedObjects),
     management: {
+      displayName: 'connector',
       defaultSearchField: 'name',
       importableAndExportable: true,
       getTitle(savedObject: SavedObject<RawAction>) {
diff --git a/x-pack/plugins/alerting/server/saved_objects/index.ts b/x-pack/plugins/alerting/server/saved_objects/index.ts
index f1afba147a2f7c..eb561b3c285f8e 100644
--- a/x-pack/plugins/alerting/server/saved_objects/index.ts
+++ b/x-pack/plugins/alerting/server/saved_objects/index.ts
@@ -58,6 +58,7 @@ export function setupSavedObjects(
     migrations: getMigrations(encryptedSavedObjects, isPreconfigured),
     mappings: mappings.alert as SavedObjectsTypeMappingDefinition,
     management: {
+      displayName: 'rule',
       importableAndExportable: true,
       getTitle(ruleSavedObject: SavedObject<RawAlert>) {
         return `Rule: [${ruleSavedObject.attributes.name}]`;

From b304c1ca0b3ed77f7cb382dac1060e91904c48ae Mon Sep 17 00:00:00 2001
From: Georgii Gorbachev <georgii.gorbachev@elastic.co>
Date: Thu, 14 Oct 2021 17:40:23 +0200
Subject: [PATCH 62/71] [Security Solution][Detections] Truncate
 lastFailureMessage for siem-detection-engine-rule-status documents (#112257)

**Ticket:** https://github.com/elastic/kibana/issues/109815

## Summary

**Background:** `siem-detection-engine-rule-status` documents stores the `lastFailureMessage` a string which is indexed as `type: "text"` but some failure messages are so large that these documents are up to 26MB. These large documents cause migrations to fail because a batch of 1000 documents easily exceed Elasticsearch's `http.max_content_length` which defaults to 100mb.

This PR truncates `lastFailureMessage` and `lastSuccessMessage` in the following cases:

1. When we write new or update existing status SOs:
    - The lists of errors/warnings are deduped -> truncated to max `20` items -> joined to a string
    - The resulting strings are truncated to max `10240` characters
2. When we migrate `siem-detection-engine-rule-status` SOs to 7.15.2:
    - The two message fields are truncated to max `10240` characters

### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
---
 .../rule_execution_log/index.ts               | 10 ++++++
 .../rule_execution_log_client.ts              | 18 ++++++++--
 .../rule_execution_log/utils/normalization.ts | 34 +++++++++++++++++++
 .../create_security_rule_type_wrapper.ts      |  8 +++--
 .../rules/saved_object_mappings.ts            | 20 ++++++++++-
 .../signals/signal_rule_alert_type.ts         |  8 +++--
 6 files changed, 89 insertions(+), 9 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/index.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/utils/normalization.ts

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/index.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/index.ts
new file mode 100644
index 00000000000000..5c7d9a875056af
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/index.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './rule_execution_log_client';
+export * from './types';
+export * from './utils/normalization';
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/rule_execution_log_client.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/rule_execution_log_client.ts
index 2d773fc35cce00..7ae2f179f9692d 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/rule_execution_log_client.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/rule_execution_log_client.ts
@@ -18,6 +18,7 @@ import {
   UpdateExecutionLogArgs,
   UnderlyingLogClient,
 } from './types';
+import { truncateMessage } from './utils/normalization';
 
 export interface RuleExecutionLogClientArgs {
   savedObjectsClient: SavedObjectsClientContract;
@@ -52,7 +53,16 @@ export class RuleExecutionLogClient implements IRuleExecutionLogClient {
   }
 
   public async update(args: UpdateExecutionLogArgs) {
-    return this.client.update(args);
+    const { lastFailureMessage, lastSuccessMessage, ...restAttributes } = args.attributes;
+
+    return this.client.update({
+      ...args,
+      attributes: {
+        lastFailureMessage: truncateMessage(lastFailureMessage),
+        lastSuccessMessage: truncateMessage(lastSuccessMessage),
+        ...restAttributes,
+      },
+    });
   }
 
   public async delete(id: string) {
@@ -64,6 +74,10 @@ export class RuleExecutionLogClient implements IRuleExecutionLogClient {
   }
 
   public async logStatusChange(args: LogStatusChangeArgs) {
-    return this.client.logStatusChange(args);
+    const message = args.message ? truncateMessage(args.message) : args.message;
+    return this.client.logStatusChange({
+      ...args,
+      message,
+    });
   }
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/utils/normalization.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/utils/normalization.ts
new file mode 100644
index 00000000000000..baaee9446eee3d
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/utils/normalization.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { take, toString, truncate, uniq } from 'lodash';
+
+// When we write rule execution status updates to `siem-detection-engine-rule-status` saved objects
+// or to event log, we write success and failure messages as well. Those messages are built from
+// N errors collected during the "big loop" in the Detection Engine, where N can be very large.
+// When N is large the resulting message strings are so large that these documents are up to 26MB.
+// These large documents may cause migrations to fail because a batch of 1000 documents easily
+// exceed Elasticsearch's `http.max_content_length` which defaults to 100mb.
+// In order to fix that, we need to truncate those messages to an adequate MAX length.
+// https://github.com/elastic/kibana/pull/112257
+
+const MAX_MESSAGE_LENGTH = 10240;
+const MAX_LIST_LENGTH = 20;
+
+export const truncateMessage = (value: unknown): string | undefined => {
+  if (value === undefined) {
+    return value;
+  }
+
+  const str = toString(value);
+  return truncate(str, { length: MAX_MESSAGE_LENGTH });
+};
+
+export const truncateMessageList = (list: string[]): string[] => {
+  const deduplicatedList = uniq(list);
+  return take(deduplicatedList, MAX_LIST_LENGTH);
+};
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_wrapper.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_wrapper.ts
index b037e572f21b7c..77981d92b2ba7d 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_wrapper.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_wrapper.ts
@@ -38,7 +38,7 @@ import {
 import { getNotificationResultsLink } from '../notifications/utils';
 import { createResultObject } from './utils';
 import { bulkCreateFactory, wrapHitsFactory, wrapSequencesFactory } from './factories';
-import { RuleExecutionLogClient } from '../rule_execution_log/rule_execution_log_client';
+import { RuleExecutionLogClient, truncateMessageList } from '../rule_execution_log';
 import { RuleExecutionStatus } from '../../../../common/detection_engine/schemas/common/schemas';
 import { scheduleThrottledNotificationActions } from '../notifications/schedule_throttle_notification_actions';
 import { AlertAttributes } from '../signals/types';
@@ -282,7 +282,9 @@ export const createSecurityRuleTypeWrapper: CreateSecurityRuleTypeWrapper =
           }
 
           if (result.warningMessages.length) {
-            const warningMessage = buildRuleMessage(result.warningMessages.join());
+            const warningMessage = buildRuleMessage(
+              truncateMessageList(result.warningMessages).join()
+            );
             await ruleStatusClient.logStatusChange({
               ...basicLogArguments,
               newStatus: RuleExecutionStatus['partial failure'],
@@ -372,7 +374,7 @@ export const createSecurityRuleTypeWrapper: CreateSecurityRuleTypeWrapper =
           } else {
             const errorMessage = buildRuleMessage(
               'Bulk Indexing of signals failed:',
-              result.errors.join()
+              truncateMessageList(result.errors).join()
             );
             logger.error(errorMessage);
             await ruleStatusClient.logStatusChange({
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/saved_object_mappings.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/saved_object_mappings.ts
index 813e800f34ce22..d347fccf6b77b9 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/saved_object_mappings.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/saved_object_mappings.ts
@@ -5,7 +5,8 @@
  * 2.0.
  */
 
-import { SavedObjectsType } from '../../../../../../../src/core/server';
+import { SavedObjectsType, SavedObjectMigrationFn } from 'kibana/server';
+import { truncateMessage } from '../rule_execution_log';
 
 export const ruleStatusSavedObjectType = 'siem-detection-engine-rule-status';
 
@@ -47,11 +48,28 @@ export const ruleStatusSavedObjectMappings: SavedObjectsType['mappings'] = {
   },
 };
 
+const truncateMessageFields: SavedObjectMigrationFn<Record<string, unknown>> = (doc) => {
+  const { lastFailureMessage, lastSuccessMessage, ...restAttributes } = doc.attributes;
+
+  return {
+    ...doc,
+    attributes: {
+      lastFailureMessage: truncateMessage(lastFailureMessage),
+      lastSuccessMessage: truncateMessage(lastSuccessMessage),
+      ...restAttributes,
+    },
+    references: doc.references ?? [],
+  };
+};
+
 export const type: SavedObjectsType = {
   name: ruleStatusSavedObjectType,
   hidden: false,
   namespaceType: 'single',
   mappings: ruleStatusSavedObjectMappings,
+  migrations: {
+    '7.15.2': truncateMessageFields,
+  },
 };
 
 export const ruleAssetSavedObjectType = 'security-rule';
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
index 1e3a8a513c4a13..2094264cbf15f8 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
@@ -69,7 +69,7 @@ import { wrapSequencesFactory } from './wrap_sequences_factory';
 import { ConfigType } from '../../../config';
 import { ExperimentalFeatures } from '../../../../common/experimental_features';
 import { injectReferences, extractReferences } from './saved_object_references';
-import { RuleExecutionLogClient } from '../rule_execution_log/rule_execution_log_client';
+import { RuleExecutionLogClient, truncateMessageList } from '../rule_execution_log';
 import { RuleExecutionStatus } from '../../../../common/detection_engine/schemas/common/schemas';
 import { scheduleThrottledNotificationActions } from '../notifications/schedule_throttle_notification_actions';
 import { IEventLogService } from '../../../../../event_log/server';
@@ -384,7 +384,9 @@ export const signalRulesAlertType = ({
           throw new Error(`unknown rule type ${type}`);
         }
         if (result.warningMessages.length) {
-          const warningMessage = buildRuleMessage(result.warningMessages.join());
+          const warningMessage = buildRuleMessage(
+            truncateMessageList(result.warningMessages).join()
+          );
           await ruleStatusClient.logStatusChange({
             ...basicLogArguments,
             newStatus: RuleExecutionStatus['partial failure'],
@@ -471,7 +473,7 @@ export const signalRulesAlertType = ({
         } else {
           const errorMessage = buildRuleMessage(
             'Bulk Indexing of signals failed:',
-            result.errors.join()
+            truncateMessageList(result.errors).join()
           );
           logger.error(errorMessage);
           await ruleStatusClient.logStatusChange({

From 1155640779201d3d217390f944d455a3408264ef Mon Sep 17 00:00:00 2001
From: Chenhui Wang <54903978+wangch079@users.noreply.github.com>
Date: Thu, 14 Oct 2021 23:44:47 +0800
Subject: [PATCH 63/71] Add comments in the GitHub content source UI (#114766)

---
 .../public/applications/workplace_search/constants.ts         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/constants.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/constants.ts
index 2cec9f617cd27e..a43fb6f2934576 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/constants.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/constants.ts
@@ -253,12 +253,12 @@ export const SOURCE_OBJ_TYPES = {
     defaultMessage: 'Bugs',
   }),
   ISSUES: i18n.translate('xpack.enterpriseSearch.workplaceSearch.sources.objTypes.issues', {
-    defaultMessage: 'Issues',
+    defaultMessage: 'Issues (including comments)',
   }),
   PULL_REQUESTS: i18n.translate(
     'xpack.enterpriseSearch.workplaceSearch.sources.objTypes.pullRequests',
     {
-      defaultMessage: 'Pull Requests',
+      defaultMessage: 'Pull Requests (including comments)',
     }
   ),
   REPOSITORY_LIST: i18n.translate(

From f2d70d89968222303009a30d5fb71f911097479d Mon Sep 17 00:00:00 2001
From: Tyler Smalley <tyler.smalley@elastic.co>
Date: Thu, 14 Oct 2021 08:52:11 -0700
Subject: [PATCH 64/71] [renovate] Configure Cypress (#114880)

On `ci:all-cypress-suites` label, run all Cypress suites on Buildkite

Signed-off-by: Tyler Smalley <tyler.smalley@elastic.co>
---
 .buildkite/scripts/pipelines/pull_request/pipeline.js | 4 ++--
 renovate.json5                                        | 9 +++++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/.buildkite/scripts/pipelines/pull_request/pipeline.js b/.buildkite/scripts/pipelines/pull_request/pipeline.js
index 068de9917c2137..78dc6e1b29b6d1 100644
--- a/.buildkite/scripts/pipelines/pull_request/pipeline.js
+++ b/.buildkite/scripts/pipelines/pull_request/pipeline.js
@@ -60,7 +60,7 @@ const uploadPipeline = (pipelineContent) => {
         /^x-pack\/test\/security_solution_cypress/,
         /^x-pack\/plugins\/triggers_actions_ui\/public\/application\/sections\/action_connector_form/,
         /^x-pack\/plugins\/triggers_actions_ui\/public\/application\/context\/actions_connectors_context\.tsx/,
-      ])
+      ]) || process.env.GITHUB_PR_LABELS.includes('ci:all-cypress-suites')
     ) {
       pipeline.push(getPipeline('.buildkite/pipelines/pull_request/security_solution.yml'));
     }
@@ -69,7 +69,7 @@ const uploadPipeline = (pipelineContent) => {
     // if (
     //   await doAnyChangesMatch([
     //     /^x-pack\/plugins\/apm/,
-    //   ])
+    //   ]) || process.env.GITHUB_PR_LABELS.includes('ci:all-cypress-suites')
     // ) {
     //   pipeline.push(getPipeline('.buildkite/pipelines/pull_request/apm_cypress.yml'));
     // }
diff --git a/renovate.json5 b/renovate.json5
index b08d7e0bcec1e7..76923f01daba0e 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -93,6 +93,15 @@
         labels: ['Feature:Vega', 'Team:VisEditors'],
         enabled: true,
       },
+      {
+        groupName: 'cypress',
+        packageNames: ['eslint-plugin-cypress'],
+        matchPackagePatterns: ["^cypress"],
+        reviewers: ['Team:apm', 'Team: SecuritySolution'],
+        matchBaseBranches: ['master'],
+        labels: ['buildkite-ci', 'ci:all-cypress-suites'],
+        enabled: true,
+      }
       {
         groupName: 'platform security modules',
         packageNames: [

From 45e9d51a444875e396c9e44942cf97ec324c6ead Mon Sep 17 00:00:00 2001
From: Stacey Gammon <gammon@elastic.co>
Date: Thu, 14 Oct 2021 11:54:35 -0400
Subject: [PATCH 65/71] Add pluginTeam to plugin API ci stats  (#115007)

* Add pluginTeam to ci stats for easier higher level groupings

* Updated docs
---
 api_docs/actions.json                         |   18 +-
 api_docs/alerting.json                        |  153 +-
 api_docs/alerting.mdx                         |    2 +-
 api_docs/apm.json                             |  166 +-
 api_docs/apm.mdx                              |    5 +-
 api_docs/apm_oss.json                         |  109 -
 api_docs/apm_oss.mdx                          |   38 -
 api_docs/bfetch.json                          |  393 +--
 api_docs/bfetch.mdx                           |    5 +-
 api_docs/cases.json                           |   30 +-
 api_docs/cases.mdx                            |    2 +-
 api_docs/charts.json                          |    2 +-
 api_docs/core.json                            |  112 +-
 api_docs/core.mdx                             |    2 +-
 api_docs/core_application.mdx                 |    2 +-
 api_docs/core_chrome.json                     |    2 +-
 api_docs/core_chrome.mdx                      |    2 +-
 api_docs/core_http.json                       |   30 +-
 api_docs/core_http.mdx                        |    2 +-
 api_docs/core_saved_objects.json              |  356 +--
 api_docs/core_saved_objects.mdx               |    2 +-
 api_docs/custom_integrations.json             |  209 +-
 api_docs/custom_integrations.mdx              |    2 +-
 api_docs/dashboard.json                       |   12 +-
 api_docs/data.json                            | 2829 +++--------------
 api_docs/data.mdx                             |    2 +-
 api_docs/data_autocomplete.mdx                |    2 +-
 api_docs/data_query.json                      |    4 +-
 api_docs/data_query.mdx                       |    2 +-
 api_docs/data_search.json                     |  234 +-
 api_docs/data_search.mdx                      |    2 +-
 api_docs/data_ui.mdx                          |    2 +-
 api_docs/data_views.json                      | 1846 +++--------
 api_docs/data_views.mdx                       |    2 +-
 api_docs/data_visualizer.json                 |    4 +-
 api_docs/deprecations_by_api.mdx              |   41 +-
 api_docs/deprecations_by_plugin.mdx           |   56 +-
 api_docs/discover.json                        | 1006 +++++-
 api_docs/discover.mdx                         |    5 +-
 api_docs/elastic_apm_generator.json           |   45 +-
 api_docs/elastic_apm_generator.mdx            |    2 +-
 api_docs/es_ui_shared.json                    |    2 +-
 api_docs/event_log.json                       |   22 +-
 api_docs/expressions.json                     |  205 +-
 api_docs/expressions.mdx                      |    2 +-
 api_docs/fleet.json                           |  303 +-
 api_docs/fleet.mdx                            |    2 +-
 api_docs/global_search.json                   |    2 +-
 api_docs/home.json                            |   12 +-
 api_docs/kbn_dev_utils.json                   |  750 ++++-
 api_docs/kbn_dev_utils.mdx                    |    2 +-
 api_docs/kbn_logging.json                     |    4 +-
 api_docs/kbn_monaco.json                      |    4 +-
 .../kbn_securitysolution_autocomplete.json    |    6 +-
 api_docs/kbn_securitysolution_es_utils.json   |  136 +-
 ...kbn_securitysolution_io_ts_list_types.json |   80 +-
 api_docs/kbn_securitysolution_list_api.json   |   16 +-
 api_docs/kbn_securitysolution_list_hooks.json |   40 +-
 api_docs/kbn_securitysolution_list_utils.json |   26 +-
 api_docs/kbn_securitysolution_utils.json      |   31 +
 api_docs/kbn_securitysolution_utils.mdx       |    2 +-
 api_docs/kibana_react.json                    |   26 +-
 api_docs/kibana_utils.json                    |    4 +-
 api_docs/lens.json                            |   46 +-
 api_docs/lists.json                           |  104 +-
 api_docs/maps_ems.json                        |    2 +-
 api_docs/metrics_entities.json                |    2 +-
 api_docs/ml.json                              |    6 +-
 api_docs/monitoring.json                      |    2 +-
 api_docs/observability.json                   |   34 +-
 api_docs/plugin_directory.mdx                 |   39 +-
 api_docs/presentation_util.json               |   30 +-
 api_docs/presentation_util.mdx                |    2 +-
 api_docs/reporting.json                       |   12 +-
 api_docs/rule_registry.json                   |  251 +-
 api_docs/rule_registry.mdx                    |    2 +-
 api_docs/runtime_fields.json                  |    6 +-
 api_docs/saved_objects.json                   |  152 +-
 api_docs/saved_objects_management.json        |    4 +-
 api_docs/security_solution.json               |   26 +-
 api_docs/spaces.json                          |    2 +-
 api_docs/task_manager.json                    |    2 +-
 api_docs/telemetry_collection_manager.json    |   42 +-
 api_docs/timelines.json                       |    8 +-
 api_docs/triggers_actions_ui.json             |   30 +-
 api_docs/triggers_actions_ui.mdx              |    2 +-
 api_docs/usage_collection.json                |    8 +-
 api_docs/vis_type_pie.json                    |    4 +-
 api_docs/visualizations.json                  |   92 +-
 api_docs/visualize.json                       |    8 +-
 .../src/api_docs/build_api_docs_cli.ts        |    6 +
 91 files changed, 4225 insertions(+), 6116 deletions(-)
 delete mode 100644 api_docs/apm_oss.json
 delete mode 100644 api_docs/apm_oss.mdx

diff --git a/api_docs/actions.json b/api_docs/actions.json
index 5094a7cadefe30..532128e65d926c 100644
--- a/api_docs/actions.json
+++ b/api_docs/actions.json
@@ -695,7 +695,7 @@
         "label": "ActionParamsType",
         "description": [],
         "signature": [
-          "{ readonly source?: string | undefined; readonly summary?: string | undefined; readonly timestamp?: string | undefined; readonly eventAction?: \"resolve\" | \"trigger\" | \"acknowledge\" | undefined; readonly dedupKey?: string | undefined; readonly severity?: \"warning\" | \"error\" | \"info\" | \"critical\" | undefined; readonly component?: string | undefined; readonly group?: string | undefined; readonly class?: string | undefined; }"
+          "{ readonly source?: string | undefined; readonly summary?: string | undefined; readonly timestamp?: string | undefined; readonly eventAction?: \"resolve\" | \"trigger\" | \"acknowledge\" | undefined; readonly dedupKey?: string | undefined; readonly severity?: \"error\" | \"info\" | \"warning\" | \"critical\" | undefined; readonly component?: string | undefined; readonly group?: string | undefined; readonly class?: string | undefined; }"
         ],
         "path": "x-pack/plugins/actions/server/builtin_action_types/pagerduty.ts",
         "deprecated": false,
@@ -751,7 +751,7 @@
         "label": "ActionParamsType",
         "description": [],
         "signature": [
-          "Readonly<{} & { subAction: \"getFields\"; subActionParams: Readonly<{} & {}>; }> | Readonly<{} & { subAction: \"getIncident\"; subActionParams: Readonly<{} & { externalId: string; }>; }> | Readonly<{} & { subAction: \"handshake\"; subActionParams: Readonly<{} & {}>; }> | Readonly<{} & { subAction: \"pushToService\"; subActionParams: Readonly<{} & { incident: Readonly<{} & { description: string | null; category: string | null; severity: string | null; externalId: string | null; urgency: string | null; impact: string | null; short_description: string; subcategory: string | null; }>; comments: Readonly<{} & { comment: string; commentId: string; }>[] | null; }>; }> | Readonly<{} & { subAction: \"getChoices\"; subActionParams: Readonly<{} & { fields: string[]; }>; }> | Readonly<{} & { subAction: \"getFields\"; subActionParams: Readonly<{} & {}>; }> | Readonly<{} & { subAction: \"getIncident\"; subActionParams: Readonly<{} & { externalId: string; }>; }> | Readonly<{} & { subAction: \"handshake\"; subActionParams: Readonly<{} & {}>; }> | Readonly<{} & { subAction: \"pushToService\"; subActionParams: Readonly<{} & { incident: Readonly<{} & { description: string | null; category: string | null; externalId: string | null; short_description: string; subcategory: string | null; dest_ip: string | null; malware_hash: string | null; malware_url: string | null; source_ip: string | null; priority: string | null; }>; comments: Readonly<{} & { comment: string; commentId: string; }>[] | null; }>; }> | Readonly<{} & { subAction: \"getChoices\"; subActionParams: Readonly<{} & { fields: string[]; }>; }>"
+          "Readonly<{} & { subAction: \"getFields\"; subActionParams: Readonly<{} & {}>; }> | Readonly<{} & { subAction: \"getIncident\"; subActionParams: Readonly<{} & { externalId: string; }>; }> | Readonly<{} & { subAction: \"handshake\"; subActionParams: Readonly<{} & {}>; }> | Readonly<{} & { subAction: \"pushToService\"; subActionParams: Readonly<{} & { incident: Readonly<{} & { description: string | null; category: string | null; severity: string | null; externalId: string | null; urgency: string | null; impact: string | null; short_description: string; subcategory: string | null; correlation_id: string | null; correlation_display: string | null; }>; comments: Readonly<{} & { comment: string; commentId: string; }>[] | null; }>; }> | Readonly<{} & { subAction: \"getChoices\"; subActionParams: Readonly<{} & { fields: string[]; }>; }> | Readonly<{} & { subAction: \"getFields\"; subActionParams: Readonly<{} & {}>; }> | Readonly<{} & { subAction: \"getIncident\"; subActionParams: Readonly<{} & { externalId: string; }>; }> | Readonly<{} & { subAction: \"handshake\"; subActionParams: Readonly<{} & {}>; }> | Readonly<{} & { subAction: \"pushToService\"; subActionParams: Readonly<{} & { incident: Readonly<{} & { description: string | null; category: string | null; externalId: string | null; short_description: string; subcategory: string | null; correlation_id: string | null; correlation_display: string | null; dest_ip: string | string[] | null; malware_hash: string | string[] | null; malware_url: string | string[] | null; source_ip: string | string[] | null; priority: string | null; }>; comments: Readonly<{} & { comment: string; commentId: string; }>[] | null; }>; }> | Readonly<{} & { subAction: \"getChoices\"; subActionParams: Readonly<{} & { fields: string[]; }>; }>"
         ],
         "path": "x-pack/plugins/actions/server/builtin_action_types/servicenow/index.ts",
         "deprecated": false,
@@ -821,7 +821,9 @@
         "label": "ActionsClient",
         "description": [],
         "signature": [
-          "{ get: ({ id }: { id: string; }) => Promise<",
+          "{ create: ({ action: { actionTypeId, name, config, secrets }, }: ",
+          "CreateOptions",
+          ") => Promise<",
           {
             "pluginId": "actions",
             "scope": "server",
@@ -829,9 +831,7 @@
             "section": "def-server.ActionResult",
             "text": "ActionResult"
           },
-          "<Record<string, unknown>>>; delete: ({ id }: { id: string; }) => Promise<{}>; create: ({ action: { actionTypeId, name, config, secrets }, }: ",
-          "CreateOptions",
-          ") => Promise<",
+          "<Record<string, unknown>>>; delete: ({ id }: { id: string; }) => Promise<{}>; get: ({ id }: { id: string; }) => Promise<",
           {
             "pluginId": "actions",
             "scope": "server",
@@ -1031,7 +1031,7 @@
         "signature": [
           "\".servicenow\""
         ],
-        "path": "x-pack/plugins/actions/server/builtin_action_types/servicenow/index.ts",
+        "path": "x-pack/plugins/actions/server/builtin_action_types/servicenow/config.ts",
         "deprecated": false,
         "initialIsOpen": false
       },
@@ -1045,7 +1045,7 @@
         "signature": [
           "\".servicenow-sir\""
         ],
-        "path": "x-pack/plugins/actions/server/builtin_action_types/servicenow/index.ts",
+        "path": "x-pack/plugins/actions/server/builtin_action_types/servicenow/config.ts",
         "deprecated": false,
         "initialIsOpen": false
       }
@@ -1292,7 +1292,7 @@
               "section": "def-server.ActionsClient",
               "text": "ActionsClient"
             },
-            ", \"get\" | \"delete\" | \"create\" | \"update\" | \"execute\" | \"getAll\" | \"getBulk\" | \"enqueueExecution\" | \"ephemeralEnqueuedExecution\" | \"listTypes\" | \"isActionTypeEnabled\" | \"isPreconfigured\">>"
+            ", \"create\" | \"delete\" | \"get\" | \"update\" | \"execute\" | \"getAll\" | \"getBulk\" | \"enqueueExecution\" | \"ephemeralEnqueuedExecution\" | \"listTypes\" | \"isActionTypeEnabled\" | \"isPreconfigured\">>"
           ],
           "path": "x-pack/plugins/actions/server/plugin.ts",
           "deprecated": false,
diff --git a/api_docs/alerting.json b/api_docs/alerting.json
index caf8894c3c8a5e..ed62c8ffcfe10c 100644
--- a/api_docs/alerting.json
+++ b/api_docs/alerting.json
@@ -24,7 +24,7 @@
             "section": "def-common.Alert",
             "text": "Alert"
           },
-          "<never>, \"enabled\" | \"id\" | \"name\" | \"tags\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">) => string | ",
+          "<never>, \"id\" | \"name\" | \"tags\" | \"enabled\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">) => string | ",
           {
             "pluginId": "@kbn/utility-types",
             "scope": "server",
@@ -47,7 +47,7 @@
             "label": "alert",
             "description": [],
             "signature": [
-              "{ enabled: boolean; id: string; name: string; tags: string[]; params: never; actions: ",
+              "{ id: string; name: string; tags: string[]; enabled: boolean; params: never; actions: ",
               {
                 "pluginId": "alerting",
                 "scope": "common",
@@ -1038,7 +1038,7 @@
                 "section": "def-common.Alert",
                 "text": "Alert"
               },
-              "<never>, \"enabled\" | \"id\" | \"name\" | \"tags\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">, \"enabled\" | \"name\" | \"tags\" | \"actions\" | \"throttle\" | \"consumer\" | \"schedule\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"notifyWhen\"> & { producer: string; ruleTypeId: string; ruleTypeName: string; }"
+              "<never>, \"id\" | \"name\" | \"tags\" | \"enabled\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">, \"name\" | \"tags\" | \"enabled\" | \"actions\" | \"throttle\" | \"consumer\" | \"schedule\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"notifyWhen\"> & { producer: string; ruleTypeId: string; ruleTypeName: string; }"
             ],
             "path": "x-pack/plugins/alerting/server/types.ts",
             "deprecated": false
@@ -1568,6 +1568,32 @@
             "path": "x-pack/plugins/alerting/server/types.ts",
             "deprecated": false
           },
+          {
+            "parentPluginId": "alerting",
+            "id": "def-server.AlertType.defaultScheduleInterval",
+            "type": "string",
+            "tags": [],
+            "label": "defaultScheduleInterval",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "x-pack/plugins/alerting/server/types.ts",
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "alerting",
+            "id": "def-server.AlertType.minimumScheduleInterval",
+            "type": "string",
+            "tags": [],
+            "label": "minimumScheduleInterval",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "x-pack/plugins/alerting/server/types.ts",
+            "deprecated": false
+          },
           {
             "parentPluginId": "alerting",
             "id": "def-server.AlertType.ruleTaskTimeout",
@@ -1650,7 +1676,7 @@
                 "section": "def-common.Alert",
                 "text": "Alert"
               },
-              "<Params>, \"enabled\" | \"id\" | \"name\" | \"tags\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">[]"
+              "<Params>, \"id\" | \"name\" | \"tags\" | \"enabled\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">[]"
             ],
             "path": "x-pack/plugins/alerting/server/rules_client/rules_client.ts",
             "deprecated": false
@@ -1767,7 +1793,7 @@
                 "section": "def-server.RulesClient",
                 "text": "RulesClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"find\" | \"resolve\" | \"update\" | \"aggregate\" | \"enable\" | \"disable\" | \"muteAll\" | \"getAlertState\" | \"getAlertInstanceSummary\" | \"updateApiKey\" | \"unmuteAll\" | \"muteInstance\" | \"unmuteInstance\" | \"listAlertTypes\" | \"getSpaceId\">"
+              ", \"create\" | \"delete\" | \"find\" | \"get\" | \"resolve\" | \"update\" | \"aggregate\" | \"enable\" | \"disable\" | \"muteAll\" | \"getAlertState\" | \"getAlertInstanceSummary\" | \"updateApiKey\" | \"unmuteAll\" | \"muteInstance\" | \"unmuteInstance\" | \"listAlertTypes\" | \"getSpaceId\">"
             ],
             "path": "x-pack/plugins/alerting/server/plugin.ts",
             "deprecated": false,
@@ -2111,7 +2137,7 @@
             "section": "def-common.Alert",
             "text": "Alert"
           },
-          "<Params>, \"enabled\" | \"name\" | \"tags\" | \"params\" | \"actions\" | \"throttle\" | \"apiKey\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">>"
+          "<Params>, \"name\" | \"tags\" | \"enabled\" | \"params\" | \"actions\" | \"throttle\" | \"apiKey\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">>"
         ],
         "path": "x-pack/plugins/alerting/server/types.ts",
         "deprecated": false,
@@ -2145,17 +2171,7 @@
         "label": "RulesClient",
         "description": [],
         "signature": [
-          "{ get: <Params extends Record<string, unknown> = never>({ id, includeLegacyId, }: { id: string; includeLegacyId?: boolean | undefined; }) => Promise<Pick<",
-          {
-            "pluginId": "alerting",
-            "scope": "common",
-            "docId": "kibAlertingPluginApi",
-            "section": "def-common.Alert",
-            "text": "Alert"
-          },
-          "<Params>, \"enabled\" | \"id\" | \"name\" | \"tags\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\"> | Pick<",
-          "AlertWithLegacyId",
-          "<Params>, \"enabled\" | \"id\" | \"name\" | \"tags\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\" | \"legacyId\">>; delete: ({ id }: { id: string; }) => Promise<{}>; create: <Params extends Record<string, unknown> = never>({ data, options, }: ",
+          "{ create: <Params extends Record<string, unknown> = never>({ data, options, }: ",
           "CreateOptions",
           "<Params>) => Promise<Pick<",
           {
@@ -2165,7 +2181,7 @@
             "section": "def-common.Alert",
             "text": "Alert"
           },
-          "<Params>, \"enabled\" | \"id\" | \"name\" | \"tags\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">>; find: <Params extends Record<string, unknown> = never>({ options: { fields, ...options }, }?: { options?: ",
+          "<Params>, \"id\" | \"name\" | \"tags\" | \"enabled\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">>; delete: ({ id }: { id: string; }) => Promise<{}>; find: <Params extends Record<string, unknown> = never>({ options: { fields, ...options }, }?: { options?: ",
           "FindOptions",
           " | undefined; }) => Promise<",
           {
@@ -2175,7 +2191,17 @@
             "section": "def-server.FindResult",
             "text": "FindResult"
           },
-          "<Params>>; resolve: <Params extends Record<string, unknown> = never>({ id, }: { id: string; }) => Promise<",
+          "<Params>>; get: <Params extends Record<string, unknown> = never>({ id, includeLegacyId, }: { id: string; includeLegacyId?: boolean | undefined; }) => Promise<Pick<",
+          {
+            "pluginId": "alerting",
+            "scope": "common",
+            "docId": "kibAlertingPluginApi",
+            "section": "def-common.Alert",
+            "text": "Alert"
+          },
+          "<Params>, \"id\" | \"name\" | \"tags\" | \"enabled\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\"> | Pick<",
+          "AlertWithLegacyId",
+          "<Params>, \"id\" | \"name\" | \"tags\" | \"enabled\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\" | \"legacyId\">>; resolve: <Params extends Record<string, unknown> = never>({ id, }: { id: string; }) => Promise<",
           {
             "pluginId": "alerting",
             "scope": "common",
@@ -2225,6 +2251,37 @@
   "common": {
     "classes": [],
     "functions": [
+      {
+        "parentPluginId": "alerting",
+        "id": "def-common.formatDuration",
+        "type": "Function",
+        "tags": [],
+        "label": "formatDuration",
+        "description": [],
+        "signature": [
+          "(duration: string) => string"
+        ],
+        "path": "x-pack/plugins/alerting/common/parse_duration.ts",
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "alerting",
+            "id": "def-common.formatDuration.$1",
+            "type": "string",
+            "tags": [],
+            "label": "duration",
+            "description": [],
+            "signature": [
+              "string"
+            ],
+            "path": "x-pack/plugins/alerting/common/parse_duration.ts",
+            "deprecated": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "alerting",
         "id": "def-common.getBuiltinActionGroups",
@@ -3009,6 +3066,19 @@
             "path": "x-pack/plugins/alerting/common/alert.ts",
             "deprecated": false
           },
+          {
+            "parentPluginId": "alerting",
+            "id": "def-common.AlertExecutionStatus.lastDuration",
+            "type": "number",
+            "tags": [],
+            "label": "lastDuration",
+            "description": [],
+            "signature": [
+              "number | undefined"
+            ],
+            "path": "x-pack/plugins/alerting/common/alert.ts",
+            "deprecated": false
+          },
           {
             "parentPluginId": "alerting",
             "id": "def-common.AlertExecutionStatus.error",
@@ -3585,6 +3655,45 @@
             "description": [],
             "path": "x-pack/plugins/alerting/common/alert_type.ts",
             "deprecated": false
+          },
+          {
+            "parentPluginId": "alerting",
+            "id": "def-common.AlertType.ruleTaskTimeout",
+            "type": "string",
+            "tags": [],
+            "label": "ruleTaskTimeout",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "x-pack/plugins/alerting/common/alert_type.ts",
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "alerting",
+            "id": "def-common.AlertType.defaultScheduleInterval",
+            "type": "string",
+            "tags": [],
+            "label": "defaultScheduleInterval",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "x-pack/plugins/alerting/common/alert_type.ts",
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "alerting",
+            "id": "def-common.AlertType.minimumScheduleInterval",
+            "type": "string",
+            "tags": [],
+            "label": "minimumScheduleInterval",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "x-pack/plugins/alerting/common/alert_type.ts",
+            "deprecated": false
           }
         ],
         "initialIsOpen": false
@@ -4044,7 +4153,7 @@
             "section": "def-common.Alert",
             "text": "Alert"
           },
-          "<Params>, \"enabled\" | \"id\" | \"name\" | \"tags\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\"> & Pick<",
+          "<Params>, \"id\" | \"name\" | \"tags\" | \"enabled\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\"> & Pick<",
           {
             "pluginId": "core",
             "scope": "server",
@@ -4066,7 +4175,7 @@
         "label": "SanitizedAlert",
         "description": [],
         "signature": [
-          "{ enabled: boolean; id: string; name: string; tags: string[]; params: Params; actions: ",
+          "{ id: string; name: string; tags: string[]; enabled: boolean; params: Params; actions: ",
           {
             "pluginId": "alerting",
             "scope": "common",
@@ -4112,7 +4221,7 @@
             "section": "def-common.Alert",
             "text": "Alert"
           },
-          "<never>, \"enabled\" | \"id\" | \"name\" | \"tags\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">, \"enabled\" | \"name\" | \"tags\" | \"actions\" | \"throttle\" | \"consumer\" | \"schedule\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"notifyWhen\"> & { producer: string; ruleTypeId: string; ruleTypeName: string; }"
+          "<never>, \"id\" | \"name\" | \"tags\" | \"enabled\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">, \"name\" | \"tags\" | \"enabled\" | \"actions\" | \"throttle\" | \"consumer\" | \"schedule\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"notifyWhen\"> & { producer: string; ruleTypeId: string; ruleTypeName: string; }"
         ],
         "path": "x-pack/plugins/alerting/common/alert.ts",
         "deprecated": false,
diff --git a/api_docs/alerting.mdx b/api_docs/alerting.mdx
index 32a9195f2fd1d5..333c524db5e24d 100644
--- a/api_docs/alerting.mdx
+++ b/api_docs/alerting.mdx
@@ -18,7 +18,7 @@ Contact [Kibana Alerting](https://github.com/orgs/elastic/teams/kibana-alerting-
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 249 | 0 | 241 | 17 |
+| 257 | 0 | 249 | 17 |
 
 ## Client
 
diff --git a/api_docs/apm.json b/api_docs/apm.json
index 8b43370097091f..f0c84d9974c318 100644
--- a/api_docs/apm.json
+++ b/api_docs/apm.json
@@ -184,11 +184,11 @@
               "APMPluginStartDependencies",
               ", unknown>, plugins: Pick<",
               "APMPluginSetupDependencies",
-              ", \"data\" | \"cloud\" | \"security\" | \"home\" | \"features\" | \"fleet\" | \"ml\" | \"actions\" | \"usageCollection\" | \"spaces\" | \"apmOss\" | \"licensing\" | \"observability\" | \"ruleRegistry\" | \"taskManager\" | \"alerting\">) => { config$: ",
+              ", \"data\" | \"cloud\" | \"security\" | \"home\" | \"features\" | \"fleet\" | \"ml\" | \"spaces\" | \"actions\" | \"usageCollection\" | \"licensing\" | \"observability\" | \"ruleRegistry\" | \"taskManager\" | \"alerting\">) => { config$: ",
               "Observable",
-              "<{ 'apm_oss.transactionIndices': string; 'apm_oss.spanIndices': string; 'apm_oss.errorIndices': string; 'apm_oss.metricsIndices': string; 'apm_oss.sourcemapIndices': string; 'apm_oss.onboardingIndices': string; 'xpack.apm.serviceMapEnabled': boolean; 'xpack.apm.serviceMapFingerprintBucketSize': number; 'xpack.apm.serviceMapTraceIdBucketSize': number; 'xpack.apm.serviceMapFingerprintGlobalBucketSize': number; 'xpack.apm.serviceMapTraceIdGlobalBucketSize': number; 'xpack.apm.serviceMapMaxTracesPerRequest': number; 'xpack.apm.ui.enabled': boolean; 'xpack.apm.ui.maxTraceItems': number; 'xpack.apm.ui.transactionGroupBucketSize': number; 'xpack.apm.autocreateApmIndexPattern': boolean; 'xpack.apm.telemetryCollectionEnabled': boolean; 'xpack.apm.searchAggregatedTransactions': ",
+              "<Readonly<{} & { enabled: boolean; indices: Readonly<{} & { error: string; metric: string; span: string; transaction: string; sourcemap: string; onboarding: string; }>; serviceMapEnabled: boolean; serviceMapFingerprintBucketSize: number; serviceMapTraceIdBucketSize: number; serviceMapFingerprintGlobalBucketSize: number; serviceMapTraceIdGlobalBucketSize: number; serviceMapMaxTracesPerRequest: number; autocreateApmIndexPattern: boolean; ui: Readonly<{} & { enabled: boolean; transactionGroupBucketSize: number; maxTraceItems: number; }>; searchAggregatedTransactions: ",
               "SearchAggregatedTransactionSetting",
-              "; 'xpack.apm.metricsInterval': number; 'xpack.apm.agent.migrations.enabled': boolean; }>; getApmIndices: () => Promise<",
+              "; telemetryCollectionEnabled: boolean; metricsInterval: number; profilingEnabled: boolean; agent: Readonly<{} & { migrations: Readonly<{} & { enabled: boolean; }>; }>; }>>; getApmIndices: () => Promise<",
               "ApmIndicesConfig",
               ">; createApmEventClient: ({ request, context, debug, }: { debug?: boolean | undefined; request: ",
               {
@@ -248,7 +248,7 @@
                 "signature": [
                   "Pick<",
                   "APMPluginSetupDependencies",
-                  ", \"data\" | \"cloud\" | \"security\" | \"home\" | \"features\" | \"fleet\" | \"ml\" | \"actions\" | \"usageCollection\" | \"spaces\" | \"apmOss\" | \"licensing\" | \"observability\" | \"ruleRegistry\" | \"taskManager\" | \"alerting\">"
+                  ", \"data\" | \"cloud\" | \"security\" | \"home\" | \"features\" | \"fleet\" | \"ml\" | \"spaces\" | \"actions\" | \"usageCollection\" | \"licensing\" | \"observability\" | \"ruleRegistry\" | \"taskManager\" | \"alerting\">"
                 ],
                 "path": "x-pack/plugins/apm/server/plugin.ts",
                 "deprecated": false,
@@ -320,59 +320,7 @@
         "initialIsOpen": false
       }
     ],
-    "functions": [
-      {
-        "parentPluginId": "apm",
-        "id": "def-server.mergeConfigs",
-        "type": "Function",
-        "tags": [],
-        "label": "mergeConfigs",
-        "description": [],
-        "signature": [
-          "(apmOssConfig: Readonly<{} & { enabled: boolean; transactionIndices: string; spanIndices: string; errorIndices: string; metricsIndices: string; sourcemapIndices: string; onboardingIndices: string; indexPattern: string; fleetMode: boolean; }>, apmConfig: Readonly<{} & { enabled: boolean; serviceMapEnabled: boolean; serviceMapFingerprintBucketSize: number; serviceMapTraceIdBucketSize: number; serviceMapFingerprintGlobalBucketSize: number; serviceMapTraceIdGlobalBucketSize: number; serviceMapMaxTracesPerRequest: number; autocreateApmIndexPattern: boolean; ui: Readonly<{} & { enabled: boolean; transactionGroupBucketSize: number; maxTraceItems: number; }>; searchAggregatedTransactions: ",
-          "SearchAggregatedTransactionSetting",
-          "; telemetryCollectionEnabled: boolean; metricsInterval: number; profilingEnabled: boolean; agent: Readonly<{} & { migrations: Readonly<{} & { enabled: boolean; }>; }>; }>) => { 'apm_oss.transactionIndices': string; 'apm_oss.spanIndices': string; 'apm_oss.errorIndices': string; 'apm_oss.metricsIndices': string; 'apm_oss.sourcemapIndices': string; 'apm_oss.onboardingIndices': string; 'xpack.apm.serviceMapEnabled': boolean; 'xpack.apm.serviceMapFingerprintBucketSize': number; 'xpack.apm.serviceMapTraceIdBucketSize': number; 'xpack.apm.serviceMapFingerprintGlobalBucketSize': number; 'xpack.apm.serviceMapTraceIdGlobalBucketSize': number; 'xpack.apm.serviceMapMaxTracesPerRequest': number; 'xpack.apm.ui.enabled': boolean; 'xpack.apm.ui.maxTraceItems': number; 'xpack.apm.ui.transactionGroupBucketSize': number; 'xpack.apm.autocreateApmIndexPattern': boolean; 'xpack.apm.telemetryCollectionEnabled': boolean; 'xpack.apm.searchAggregatedTransactions': ",
-          "SearchAggregatedTransactionSetting",
-          "; 'xpack.apm.metricsInterval': number; 'xpack.apm.agent.migrations.enabled': boolean; }"
-        ],
-        "path": "x-pack/plugins/apm/server/index.ts",
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "apm",
-            "id": "def-server.mergeConfigs.$1",
-            "type": "Object",
-            "tags": [],
-            "label": "apmOssConfig",
-            "description": [],
-            "signature": [
-              "Readonly<{} & { enabled: boolean; transactionIndices: string; spanIndices: string; errorIndices: string; metricsIndices: string; sourcemapIndices: string; onboardingIndices: string; indexPattern: string; fleetMode: boolean; }>"
-            ],
-            "path": "x-pack/plugins/apm/server/index.ts",
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "apm",
-            "id": "def-server.mergeConfigs.$2",
-            "type": "Object",
-            "tags": [],
-            "label": "apmConfig",
-            "description": [],
-            "signature": [
-              "Readonly<{} & { enabled: boolean; serviceMapEnabled: boolean; serviceMapFingerprintBucketSize: number; serviceMapTraceIdBucketSize: number; serviceMapFingerprintGlobalBucketSize: number; serviceMapTraceIdGlobalBucketSize: number; serviceMapMaxTracesPerRequest: number; autocreateApmIndexPattern: boolean; ui: Readonly<{} & { enabled: boolean; transactionGroupBucketSize: number; maxTraceItems: number; }>; searchAggregatedTransactions: ",
-              "SearchAggregatedTransactionSetting",
-              "; telemetryCollectionEnabled: boolean; metricsInterval: number; profilingEnabled: boolean; agent: Readonly<{} & { migrations: Readonly<{} & { enabled: boolean; }>; }>; }>"
-            ],
-            "path": "x-pack/plugins/apm/server/index.ts",
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      }
-    ],
+    "functions": [],
     "interfaces": [
       {
         "parentPluginId": "apm",
@@ -440,9 +388,9 @@
             "label": "config",
             "description": [],
             "signature": [
-              "{ 'apm_oss.transactionIndices': string; 'apm_oss.spanIndices': string; 'apm_oss.errorIndices': string; 'apm_oss.metricsIndices': string; 'apm_oss.sourcemapIndices': string; 'apm_oss.onboardingIndices': string; 'xpack.apm.serviceMapEnabled': boolean; 'xpack.apm.serviceMapFingerprintBucketSize': number; 'xpack.apm.serviceMapTraceIdBucketSize': number; 'xpack.apm.serviceMapFingerprintGlobalBucketSize': number; 'xpack.apm.serviceMapTraceIdGlobalBucketSize': number; 'xpack.apm.serviceMapMaxTracesPerRequest': number; 'xpack.apm.ui.enabled': boolean; 'xpack.apm.ui.maxTraceItems': number; 'xpack.apm.ui.transactionGroupBucketSize': number; 'xpack.apm.autocreateApmIndexPattern': boolean; 'xpack.apm.telemetryCollectionEnabled': boolean; 'xpack.apm.searchAggregatedTransactions': ",
+              "{ readonly enabled: boolean; readonly indices: Readonly<{} & { error: string; metric: string; span: string; transaction: string; sourcemap: string; onboarding: string; }>; readonly serviceMapEnabled: boolean; readonly serviceMapFingerprintBucketSize: number; readonly serviceMapTraceIdBucketSize: number; readonly serviceMapFingerprintGlobalBucketSize: number; readonly serviceMapTraceIdGlobalBucketSize: number; readonly serviceMapMaxTracesPerRequest: number; readonly autocreateApmIndexPattern: boolean; readonly ui: Readonly<{} & { enabled: boolean; transactionGroupBucketSize: number; maxTraceItems: number; }>; readonly searchAggregatedTransactions: ",
               "SearchAggregatedTransactionSetting",
-              "; 'xpack.apm.metricsInterval': number; 'xpack.apm.agent.migrations.enabled': boolean; }"
+              "; readonly telemetryCollectionEnabled: boolean; readonly metricsInterval: number; readonly profilingEnabled: boolean; readonly agent: Readonly<{} & { migrations: Readonly<{} & { enabled: boolean; }>; }>; }"
             ],
             "path": "x-pack/plugins/apm/server/routes/typings.ts",
             "deprecated": false
@@ -535,15 +483,7 @@
                 "section": "def-server.PluginStartContract",
                 "text": "PluginStartContract"
               },
-              ">; }; apmOss: { setup: ",
-              {
-                "pluginId": "apmOss",
-                "scope": "server",
-                "docId": "kibApmOssPluginApi",
-                "section": "def-server.APMOSSPluginSetup",
-                "text": "APMOSSPluginSetup"
-              },
-              "; start: () => Promise<undefined>; }; licensing: { setup: ",
+              ">; }; licensing: { setup: ",
               {
                 "pluginId": "licensing",
                 "scope": "server",
@@ -655,7 +595,23 @@
               },
               ">; } | undefined; ml?: { setup: ",
               "SharedServices",
-              "; start: () => Promise<void>; } | undefined; actions?: { setup: ",
+              "; start: () => Promise<void>; } | undefined; spaces?: { setup: ",
+              {
+                "pluginId": "spaces",
+                "scope": "server",
+                "docId": "kibSpacesPluginApi",
+                "section": "def-server.SpacesPluginSetup",
+                "text": "SpacesPluginSetup"
+              },
+              "; start: () => Promise<",
+              {
+                "pluginId": "spaces",
+                "scope": "server",
+                "docId": "kibSpacesPluginApi",
+                "section": "def-server.SpacesPluginStart",
+                "text": "SpacesPluginStart"
+              },
+              ">; } | undefined; actions?: { setup: ",
               {
                 "pluginId": "actions",
                 "scope": "server",
@@ -679,23 +635,7 @@
                 "section": "def-server.UsageCollectionSetup",
                 "text": "UsageCollectionSetup"
               },
-              "; start: () => Promise<undefined>; } | undefined; spaces?: { setup: ",
-              {
-                "pluginId": "spaces",
-                "scope": "server",
-                "docId": "kibSpacesPluginApi",
-                "section": "def-server.SpacesPluginSetup",
-                "text": "SpacesPluginSetup"
-              },
-              "; start: () => Promise<",
-              {
-                "pluginId": "spaces",
-                "scope": "server",
-                "docId": "kibSpacesPluginApi",
-                "section": "def-server.SpacesPluginStart",
-                "text": "SpacesPluginStart"
-              },
-              ">; } | undefined; taskManager?: { setup: ",
+              "; start: () => Promise<undefined>; } | undefined; taskManager?: { setup: ",
               {
                 "pluginId": "taskManager",
                 "scope": "server",
@@ -825,9 +765,23 @@
         "label": "APMConfig",
         "description": [],
         "signature": [
-          "{ 'apm_oss.transactionIndices': string; 'apm_oss.spanIndices': string; 'apm_oss.errorIndices': string; 'apm_oss.metricsIndices': string; 'apm_oss.sourcemapIndices': string; 'apm_oss.onboardingIndices': string; 'xpack.apm.serviceMapEnabled': boolean; 'xpack.apm.serviceMapFingerprintBucketSize': number; 'xpack.apm.serviceMapTraceIdBucketSize': number; 'xpack.apm.serviceMapFingerprintGlobalBucketSize': number; 'xpack.apm.serviceMapTraceIdGlobalBucketSize': number; 'xpack.apm.serviceMapMaxTracesPerRequest': number; 'xpack.apm.ui.enabled': boolean; 'xpack.apm.ui.maxTraceItems': number; 'xpack.apm.ui.transactionGroupBucketSize': number; 'xpack.apm.autocreateApmIndexPattern': boolean; 'xpack.apm.telemetryCollectionEnabled': boolean; 'xpack.apm.searchAggregatedTransactions': ",
+          "{ readonly enabled: boolean; readonly indices: Readonly<{} & { error: string; metric: string; span: string; transaction: string; sourcemap: string; onboarding: string; }>; readonly serviceMapEnabled: boolean; readonly serviceMapFingerprintBucketSize: number; readonly serviceMapTraceIdBucketSize: number; readonly serviceMapFingerprintGlobalBucketSize: number; readonly serviceMapTraceIdGlobalBucketSize: number; readonly serviceMapMaxTracesPerRequest: number; readonly autocreateApmIndexPattern: boolean; readonly ui: Readonly<{} & { enabled: boolean; transactionGroupBucketSize: number; maxTraceItems: number; }>; readonly searchAggregatedTransactions: ",
           "SearchAggregatedTransactionSetting",
-          "; 'xpack.apm.metricsInterval': number; 'xpack.apm.agent.migrations.enabled': boolean; }"
+          "; readonly telemetryCollectionEnabled: boolean; readonly metricsInterval: number; readonly profilingEnabled: boolean; readonly agent: Readonly<{} & { migrations: Readonly<{} & { enabled: boolean; }>; }>; }"
+        ],
+        "path": "x-pack/plugins/apm/server/index.ts",
+        "deprecated": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "apm",
+        "id": "def-server.ApmIndicesConfigName",
+        "type": "Type",
+        "tags": [],
+        "label": "ApmIndicesConfigName",
+        "description": [],
+        "signature": [
+          "\"error\" | \"metric\" | \"span\" | \"transaction\" | \"sourcemap\" | \"onboarding\""
         ],
         "path": "x-pack/plugins/apm/server/index.ts",
         "deprecated": false,
@@ -4046,7 +4000,7 @@
             "section": "def-server.APMRouteHandlerResources",
             "text": "APMRouteHandlerResources"
           },
-          ", { apmIndexSettings: { configurationName: \"apm_oss.sourcemapIndices\" | \"apm_oss.errorIndices\" | \"apm_oss.onboardingIndices\" | \"apm_oss.spanIndices\" | \"apm_oss.transactionIndices\" | \"apm_oss.metricsIndices\" | \"apmAgentConfigurationIndex\" | \"apmCustomLinkIndex\"; defaultValue: string; savedValue: string | undefined; }[]; }, ",
+          ", { apmIndexSettings: { configurationName: \"error\" | \"metric\" | \"span\" | \"transaction\" | \"sourcemap\" | \"onboarding\"; defaultValue: string; savedValue: string | undefined; }[]; }, ",
           "APMRouteCreateOptions",
           ">; } & { \"GET /internal/apm/settings/apm-indices\": ",
           {
@@ -4080,19 +4034,7 @@
           "TypeC",
           "<{ body: ",
           "PartialC",
-          "<{ 'apm_oss.sourcemapIndices': ",
-          "StringC",
-          "; 'apm_oss.errorIndices': ",
-          "StringC",
-          "; 'apm_oss.onboardingIndices': ",
-          "StringC",
-          "; 'apm_oss.spanIndices': ",
-          "StringC",
-          "; 'apm_oss.transactionIndices': ",
-          "StringC",
-          "; 'apm_oss.metricsIndices': ",
-          "StringC",
-          "; }>; }>, ",
+          "<SaveApmIndicesBodySchema>; }>, ",
           {
             "pluginId": "apm",
             "scope": "server",
@@ -4959,22 +4901,6 @@
         "path": "x-pack/plugins/apm/server/routes/get_global_apm_server_route_repository.ts",
         "deprecated": false,
         "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "apm",
-        "id": "def-server.APMXPackConfig",
-        "type": "Type",
-        "tags": [],
-        "label": "APMXPackConfig",
-        "description": [],
-        "signature": [
-          "{ readonly enabled: boolean; readonly serviceMapEnabled: boolean; readonly serviceMapFingerprintBucketSize: number; readonly serviceMapTraceIdBucketSize: number; readonly serviceMapFingerprintGlobalBucketSize: number; readonly serviceMapTraceIdGlobalBucketSize: number; readonly serviceMapMaxTracesPerRequest: number; readonly autocreateApmIndexPattern: boolean; readonly ui: Readonly<{} & { enabled: boolean; transactionGroupBucketSize: number; maxTraceItems: number; }>; readonly searchAggregatedTransactions: ",
-          "SearchAggregatedTransactionSetting",
-          "; readonly telemetryCollectionEnabled: boolean; readonly metricsInterval: number; readonly profilingEnabled: boolean; readonly agent: Readonly<{} & { migrations: Readonly<{} & { enabled: boolean; }>; }>; }"
-        ],
-        "path": "x-pack/plugins/apm/server/index.ts",
-        "deprecated": false,
-        "initialIsOpen": false
       }
     ],
     "objects": [],
@@ -4997,9 +4923,9 @@
           "description": [],
           "signature": [
             "Observable",
-            "<{ 'apm_oss.transactionIndices': string; 'apm_oss.spanIndices': string; 'apm_oss.errorIndices': string; 'apm_oss.metricsIndices': string; 'apm_oss.sourcemapIndices': string; 'apm_oss.onboardingIndices': string; 'xpack.apm.serviceMapEnabled': boolean; 'xpack.apm.serviceMapFingerprintBucketSize': number; 'xpack.apm.serviceMapTraceIdBucketSize': number; 'xpack.apm.serviceMapFingerprintGlobalBucketSize': number; 'xpack.apm.serviceMapTraceIdGlobalBucketSize': number; 'xpack.apm.serviceMapMaxTracesPerRequest': number; 'xpack.apm.ui.enabled': boolean; 'xpack.apm.ui.maxTraceItems': number; 'xpack.apm.ui.transactionGroupBucketSize': number; 'xpack.apm.autocreateApmIndexPattern': boolean; 'xpack.apm.telemetryCollectionEnabled': boolean; 'xpack.apm.searchAggregatedTransactions': ",
+            "<Readonly<{} & { enabled: boolean; indices: Readonly<{} & { error: string; metric: string; span: string; transaction: string; sourcemap: string; onboarding: string; }>; serviceMapEnabled: boolean; serviceMapFingerprintBucketSize: number; serviceMapTraceIdBucketSize: number; serviceMapFingerprintGlobalBucketSize: number; serviceMapTraceIdGlobalBucketSize: number; serviceMapMaxTracesPerRequest: number; autocreateApmIndexPattern: boolean; ui: Readonly<{} & { enabled: boolean; transactionGroupBucketSize: number; maxTraceItems: number; }>; searchAggregatedTransactions: ",
             "SearchAggregatedTransactionSetting",
-            "; 'xpack.apm.metricsInterval': number; 'xpack.apm.agent.migrations.enabled': boolean; }>"
+            "; telemetryCollectionEnabled: boolean; metricsInterval: number; profilingEnabled: boolean; agent: Readonly<{} & { migrations: Readonly<{} & { enabled: boolean; }>; }>; }>>"
           ],
           "path": "x-pack/plugins/apm/server/types.ts",
           "deprecated": false
diff --git a/api_docs/apm.mdx b/api_docs/apm.mdx
index d9e53e6ec9df83..5daa09e8df84c4 100644
--- a/api_docs/apm.mdx
+++ b/api_docs/apm.mdx
@@ -18,7 +18,7 @@ Contact [APM UI](https://github.com/orgs/elastic/teams/apm-ui) for questions reg
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 42 | 0 | 42 | 37 |
+| 39 | 0 | 39 | 37 |
 
 ## Client
 
@@ -36,9 +36,6 @@ Contact [APM UI](https://github.com/orgs/elastic/teams/apm-ui) for questions reg
 ### Setup
 <DocDefinitionList data={[apmObj.server.setup]}/>
 
-### Functions
-<DocDefinitionList data={apmObj.server.functions}/>
-
 ### Classes
 <DocDefinitionList data={apmObj.server.classes}/>
 
diff --git a/api_docs/apm_oss.json b/api_docs/apm_oss.json
deleted file mode 100644
index adcf164f39450e..00000000000000
--- a/api_docs/apm_oss.json
+++ /dev/null
@@ -1,109 +0,0 @@
-{
-  "id": "apmOss",
-  "client": {
-    "classes": [],
-    "functions": [],
-    "interfaces": [],
-    "enums": [],
-    "misc": [],
-    "objects": [],
-    "setup": {
-      "parentPluginId": "apmOss",
-      "id": "def-public.ApmOssPluginSetup",
-      "type": "Interface",
-      "tags": [],
-      "label": "ApmOssPluginSetup",
-      "description": [],
-      "path": "src/plugins/apm_oss/public/types.ts",
-      "deprecated": false,
-      "children": [],
-      "lifecycle": "setup",
-      "initialIsOpen": true
-    },
-    "start": {
-      "parentPluginId": "apmOss",
-      "id": "def-public.ApmOssPluginStart",
-      "type": "Interface",
-      "tags": [],
-      "label": "ApmOssPluginStart",
-      "description": [],
-      "path": "src/plugins/apm_oss/public/types.ts",
-      "deprecated": false,
-      "children": [],
-      "lifecycle": "start",
-      "initialIsOpen": true
-    }
-  },
-  "server": {
-    "classes": [],
-    "functions": [],
-    "interfaces": [],
-    "enums": [],
-    "misc": [
-      {
-        "parentPluginId": "apmOss",
-        "id": "def-server.APMOSSConfig",
-        "type": "Type",
-        "tags": [],
-        "label": "APMOSSConfig",
-        "description": [],
-        "signature": [
-          "{ readonly enabled: boolean; readonly transactionIndices: string; readonly spanIndices: string; readonly errorIndices: string; readonly metricsIndices: string; readonly sourcemapIndices: string; readonly onboardingIndices: string; readonly indexPattern: string; readonly fleetMode: boolean; }"
-        ],
-        "path": "src/plugins/apm_oss/server/index.ts",
-        "deprecated": false,
-        "initialIsOpen": false
-      }
-    ],
-    "objects": [],
-    "setup": {
-      "parentPluginId": "apmOss",
-      "id": "def-server.APMOSSPluginSetup",
-      "type": "Interface",
-      "tags": [],
-      "label": "APMOSSPluginSetup",
-      "description": [],
-      "path": "src/plugins/apm_oss/server/plugin.ts",
-      "deprecated": false,
-      "children": [
-        {
-          "parentPluginId": "apmOss",
-          "id": "def-server.APMOSSPluginSetup.config",
-          "type": "Object",
-          "tags": [],
-          "label": "config",
-          "description": [],
-          "signature": [
-            "{ readonly enabled: boolean; readonly transactionIndices: string; readonly spanIndices: string; readonly errorIndices: string; readonly metricsIndices: string; readonly sourcemapIndices: string; readonly onboardingIndices: string; readonly indexPattern: string; readonly fleetMode: boolean; }"
-          ],
-          "path": "src/plugins/apm_oss/server/plugin.ts",
-          "deprecated": false
-        },
-        {
-          "parentPluginId": "apmOss",
-          "id": "def-server.APMOSSPluginSetup.config$",
-          "type": "Object",
-          "tags": [],
-          "label": "config$",
-          "description": [],
-          "signature": [
-            "Observable",
-            "<Readonly<{} & { enabled: boolean; transactionIndices: string; spanIndices: string; errorIndices: string; metricsIndices: string; sourcemapIndices: string; onboardingIndices: string; indexPattern: string; fleetMode: boolean; }>>"
-          ],
-          "path": "src/plugins/apm_oss/server/plugin.ts",
-          "deprecated": false
-        }
-      ],
-      "lifecycle": "setup",
-      "initialIsOpen": true
-    }
-  },
-  "common": {
-    "classes": [],
-    "functions": [],
-    "interfaces": [],
-    "enums": [],
-    "misc": [],
-    "objects": []
-  }
-}
\ No newline at end of file
diff --git a/api_docs/apm_oss.mdx b/api_docs/apm_oss.mdx
deleted file mode 100644
index 214147f9f46908..00000000000000
--- a/api_docs/apm_oss.mdx
+++ /dev/null
@@ -1,38 +0,0 @@
----
-id: kibApmOssPluginApi
-slug: /kibana-dev-docs/api/apmOss
-title: "apmOss"
-image: https://source.unsplash.com/400x175/?github
-summary: API docs for the apmOss plugin
-date: 2020-11-16
-tags: ['contributor', 'dev', 'apidocs', 'kibana', 'apmOss']
-warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info.
----
-import apmOssObj from './apm_oss.json';
-
-
-
-Contact [APM UI](https://github.com/orgs/elastic/teams/apm-ui) for questions regarding this plugin.
-
-**Code health stats**
-
-| Public API count  | Any count | Items lacking comments | Missing exports | 
-|-------------------|-----------|------------------------|-----------------|
-| 6 | 0 | 6 | 0 |
-
-## Client
-
-### Setup
-<DocDefinitionList data={[apmOssObj.client.setup]}/>
-
-### Start
-<DocDefinitionList data={[apmOssObj.client.start]}/>
-
-## Server
-
-### Setup
-<DocDefinitionList data={[apmOssObj.server.setup]}/>
-
-### Consts, variables and types
-<DocDefinitionList data={apmOssObj.server.misc}/>
-
diff --git a/api_docs/bfetch.json b/api_docs/bfetch.json
index c274b6a6d1ced4..4f9f7a33ebd3f8 100644
--- a/api_docs/bfetch.json
+++ b/api_docs/bfetch.json
@@ -238,86 +238,7 @@
       }
     ],
     "enums": [],
-    "misc": [
-      {
-        "parentPluginId": "bfetch",
-        "id": "def-server.StreamingRequestHandler",
-        "type": "Type",
-        "tags": [],
-        "label": "StreamingRequestHandler",
-        "description": [
-          "\nRequest handler modified to allow to return an observable.\n\nSee {@link BfetchServerSetup.createStreamingRequestHandler} for usage example."
-        ],
-        "signature": [
-          "(context: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCorePluginApi",
-            "section": "def-server.RequestHandlerContext",
-            "text": "RequestHandlerContext"
-          },
-          ", request: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.KibanaRequest",
-            "text": "KibanaRequest"
-          },
-          "<P, Q, B, Method>) => ",
-          "Observable",
-          "<Response> | Promise<",
-          "Observable",
-          "<Response>>"
-        ],
-        "path": "src/plugins/bfetch/server/types.ts",
-        "deprecated": false,
-        "returnComment": [],
-        "children": [
-          {
-            "parentPluginId": "bfetch",
-            "id": "def-server.StreamingRequestHandler.$1",
-            "type": "Object",
-            "tags": [],
-            "label": "context",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCorePluginApi",
-                "section": "def-server.RequestHandlerContext",
-                "text": "RequestHandlerContext"
-              }
-            ],
-            "path": "src/plugins/bfetch/server/types.ts",
-            "deprecated": false
-          },
-          {
-            "parentPluginId": "bfetch",
-            "id": "def-server.StreamingRequestHandler.$2",
-            "type": "Object",
-            "tags": [],
-            "label": "request",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreHttpPluginApi",
-                "section": "def-server.KibanaRequest",
-                "text": "KibanaRequest"
-              },
-              "<P, Q, B, Method>"
-            ],
-            "path": "src/plugins/bfetch/server/types.ts",
-            "deprecated": false
-          }
-        ],
-        "initialIsOpen": false
-      }
-    ],
+    "misc": [],
     "objects": [],
     "setup": {
       "parentPluginId": "bfetch",
@@ -480,259 +401,6 @@
             }
           ],
           "returnComment": []
-        },
-        {
-          "parentPluginId": "bfetch",
-          "id": "def-server.BfetchServerSetup.createStreamingRequestHandler",
-          "type": "Function",
-          "tags": [],
-          "label": "createStreamingRequestHandler",
-          "description": [
-            "\nCreate a streaming request handler to be able to use an Observable to return chunked content to the client.\nThis is meant to be used with the `fetchStreaming` API of the `bfetch` client-side plugin.\n"
-          ],
-          "signature": [
-            "<Response, P, Q, B, Context extends ",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCorePluginApi",
-              "section": "def-server.RequestHandlerContext",
-              "text": "RequestHandlerContext"
-            },
-            " = ",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCorePluginApi",
-              "section": "def-server.RequestHandlerContext",
-              "text": "RequestHandlerContext"
-            },
-            ", Method extends ",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCoreHttpPluginApi",
-              "section": "def-server.RouteMethod",
-              "text": "RouteMethod"
-            },
-            " = any>(streamHandler: ",
-            {
-              "pluginId": "bfetch",
-              "scope": "server",
-              "docId": "kibBfetchPluginApi",
-              "section": "def-server.StreamingRequestHandler",
-              "text": "StreamingRequestHandler"
-            },
-            "<Response, P, Q, B, Method>) => ",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCoreHttpPluginApi",
-              "section": "def-server.RequestHandler",
-              "text": "RequestHandler"
-            },
-            "<P, Q, B, Context, Method, { custom: <T extends string | Record<string, any> | Error | { message: string | Error; attributes?: Record<string, any> | undefined; } | Buffer | ",
-            "Stream",
-            " | undefined>(options: ",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCoreHttpPluginApi",
-              "section": "def-server.CustomHttpResponseOptions",
-              "text": "CustomHttpResponseOptions"
-            },
-            "<T>) => ",
-            "KibanaResponse",
-            "<T>; badRequest: (options?: ",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCoreHttpPluginApi",
-              "section": "def-server.ErrorHttpResponseOptions",
-              "text": "ErrorHttpResponseOptions"
-            },
-            ") => ",
-            "KibanaResponse",
-            "<",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCoreHttpPluginApi",
-              "section": "def-server.ResponseError",
-              "text": "ResponseError"
-            },
-            ">; unauthorized: (options?: ",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCoreHttpPluginApi",
-              "section": "def-server.ErrorHttpResponseOptions",
-              "text": "ErrorHttpResponseOptions"
-            },
-            ") => ",
-            "KibanaResponse",
-            "<",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCoreHttpPluginApi",
-              "section": "def-server.ResponseError",
-              "text": "ResponseError"
-            },
-            ">; forbidden: (options?: ",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCoreHttpPluginApi",
-              "section": "def-server.ErrorHttpResponseOptions",
-              "text": "ErrorHttpResponseOptions"
-            },
-            ") => ",
-            "KibanaResponse",
-            "<",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCoreHttpPluginApi",
-              "section": "def-server.ResponseError",
-              "text": "ResponseError"
-            },
-            ">; notFound: (options?: ",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCoreHttpPluginApi",
-              "section": "def-server.ErrorHttpResponseOptions",
-              "text": "ErrorHttpResponseOptions"
-            },
-            ") => ",
-            "KibanaResponse",
-            "<",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCoreHttpPluginApi",
-              "section": "def-server.ResponseError",
-              "text": "ResponseError"
-            },
-            ">; conflict: (options?: ",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCoreHttpPluginApi",
-              "section": "def-server.ErrorHttpResponseOptions",
-              "text": "ErrorHttpResponseOptions"
-            },
-            ") => ",
-            "KibanaResponse",
-            "<",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCoreHttpPluginApi",
-              "section": "def-server.ResponseError",
-              "text": "ResponseError"
-            },
-            ">; customError: (options: ",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCoreHttpPluginApi",
-              "section": "def-server.CustomHttpResponseOptions",
-              "text": "CustomHttpResponseOptions"
-            },
-            "<",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCoreHttpPluginApi",
-              "section": "def-server.ResponseError",
-              "text": "ResponseError"
-            },
-            ">) => ",
-            "KibanaResponse",
-            "<",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCoreHttpPluginApi",
-              "section": "def-server.ResponseError",
-              "text": "ResponseError"
-            },
-            ">; redirected: (options: ",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCoreHttpPluginApi",
-              "section": "def-server.RedirectResponseOptions",
-              "text": "RedirectResponseOptions"
-            },
-            ") => ",
-            "KibanaResponse",
-            "<string | Record<string, any> | Buffer | ",
-            "Stream",
-            ">; ok: (options?: ",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCoreHttpPluginApi",
-              "section": "def-server.HttpResponseOptions",
-              "text": "HttpResponseOptions"
-            },
-            ") => ",
-            "KibanaResponse",
-            "<string | Record<string, any> | Buffer | ",
-            "Stream",
-            ">; accepted: (options?: ",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCoreHttpPluginApi",
-              "section": "def-server.HttpResponseOptions",
-              "text": "HttpResponseOptions"
-            },
-            ") => ",
-            "KibanaResponse",
-            "<string | Record<string, any> | Buffer | ",
-            "Stream",
-            ">; noContent: (options?: ",
-            {
-              "pluginId": "core",
-              "scope": "server",
-              "docId": "kibCoreHttpPluginApi",
-              "section": "def-server.HttpResponseOptions",
-              "text": "HttpResponseOptions"
-            },
-            ") => ",
-            "KibanaResponse",
-            "<undefined>; }>"
-          ],
-          "path": "src/plugins/bfetch/server/plugin.ts",
-          "deprecated": false,
-          "children": [
-            {
-              "parentPluginId": "bfetch",
-              "id": "def-server.BfetchServerSetup.createStreamingRequestHandler.$1",
-              "type": "Function",
-              "tags": [],
-              "label": "streamHandler",
-              "description": [],
-              "signature": [
-                {
-                  "pluginId": "bfetch",
-                  "scope": "server",
-                  "docId": "kibBfetchPluginApi",
-                  "section": "def-server.StreamingRequestHandler",
-                  "text": "StreamingRequestHandler"
-                },
-                "<Response, P, Q, B, Method>"
-              ],
-              "path": "src/plugins/bfetch/server/plugin.ts",
-              "deprecated": false,
-              "isRequired": true
-            }
-          ],
-          "returnComment": []
         }
       ],
       "lifecycle": "setup",
@@ -1024,6 +692,65 @@
       }
     ],
     "functions": [
+      {
+        "parentPluginId": "bfetch",
+        "id": "def-common.appendQueryParam",
+        "type": "Function",
+        "tags": [],
+        "label": "appendQueryParam",
+        "description": [],
+        "signature": [
+          "(url: string, key: string, value: string) => string"
+        ],
+        "path": "src/plugins/bfetch/common/util/query_params.ts",
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "bfetch",
+            "id": "def-common.appendQueryParam.$1",
+            "type": "string",
+            "tags": [],
+            "label": "url",
+            "description": [],
+            "signature": [
+              "string"
+            ],
+            "path": "src/plugins/bfetch/common/util/query_params.ts",
+            "deprecated": false,
+            "isRequired": true
+          },
+          {
+            "parentPluginId": "bfetch",
+            "id": "def-common.appendQueryParam.$2",
+            "type": "string",
+            "tags": [],
+            "label": "key",
+            "description": [],
+            "signature": [
+              "string"
+            ],
+            "path": "src/plugins/bfetch/common/util/query_params.ts",
+            "deprecated": false,
+            "isRequired": true
+          },
+          {
+            "parentPluginId": "bfetch",
+            "id": "def-common.appendQueryParam.$3",
+            "type": "string",
+            "tags": [],
+            "label": "value",
+            "description": [],
+            "signature": [
+              "string"
+            ],
+            "path": "src/plugins/bfetch/common/util/query_params.ts",
+            "deprecated": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "bfetch",
         "id": "def-common.createBatchedFunction",
diff --git a/api_docs/bfetch.mdx b/api_docs/bfetch.mdx
index 25e77b77317907..ca32afc24e1661 100644
--- a/api_docs/bfetch.mdx
+++ b/api_docs/bfetch.mdx
@@ -18,7 +18,7 @@ Contact [App Services](https://github.com/orgs/elastic/teams/kibana-app-services
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 77 | 1 | 66 | 2 |
+| 76 | 1 | 67 | 2 |
 
 ## Client
 
@@ -42,9 +42,6 @@ Contact [App Services](https://github.com/orgs/elastic/teams/kibana-app-services
 ### Interfaces
 <DocDefinitionList data={bfetchObj.server.interfaces}/>
 
-### Consts, variables and types
-<DocDefinitionList data={bfetchObj.server.misc}/>
-
 ## Common
 
 ### Functions
diff --git a/api_docs/cases.json b/api_docs/cases.json
index 062235d8ed6798..c35220cda3c663 100644
--- a/api_docs/cases.json
+++ b/api_docs/cases.json
@@ -2948,7 +2948,7 @@
             "label": "action",
             "description": [],
             "signature": [
-              "\"add\" | \"delete\" | \"create\" | \"update\" | \"push-to-service\""
+              "\"add\" | \"create\" | \"delete\" | \"update\" | \"push-to-service\""
             ],
             "path": "x-pack/plugins/cases/common/ui/types.ts",
             "deprecated": false
@@ -4964,6 +4964,26 @@
         "deprecated": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "cases",
+        "id": "def-common.CaseActionConnector",
+        "type": "Type",
+        "tags": [],
+        "label": "CaseActionConnector",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "actions",
+            "scope": "common",
+            "docId": "kibActionsPluginApi",
+            "section": "def-common.ActionResult",
+            "text": "ActionResult"
+          }
+        ],
+        "path": "x-pack/plugins/cases/common/ui/types.ts",
+        "deprecated": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "cases",
         "id": "def-common.CaseAttributes",
@@ -6776,7 +6796,7 @@
         "label": "CaseUserActionAttributes",
         "description": [],
         "signature": [
-          "{ action_field: (\"status\" | \"title\" | \"description\" | \"tags\" | \"comment\" | \"settings\" | \"owner\" | \"connector\" | \"pushed\" | \"sub_case\")[]; action: \"add\" | \"delete\" | \"create\" | \"update\" | \"push-to-service\"; action_at: string; action_by: { email: string | null | undefined; full_name: string | null | undefined; username: string | null | undefined; }; new_value: string | null; old_value: string | null; owner: string; }"
+          "{ action_field: (\"status\" | \"title\" | \"description\" | \"tags\" | \"comment\" | \"settings\" | \"owner\" | \"connector\" | \"pushed\" | \"sub_case\")[]; action: \"add\" | \"create\" | \"delete\" | \"update\" | \"push-to-service\"; action_at: string; action_by: { email: string | null | undefined; full_name: string | null | undefined; username: string | null | undefined; }; new_value: string | null; old_value: string | null; owner: string; }"
         ],
         "path": "x-pack/plugins/cases/common/api/cases/user_actions.ts",
         "deprecated": false,
@@ -6852,7 +6872,7 @@
         "label": "CaseUserActionResponse",
         "description": [],
         "signature": [
-          "{ action_field: (\"status\" | \"title\" | \"description\" | \"tags\" | \"comment\" | \"settings\" | \"owner\" | \"connector\" | \"pushed\" | \"sub_case\")[]; action: \"add\" | \"delete\" | \"create\" | \"update\" | \"push-to-service\"; action_at: string; action_by: { email: string | null | undefined; full_name: string | null | undefined; username: string | null | undefined; }; new_value: string | null; old_value: string | null; owner: string; } & { action_id: string; case_id: string; comment_id: string | null; new_val_connector_id: string | null; old_val_connector_id: string | null; } & { sub_case_id?: string | undefined; }"
+          "{ action_field: (\"status\" | \"title\" | \"description\" | \"tags\" | \"comment\" | \"settings\" | \"owner\" | \"connector\" | \"pushed\" | \"sub_case\")[]; action: \"add\" | \"create\" | \"delete\" | \"update\" | \"push-to-service\"; action_at: string; action_by: { email: string | null | undefined; full_name: string | null | undefined; username: string | null | undefined; }; new_value: string | null; old_value: string | null; owner: string; } & { action_id: string; case_id: string; comment_id: string | null; new_val_connector_id: string | null; old_val_connector_id: string | null; } & { sub_case_id?: string | undefined; }"
         ],
         "path": "x-pack/plugins/cases/common/api/cases/user_actions.ts",
         "deprecated": false,
@@ -6866,7 +6886,7 @@
         "label": "CaseUserActionsResponse",
         "description": [],
         "signature": [
-          "({ action_field: (\"status\" | \"title\" | \"description\" | \"tags\" | \"comment\" | \"settings\" | \"owner\" | \"connector\" | \"pushed\" | \"sub_case\")[]; action: \"add\" | \"delete\" | \"create\" | \"update\" | \"push-to-service\"; action_at: string; action_by: { email: string | null | undefined; full_name: string | null | undefined; username: string | null | undefined; }; new_value: string | null; old_value: string | null; owner: string; } & { action_id: string; case_id: string; comment_id: string | null; new_val_connector_id: string | null; old_val_connector_id: string | null; } & { sub_case_id?: string | undefined; })[]"
+          "({ action_field: (\"status\" | \"title\" | \"description\" | \"tags\" | \"comment\" | \"settings\" | \"owner\" | \"connector\" | \"pushed\" | \"sub_case\")[]; action: \"add\" | \"create\" | \"delete\" | \"update\" | \"push-to-service\"; action_at: string; action_by: { email: string | null | undefined; full_name: string | null | undefined; username: string | null | undefined; }; new_value: string | null; old_value: string | null; owner: string; } & { action_id: string; case_id: string; comment_id: string | null; new_val_connector_id: string | null; old_val_connector_id: string | null; } & { sub_case_id?: string | undefined; })[]"
         ],
         "path": "x-pack/plugins/cases/common/api/cases/user_actions.ts",
         "deprecated": false,
@@ -8573,7 +8593,7 @@
         "label": "UserAction",
         "description": [],
         "signature": [
-          "\"add\" | \"delete\" | \"create\" | \"update\" | \"push-to-service\""
+          "\"add\" | \"create\" | \"delete\" | \"update\" | \"push-to-service\""
         ],
         "path": "x-pack/plugins/cases/common/api/cases/user_actions.ts",
         "deprecated": false,
diff --git a/api_docs/cases.mdx b/api_docs/cases.mdx
index 4d2c96b89917f6..9400133d89bda0 100644
--- a/api_docs/cases.mdx
+++ b/api_docs/cases.mdx
@@ -18,7 +18,7 @@ Contact [Security Solution Threat Hunting](https://github.com/orgs/elastic/teams
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 475 | 0 | 431 | 14 |
+| 476 | 0 | 432 | 14 |
 
 ## Client
 
diff --git a/api_docs/charts.json b/api_docs/charts.json
index 83a2a93df42a16..d6ad087ad16014 100644
--- a/api_docs/charts.json
+++ b/api_docs/charts.json
@@ -4266,4 +4266,4 @@
       }
     ]
   }
-}
+}
\ No newline at end of file
diff --git a/api_docs/core.json b/api_docs/core.json
index c288037b4486dd..e09641530635e9 100644
--- a/api_docs/core.json
+++ b/api_docs/core.json
@@ -1603,7 +1603,7 @@
             "label": "links",
             "description": [],
             "signature": [
-              "{ readonly settings: string; readonly apm: { readonly kibanaSettings: string; readonly supportedServiceMaps: string; readonly customLinks: string; readonly droppedTransactionSpans: string; readonly upgrading: string; readonly metaData: string; }; readonly canvas: { readonly guide: string; }; readonly dashboard: { readonly guide: string; readonly drilldowns: string; readonly drilldownsTriggerPicker: string; readonly urlDrilldownTemplateSyntax: string; readonly urlDrilldownVariables: string; }; readonly discover: Record<string, string>; readonly filebeat: { readonly base: string; readonly installation: string; readonly configuration: string; readonly elasticsearchOutput: string; readonly elasticsearchModule: string; readonly startup: string; readonly exportedFields: string; readonly suricataModule: string; readonly zeekModule: string; }; readonly auditbeat: { readonly base: string; readonly auditdModule: string; readonly systemModule: string; }; readonly metricbeat: { readonly base: string; readonly configure: string; readonly httpEndpoint: string; readonly install: string; readonly start: string; }; readonly enterpriseSearch: { readonly base: string; readonly appSearchBase: string; readonly workplaceSearchBase: string; }; readonly heartbeat: { readonly base: string; }; readonly libbeat: { readonly getStarted: string; }; readonly logstash: { readonly base: string; }; readonly functionbeat: { readonly base: string; }; readonly winlogbeat: { readonly base: string; }; readonly aggs: { readonly composite: string; readonly composite_missing_bucket: string; readonly date_histogram: string; readonly date_range: string; readonly date_format_pattern: string; readonly filter: string; readonly filters: string; readonly geohash_grid: string; readonly histogram: string; readonly ip_range: string; readonly range: string; readonly significant_terms: string; readonly terms: string; readonly avg: string; readonly avg_bucket: string; readonly max_bucket: string; readonly min_bucket: string; readonly sum_bucket: string; readonly cardinality: string; readonly count: string; readonly cumulative_sum: string; readonly derivative: string; readonly geo_bounds: string; readonly geo_centroid: string; readonly max: string; readonly median: string; readonly min: string; readonly moving_avg: string; readonly percentile_ranks: string; readonly serial_diff: string; readonly std_dev: string; readonly sum: string; readonly top_hits: string; }; readonly runtimeFields: { readonly overview: string; readonly mapping: string; }; readonly scriptedFields: { readonly scriptFields: string; readonly scriptAggs: string; readonly painless: string; readonly painlessApi: string; readonly painlessLangSpec: string; readonly painlessSyntax: string; readonly painlessWalkthrough: string; readonly luceneExpressions: string; }; readonly search: { readonly sessions: string; readonly sessionLimits: string; }; readonly indexPatterns: { readonly introduction: string; readonly fieldFormattersNumber: string; readonly fieldFormattersString: string; readonly runtimeFields: string; }; readonly addData: string; readonly kibana: string; readonly upgradeAssistant: string; readonly rollupJobs: string; readonly elasticsearch: Record<string, string>; readonly siem: { readonly privileges: string; readonly guide: string; readonly gettingStarted: string; readonly ml: string; readonly ruleChangeLog: string; readonly detectionsReq: string; readonly networkMap: string; readonly troubleshootGaps: string; }; readonly query: { readonly eql: string; readonly kueryQuerySyntax: string; readonly luceneQuerySyntax: string; readonly percolate: string; readonly queryDsl: string; readonly autocompleteChanges: string; }; readonly date: { readonly dateMath: string; readonly dateMathIndexNames: string; }; readonly management: Record<string, string>; readonly ml: Record<string, string>; readonly transforms: Record<string, string>; readonly visualize: Record<string, string>; readonly apis: Readonly<{ bulkIndexAlias: string; byteSizeUnits: string; createAutoFollowPattern: string; createFollower: string; createIndex: string; createSnapshotLifecyclePolicy: string; createRoleMapping: string; createRoleMappingTemplates: string; createRollupJobsRequest: string; createApiKey: string; createPipeline: string; createTransformRequest: string; cronExpressions: string; executeWatchActionModes: string; indexExists: string; openIndex: string; putComponentTemplate: string; painlessExecute: string; painlessExecuteAPIContexts: string; putComponentTemplateMetadata: string; putSnapshotLifecyclePolicy: string; putIndexTemplateV1: string; putWatch: string; simulatePipeline: string; timeUnits: string; updateTransform: string; }>; readonly observability: Readonly<{ guide: string; infrastructureThreshold: string; logsThreshold: string; metricsThreshold: string; monitorStatus: string; monitorUptime: string; tlsCertificate: string; uptimeDurationAnomaly: string; }>; readonly alerting: Record<string, string>; readonly maps: Record<string, string>; readonly monitoring: Record<string, string>; readonly security: Readonly<{ apiKeyServiceSettings: string; clusterPrivileges: string; elasticsearchSettings: string; elasticsearchEnableSecurity: string; indicesPrivileges: string; kibanaTLS: string; kibanaPrivileges: string; mappingRoles: string; mappingRolesFieldRules: string; runAsPrivilege: string; }>; readonly spaces: Readonly<{ kibanaLegacyUrlAliases: string; kibanaDisableLegacyUrlAliasesApi: string; }>; readonly watcher: Record<string, string>; readonly ccs: Record<string, string>; readonly plugins: Record<string, string>; readonly snapshotRestore: Record<string, string>; readonly ingest: Record<string, string>; readonly fleet: Readonly<{ guide: string; fleetServer: string; fleetServerAddFleetServer: string; settings: string; settingsFleetServerHostSettings: string; troubleshooting: string; elasticAgent: string; datastreams: string; datastreamsNamingScheme: string; upgradeElasticAgent: string; upgradeElasticAgent712lower: string; learnMoreBlog: string; }>; readonly ecs: { readonly guide: string; }; readonly clients: { readonly guide: string; readonly goOverview: string; readonly javaIndex: string; readonly jsIntro: string; readonly netGuide: string; readonly perlGuide: string; readonly phpGuide: string; readonly pythonGuide: string; readonly rubyOverview: string; readonly rustGuide: string; }; }"
+              "{ readonly settings: string; readonly elasticStackGetStarted: string; readonly apm: { readonly kibanaSettings: string; readonly supportedServiceMaps: string; readonly customLinks: string; readonly droppedTransactionSpans: string; readonly upgrading: string; readonly metaData: string; }; readonly canvas: { readonly guide: string; }; readonly dashboard: { readonly guide: string; readonly drilldowns: string; readonly drilldownsTriggerPicker: string; readonly urlDrilldownTemplateSyntax: string; readonly urlDrilldownVariables: string; }; readonly discover: Record<string, string>; readonly filebeat: { readonly base: string; readonly installation: string; readonly configuration: string; readonly elasticsearchOutput: string; readonly elasticsearchModule: string; readonly startup: string; readonly exportedFields: string; readonly suricataModule: string; readonly zeekModule: string; }; readonly auditbeat: { readonly base: string; readonly auditdModule: string; readonly systemModule: string; }; readonly metricbeat: { readonly base: string; readonly configure: string; readonly httpEndpoint: string; readonly install: string; readonly start: string; }; readonly enterpriseSearch: { readonly base: string; readonly appSearchBase: string; readonly workplaceSearchBase: string; }; readonly heartbeat: { readonly base: string; }; readonly libbeat: { readonly getStarted: string; }; readonly logstash: { readonly base: string; }; readonly functionbeat: { readonly base: string; }; readonly winlogbeat: { readonly base: string; }; readonly aggs: { readonly composite: string; readonly composite_missing_bucket: string; readonly date_histogram: string; readonly date_range: string; readonly date_format_pattern: string; readonly filter: string; readonly filters: string; readonly geohash_grid: string; readonly histogram: string; readonly ip_range: string; readonly range: string; readonly significant_terms: string; readonly terms: string; readonly avg: string; readonly avg_bucket: string; readonly max_bucket: string; readonly min_bucket: string; readonly sum_bucket: string; readonly cardinality: string; readonly count: string; readonly cumulative_sum: string; readonly derivative: string; readonly geo_bounds: string; readonly geo_centroid: string; readonly max: string; readonly median: string; readonly min: string; readonly moving_avg: string; readonly percentile_ranks: string; readonly serial_diff: string; readonly std_dev: string; readonly sum: string; readonly top_hits: string; }; readonly runtimeFields: { readonly overview: string; readonly mapping: string; }; readonly scriptedFields: { readonly scriptFields: string; readonly scriptAggs: string; readonly painless: string; readonly painlessApi: string; readonly painlessLangSpec: string; readonly painlessSyntax: string; readonly painlessWalkthrough: string; readonly luceneExpressions: string; }; readonly search: { readonly sessions: string; readonly sessionLimits: string; }; readonly indexPatterns: { readonly introduction: string; readonly fieldFormattersNumber: string; readonly fieldFormattersString: string; readonly runtimeFields: string; }; readonly addData: string; readonly kibana: string; readonly upgradeAssistant: string; readonly rollupJobs: string; readonly elasticsearch: Record<string, string>; readonly siem: { readonly privileges: string; readonly guide: string; readonly gettingStarted: string; readonly ml: string; readonly ruleChangeLog: string; readonly detectionsReq: string; readonly networkMap: string; readonly troubleshootGaps: string; }; readonly securitySolution: { readonly trustedApps: string; }; readonly query: { readonly eql: string; readonly kueryQuerySyntax: string; readonly luceneQuerySyntax: string; readonly percolate: string; readonly queryDsl: string; readonly autocompleteChanges: string; }; readonly date: { readonly dateMath: string; readonly dateMathIndexNames: string; }; readonly management: Record<string, string>; readonly ml: Record<string, string>; readonly transforms: Record<string, string>; readonly visualize: Record<string, string>; readonly apis: Readonly<{ bulkIndexAlias: string; byteSizeUnits: string; createAutoFollowPattern: string; createFollower: string; createIndex: string; createSnapshotLifecyclePolicy: string; createRoleMapping: string; createRoleMappingTemplates: string; createRollupJobsRequest: string; createApiKey: string; createPipeline: string; createTransformRequest: string; cronExpressions: string; executeWatchActionModes: string; indexExists: string; openIndex: string; putComponentTemplate: string; painlessExecute: string; painlessExecuteAPIContexts: string; putComponentTemplateMetadata: string; putSnapshotLifecyclePolicy: string; putIndexTemplateV1: string; putWatch: string; simulatePipeline: string; timeUnits: string; updateTransform: string; }>; readonly observability: Readonly<{ guide: string; infrastructureThreshold: string; logsThreshold: string; metricsThreshold: string; monitorStatus: string; monitorUptime: string; tlsCertificate: string; uptimeDurationAnomaly: string; }>; readonly alerting: Record<string, string>; readonly maps: Record<string, string>; readonly monitoring: Record<string, string>; readonly security: Readonly<{ apiKeyServiceSettings: string; clusterPrivileges: string; elasticsearchSettings: string; elasticsearchEnableSecurity: string; indicesPrivileges: string; kibanaTLS: string; kibanaPrivileges: string; mappingRoles: string; mappingRolesFieldRules: string; runAsPrivilege: string; }>; readonly spaces: Readonly<{ kibanaLegacyUrlAliases: string; kibanaDisableLegacyUrlAliasesApi: string; }>; readonly watcher: Record<string, string>; readonly ccs: Record<string, string>; readonly plugins: Record<string, string>; readonly snapshotRestore: Record<string, string>; readonly ingest: Record<string, string>; readonly fleet: Readonly<{ guide: string; fleetServer: string; fleetServerAddFleetServer: string; settings: string; settingsFleetServerHostSettings: string; troubleshooting: string; elasticAgent: string; datastreams: string; datastreamsNamingScheme: string; upgradeElasticAgent: string; upgradeElasticAgent712lower: string; learnMoreBlog: string; apiKeysLearnMore: string; }>; readonly ecs: { readonly guide: string; }; readonly clients: { readonly guide: string; readonly goOverview: string; readonly javaIndex: string; readonly jsIntro: string; readonly netGuide: string; readonly perlGuide: string; readonly phpGuide: string; readonly pythonGuide: string; readonly rubyOverview: string; readonly rustGuide: string; }; }"
             ],
             "path": "src/core/public/doc_links/doc_links_service.ts",
             "deprecated": false
@@ -2079,7 +2079,7 @@
             "signature": [
               "() => Readonly<Record<string, Pick<",
               "UiSettingsParams",
-              "<unknown>, \"type\" | \"options\" | \"description\" | \"name\" | \"order\" | \"value\" | \"category\" | \"optionLabels\" | \"requiresPageReload\" | \"readonly\" | \"sensitive\" | \"deprecation\" | \"metric\"> & ",
+              "<unknown>, \"type\" | \"description\" | \"name\" | \"options\" | \"order\" | \"value\" | \"category\" | \"optionLabels\" | \"requiresPageReload\" | \"readonly\" | \"sensitive\" | \"deprecation\" | \"metric\"> & ",
               "UserProvidedValues",
               "<any>>>"
             ],
@@ -3265,7 +3265,7 @@
             "label": "buttonColor",
             "description": [],
             "signature": [
-              "\"warning\" | \"text\" | \"primary\" | \"success\" | \"danger\" | \"accent\" | \"secondary\" | \"ghost\" | undefined"
+              "\"text\" | \"primary\" | \"success\" | \"warning\" | \"danger\" | \"accent\" | \"secondary\" | \"ghost\" | undefined"
             ],
             "path": "src/core/public/overlays/modal/modal_service.tsx",
             "deprecated": false
@@ -6622,7 +6622,7 @@
           "\nA sub-set of {@link UiSettingsParams} exposed to the client-side."
         ],
         "signature": [
-          "{ type?: \"string\" | \"number\" | \"boolean\" | \"undefined\" | \"color\" | \"json\" | \"image\" | \"markdown\" | \"select\" | \"array\" | undefined; options?: string[] | undefined; description?: string | undefined; name?: string | undefined; order?: number | undefined; value?: unknown; category?: string[] | undefined; optionLabels?: Record<string, string> | undefined; requiresPageReload?: boolean | undefined; readonly?: boolean | undefined; sensitive?: boolean | undefined; deprecation?: ",
+          "{ type?: \"string\" | \"number\" | \"boolean\" | \"undefined\" | \"color\" | \"json\" | \"image\" | \"markdown\" | \"select\" | \"array\" | undefined; description?: string | undefined; name?: string | undefined; options?: string[] | undefined; order?: number | undefined; value?: unknown; category?: string[] | undefined; optionLabels?: Record<string, string> | undefined; requiresPageReload?: boolean | undefined; readonly?: boolean | undefined; sensitive?: boolean | undefined; deprecation?: ",
           "DeprecationSettings",
           " | undefined; metric?: { type: ",
           {
@@ -7291,19 +7291,6 @@
             "path": "src/core/server/csp/csp_config.ts",
             "deprecated": false
           },
-          {
-            "parentPluginId": "core",
-            "id": "def-server.CspConfig.rules",
-            "type": "Array",
-            "tags": [],
-            "label": "rules",
-            "description": [],
-            "signature": [
-              "string[]"
-            ],
-            "path": "src/core/server/csp/csp_config.ts",
-            "deprecated": false
-          },
           {
             "parentPluginId": "core",
             "id": "def-server.CspConfig.strict",
@@ -9627,7 +9614,7 @@
               "corrective action needed to fix this deprecation."
             ],
             "signature": [
-              "{ api?: { path: string; method: \"PUT\" | \"POST\"; body?: { [key: string]: any; } | undefined; } | undefined; manualSteps: string[]; }"
+              "{ api?: { path: string; method: \"PUT\" | \"POST\"; body?: { [key: string]: any; } | undefined; omitContextFromBody?: boolean | undefined; } | undefined; manualSteps: string[]; }"
             ],
             "path": "src/core/server/deprecations/types.ts",
             "deprecated": false
@@ -10345,7 +10332,7 @@
               "Headers used for authentication against Elasticsearch"
             ],
             "signature": [
-              "{ accept?: string | string[] | undefined; \"accept-language\"?: string | string[] | undefined; \"accept-patch\"?: string | string[] | undefined; \"accept-ranges\"?: string | string[] | undefined; \"access-control-allow-credentials\"?: string | string[] | undefined; \"access-control-allow-headers\"?: string | string[] | undefined; \"access-control-allow-methods\"?: string | string[] | undefined; \"access-control-allow-origin\"?: string | string[] | undefined; \"access-control-expose-headers\"?: string | string[] | undefined; \"access-control-max-age\"?: string | string[] | undefined; \"access-control-request-headers\"?: string | string[] | undefined; \"access-control-request-method\"?: string | string[] | undefined; age?: string | string[] | undefined; allow?: string | string[] | undefined; \"alt-svc\"?: string | string[] | undefined; authorization?: string | string[] | undefined; \"cache-control\"?: string | string[] | undefined; connection?: string | string[] | undefined; \"content-disposition\"?: string | string[] | undefined; \"content-encoding\"?: string | string[] | undefined; \"content-language\"?: string | string[] | undefined; \"content-length\"?: string | string[] | undefined; \"content-location\"?: string | string[] | undefined; \"content-range\"?: string | string[] | undefined; \"content-type\"?: string | string[] | undefined; cookie?: string | string[] | undefined; date?: string | string[] | undefined; expect?: string | string[] | undefined; expires?: string | string[] | undefined; forwarded?: string | string[] | undefined; from?: string | string[] | undefined; host?: string | string[] | undefined; \"if-match\"?: string | string[] | undefined; \"if-modified-since\"?: string | string[] | undefined; \"if-none-match\"?: string | string[] | undefined; \"if-unmodified-since\"?: string | string[] | undefined; \"last-modified\"?: string | string[] | undefined; location?: string | string[] | undefined; origin?: string | string[] | undefined; pragma?: string | string[] | undefined; \"proxy-authenticate\"?: string | string[] | undefined; \"proxy-authorization\"?: string | string[] | undefined; \"public-key-pins\"?: string | string[] | undefined; range?: string | string[] | undefined; referer?: string | string[] | undefined; \"retry-after\"?: string | string[] | undefined; \"sec-websocket-accept\"?: string | string[] | undefined; \"sec-websocket-extensions\"?: string | string[] | undefined; \"sec-websocket-key\"?: string | string[] | undefined; \"sec-websocket-protocol\"?: string | string[] | undefined; \"sec-websocket-version\"?: string | string[] | undefined; \"set-cookie\"?: string | string[] | undefined; \"strict-transport-security\"?: string | string[] | undefined; tk?: string | string[] | undefined; trailer?: string | string[] | undefined; \"transfer-encoding\"?: string | string[] | undefined; upgrade?: string | string[] | undefined; \"user-agent\"?: string | string[] | undefined; vary?: string | string[] | undefined; via?: string | string[] | undefined; warning?: string | string[] | undefined; \"www-authenticate\"?: string | string[] | undefined; } & { [header: string]: string | string[] | undefined; }"
+              "{ from?: string | string[] | undefined; date?: string | string[] | undefined; origin?: string | string[] | undefined; range?: string | string[] | undefined; warning?: string | string[] | undefined; location?: string | string[] | undefined; allow?: string | string[] | undefined; accept?: string | string[] | undefined; \"accept-language\"?: string | string[] | undefined; \"accept-patch\"?: string | string[] | undefined; \"accept-ranges\"?: string | string[] | undefined; \"access-control-allow-credentials\"?: string | string[] | undefined; \"access-control-allow-headers\"?: string | string[] | undefined; \"access-control-allow-methods\"?: string | string[] | undefined; \"access-control-allow-origin\"?: string | string[] | undefined; \"access-control-expose-headers\"?: string | string[] | undefined; \"access-control-max-age\"?: string | string[] | undefined; \"access-control-request-headers\"?: string | string[] | undefined; \"access-control-request-method\"?: string | string[] | undefined; age?: string | string[] | undefined; \"alt-svc\"?: string | string[] | undefined; authorization?: string | string[] | undefined; \"cache-control\"?: string | string[] | undefined; connection?: string | string[] | undefined; \"content-disposition\"?: string | string[] | undefined; \"content-encoding\"?: string | string[] | undefined; \"content-language\"?: string | string[] | undefined; \"content-length\"?: string | string[] | undefined; \"content-location\"?: string | string[] | undefined; \"content-range\"?: string | string[] | undefined; \"content-type\"?: string | string[] | undefined; cookie?: string | string[] | undefined; expect?: string | string[] | undefined; expires?: string | string[] | undefined; forwarded?: string | string[] | undefined; host?: string | string[] | undefined; \"if-match\"?: string | string[] | undefined; \"if-modified-since\"?: string | string[] | undefined; \"if-none-match\"?: string | string[] | undefined; \"if-unmodified-since\"?: string | string[] | undefined; \"last-modified\"?: string | string[] | undefined; pragma?: string | string[] | undefined; \"proxy-authenticate\"?: string | string[] | undefined; \"proxy-authorization\"?: string | string[] | undefined; \"public-key-pins\"?: string | string[] | undefined; referer?: string | string[] | undefined; \"retry-after\"?: string | string[] | undefined; \"sec-websocket-accept\"?: string | string[] | undefined; \"sec-websocket-extensions\"?: string | string[] | undefined; \"sec-websocket-key\"?: string | string[] | undefined; \"sec-websocket-protocol\"?: string | string[] | undefined; \"sec-websocket-version\"?: string | string[] | undefined; \"set-cookie\"?: string | string[] | undefined; \"strict-transport-security\"?: string | string[] | undefined; tk?: string | string[] | undefined; trailer?: string | string[] | undefined; \"transfer-encoding\"?: string | string[] | undefined; upgrade?: string | string[] | undefined; \"user-agent\"?: string | string[] | undefined; vary?: string | string[] | undefined; via?: string | string[] | undefined; \"www-authenticate\"?: string | string[] | undefined; } & { [header: string]: string | string[] | undefined; }"
             ],
             "path": "src/core/server/elasticsearch/types.ts",
             "deprecated": false
@@ -10390,25 +10377,7 @@
             "label": "savedObjectsClient",
             "description": [],
             "signature": [
-              "{ get: <T = unknown>(type: string, id: string, options?: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsBaseOptions",
-                "text": "SavedObjectsBaseOptions"
-              },
-              ") => Promise<",
-              "SavedObject",
-              "<T>>; delete: (type: string, id: string, options?: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsDeleteOptions",
-                "text": "SavedObjectsDeleteOptions"
-              },
-              ") => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: ",
+              "{ create: <T = unknown>(type: string, attributes: T, options?: ",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -10466,7 +10435,15 @@
                 "section": "def-server.SavedObjectsCheckConflictsResponse",
                 "text": "SavedObjectsCheckConflictsResponse"
               },
-              ">; find: <T = unknown, A = unknown>(options: ",
+              ">; delete: (type: string, id: string, options?: ",
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCoreSavedObjectsPluginApi",
+                "section": "def-server.SavedObjectsDeleteOptions",
+                "text": "SavedObjectsDeleteOptions"
+              },
+              ") => Promise<{}>; find: <T = unknown, A = unknown>(options: ",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -10530,6 +10507,16 @@
                 "section": "def-server.SavedObjectsBulkResolveResponse",
                 "text": "SavedObjectsBulkResolveResponse"
               },
+              "<T>>; get: <T = unknown>(type: string, id: string, options?: ",
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCoreSavedObjectsPluginApi",
+                "section": "def-server.SavedObjectsBaseOptions",
+                "text": "SavedObjectsBaseOptions"
+              },
+              ") => Promise<",
+              "SavedObject",
               "<T>>; resolve: <T = unknown>(type: string, id: string, options?: ",
               {
                 "pluginId": "core",
@@ -11334,7 +11321,7 @@
               "\nHTTP Headers with additional information about response."
             ],
             "signature": [
-              "Record<\"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"allow\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"date\" | \"expect\" | \"expires\" | \"forwarded\" | \"from\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"location\" | \"origin\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"range\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"warning\" | \"www-authenticate\", string | string[]> | Record<string, string | string[]> | undefined"
+              "Record<\"from\" | \"date\" | \"origin\" | \"range\" | \"warning\" | \"location\" | \"allow\" | \"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"expect\" | \"expires\" | \"forwarded\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"www-authenticate\", string | string[]> | Record<string, string | string[]> | undefined"
             ],
             "path": "src/core/server/http_resources/types.ts",
             "deprecated": false
@@ -11646,7 +11633,7 @@
             "signature": [
               "Pick<",
               "KibanaClient",
-              ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
+              ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
               "TransportRequestParams",
               ", options?: ",
               "TransportRequestOptions",
@@ -12454,21 +12441,6 @@
         "path": "src/core/server/csp/csp_config.ts",
         "deprecated": false,
         "children": [
-          {
-            "parentPluginId": "core",
-            "id": "def-server.ICspConfig.rules",
-            "type": "Array",
-            "tags": [],
-            "label": "rules",
-            "description": [
-              "\nThe CSP rules used for Kibana."
-            ],
-            "signature": [
-              "string[]"
-            ],
-            "path": "src/core/server/csp/csp_config.ts",
-            "deprecated": false
-          },
           {
             "parentPluginId": "core",
             "id": "def-server.ICspConfig.strict",
@@ -12500,7 +12472,7 @@
             "tags": [],
             "label": "disableEmbedding",
             "description": [
-              "\nWhether or not embedding (using iframes) should be allowed by the CSP. If embedding is disabled *and* no custom rules have been\ndefined, a restrictive 'frame-ancestors' rule will be added to the default CSP rules."
+              "\nWhether or not embedding (using iframes) should be allowed by the CSP. If embedding is disabled, a restrictive 'frame-ancestors' rule will be added to the default CSP rules."
             ],
             "path": "src/core/server/csp/csp_config.ts",
             "deprecated": false
@@ -12858,7 +12830,7 @@
             "signature": [
               "Pick<",
               "KibanaClient",
-              ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
+              ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
               "TransportRequestParams",
               ", options?: ",
               "TransportRequestOptions",
@@ -12883,7 +12855,7 @@
             "signature": [
               "Pick<",
               "KibanaClient",
-              ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
+              ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
               "TransportRequestParams",
               ", options?: ",
               "TransportRequestOptions",
@@ -12923,7 +12895,7 @@
             "signature": [
               "() => Readonly<Record<string, Pick<",
               "UiSettingsParams",
-              "<unknown>, \"type\" | \"options\" | \"description\" | \"name\" | \"order\" | \"value\" | \"category\" | \"optionLabels\" | \"requiresPageReload\" | \"readonly\" | \"sensitive\" | \"deprecation\" | \"metric\">>>"
+              "<unknown>, \"type\" | \"description\" | \"name\" | \"options\" | \"order\" | \"value\" | \"category\" | \"optionLabels\" | \"requiresPageReload\" | \"readonly\" | \"sensitive\" | \"deprecation\" | \"metric\">>>"
             ],
             "path": "src/core/server/ui_settings/types.ts",
             "deprecated": false,
@@ -15382,7 +15354,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; typeRegistry: Pick<",
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; typeRegistry: Pick<",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -15406,7 +15378,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; getExporter: (client: Pick<",
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; getExporter: (client: Pick<",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -15414,7 +15386,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => Pick<",
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => Pick<",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -15430,7 +15402,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => Pick<",
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => Pick<",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -16611,7 +16583,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => ",
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => ",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -16639,7 +16611,7 @@
                     "section": "def-server.SavedObjectsClient",
                     "text": "SavedObjectsClient"
                   },
-                  ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+                  ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
                 ],
                 "path": "src/core/server/ui_settings/types.ts",
                 "deprecated": false,
@@ -17157,7 +17129,7 @@
         "label": "EcsEventCategory",
         "description": [],
         "signature": [
-          "\"host\" | \"network\" | \"web\" | \"database\" | \"package\" | \"session\" | \"file\" | \"registry\" | \"process\" | \"authentication\" | \"configuration\" | \"driver\" | \"iam\" | \"intrusion_detection\" | \"malware\""
+          "\"network\" | \"web\" | \"database\" | \"package\" | \"host\" | \"session\" | \"file\" | \"registry\" | \"process\" | \"authentication\" | \"configuration\" | \"driver\" | \"iam\" | \"intrusion_detection\" | \"malware\""
         ],
         "path": "node_modules/@kbn/logging/target_types/ecs/event.d.ts",
         "deprecated": false,
@@ -17199,7 +17171,7 @@
         "label": "EcsEventType",
         "description": [],
         "signature": [
-          "\"start\" | \"connection\" | \"end\" | \"user\" | \"error\" | \"info\" | \"group\" | \"protocol\" | \"access\" | \"admin\" | \"allowed\" | \"change\" | \"creation\" | \"deletion\" | \"denied\" | \"installation\""
+          "\"start\" | \"end\" | \"user\" | \"error\" | \"info\" | \"connection\" | \"group\" | \"protocol\" | \"access\" | \"admin\" | \"allowed\" | \"change\" | \"creation\" | \"deletion\" | \"denied\" | \"installation\""
         ],
         "path": "node_modules/@kbn/logging/target_types/ecs/event.d.ts",
         "deprecated": false,
@@ -17217,7 +17189,7 @@
         "signature": [
           "Pick<",
           "KibanaClient",
-          ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
+          ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
           "TransportRequestParams",
           ", options?: ",
           "TransportRequestOptions",
@@ -18364,7 +18336,7 @@
           "\nA sub-set of {@link UiSettingsParams} exposed to the client-side."
         ],
         "signature": [
-          "{ type?: \"string\" | \"number\" | \"boolean\" | \"undefined\" | \"color\" | \"json\" | \"image\" | \"markdown\" | \"select\" | \"array\" | undefined; options?: string[] | undefined; description?: string | undefined; name?: string | undefined; order?: number | undefined; value?: unknown; category?: string[] | undefined; optionLabels?: Record<string, string> | undefined; requiresPageReload?: boolean | undefined; readonly?: boolean | undefined; sensitive?: boolean | undefined; deprecation?: ",
+          "{ type?: \"string\" | \"number\" | \"boolean\" | \"undefined\" | \"color\" | \"json\" | \"image\" | \"markdown\" | \"select\" | \"array\" | undefined; description?: string | undefined; name?: string | undefined; options?: string[] | undefined; order?: number | undefined; value?: unknown; category?: string[] | undefined; optionLabels?: Record<string, string> | undefined; requiresPageReload?: boolean | undefined; readonly?: boolean | undefined; sensitive?: boolean | undefined; deprecation?: ",
           "DeprecationSettings",
           " | undefined; metric?: { type: ",
           {
diff --git a/api_docs/core.mdx b/api_docs/core.mdx
index 018a9f1beda6c3..11a95ef59976f0 100644
--- a/api_docs/core.mdx
+++ b/api_docs/core.mdx
@@ -18,7 +18,7 @@ Contact [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) for que
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 2300 | 27 | 1019 | 29 |
+| 2298 | 27 | 1018 | 29 |
 
 ## Client
 
diff --git a/api_docs/core_application.mdx b/api_docs/core_application.mdx
index 1c01073421f696..78431e5a91867c 100644
--- a/api_docs/core_application.mdx
+++ b/api_docs/core_application.mdx
@@ -18,7 +18,7 @@ Contact [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) for que
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 2300 | 27 | 1019 | 29 |
+| 2298 | 27 | 1018 | 29 |
 
 ## Client
 
diff --git a/api_docs/core_chrome.json b/api_docs/core_chrome.json
index e2404c6b386fc3..604ce27aa3abe8 100644
--- a/api_docs/core_chrome.json
+++ b/api_docs/core_chrome.json
@@ -1934,7 +1934,7 @@
         "description": [],
         "signature": [
           "CommonProps",
-          " & { text: React.ReactNode; href?: string | undefined; onClick?: ((event: React.MouseEvent<HTMLAnchorElement, MouseEvent>) => void) | undefined; truncate?: boolean | undefined; 'aria-current'?: boolean | \"date\" | \"location\" | \"page\" | \"time\" | \"true\" | \"false\" | \"step\" | undefined; }"
+          " & { text: React.ReactNode; href?: string | undefined; onClick?: ((event: React.MouseEvent<HTMLAnchorElement, MouseEvent>) => void) | undefined; truncate?: boolean | undefined; 'aria-current'?: boolean | \"date\" | \"page\" | \"time\" | \"true\" | \"false\" | \"step\" | \"location\" | undefined; }"
         ],
         "path": "src/core/public/chrome/types.ts",
         "deprecated": false,
diff --git a/api_docs/core_chrome.mdx b/api_docs/core_chrome.mdx
index 18244445385caf..305f1041a09236 100644
--- a/api_docs/core_chrome.mdx
+++ b/api_docs/core_chrome.mdx
@@ -18,7 +18,7 @@ Contact [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) for que
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 2300 | 27 | 1019 | 29 |
+| 2298 | 27 | 1018 | 29 |
 
 ## Client
 
diff --git a/api_docs/core_http.json b/api_docs/core_http.json
index 94ee961f265b76..285e246099952d 100644
--- a/api_docs/core_http.json
+++ b/api_docs/core_http.json
@@ -2286,7 +2286,7 @@
               "\nReadonly copy of incoming request headers."
             ],
             "signature": [
-              "{ accept?: string | string[] | undefined; \"accept-language\"?: string | string[] | undefined; \"accept-patch\"?: string | string[] | undefined; \"accept-ranges\"?: string | string[] | undefined; \"access-control-allow-credentials\"?: string | string[] | undefined; \"access-control-allow-headers\"?: string | string[] | undefined; \"access-control-allow-methods\"?: string | string[] | undefined; \"access-control-allow-origin\"?: string | string[] | undefined; \"access-control-expose-headers\"?: string | string[] | undefined; \"access-control-max-age\"?: string | string[] | undefined; \"access-control-request-headers\"?: string | string[] | undefined; \"access-control-request-method\"?: string | string[] | undefined; age?: string | string[] | undefined; allow?: string | string[] | undefined; \"alt-svc\"?: string | string[] | undefined; authorization?: string | string[] | undefined; \"cache-control\"?: string | string[] | undefined; connection?: string | string[] | undefined; \"content-disposition\"?: string | string[] | undefined; \"content-encoding\"?: string | string[] | undefined; \"content-language\"?: string | string[] | undefined; \"content-length\"?: string | string[] | undefined; \"content-location\"?: string | string[] | undefined; \"content-range\"?: string | string[] | undefined; \"content-type\"?: string | string[] | undefined; cookie?: string | string[] | undefined; date?: string | string[] | undefined; expect?: string | string[] | undefined; expires?: string | string[] | undefined; forwarded?: string | string[] | undefined; from?: string | string[] | undefined; host?: string | string[] | undefined; \"if-match\"?: string | string[] | undefined; \"if-modified-since\"?: string | string[] | undefined; \"if-none-match\"?: string | string[] | undefined; \"if-unmodified-since\"?: string | string[] | undefined; \"last-modified\"?: string | string[] | undefined; location?: string | string[] | undefined; origin?: string | string[] | undefined; pragma?: string | string[] | undefined; \"proxy-authenticate\"?: string | string[] | undefined; \"proxy-authorization\"?: string | string[] | undefined; \"public-key-pins\"?: string | string[] | undefined; range?: string | string[] | undefined; referer?: string | string[] | undefined; \"retry-after\"?: string | string[] | undefined; \"sec-websocket-accept\"?: string | string[] | undefined; \"sec-websocket-extensions\"?: string | string[] | undefined; \"sec-websocket-key\"?: string | string[] | undefined; \"sec-websocket-protocol\"?: string | string[] | undefined; \"sec-websocket-version\"?: string | string[] | undefined; \"set-cookie\"?: string | string[] | undefined; \"strict-transport-security\"?: string | string[] | undefined; tk?: string | string[] | undefined; trailer?: string | string[] | undefined; \"transfer-encoding\"?: string | string[] | undefined; upgrade?: string | string[] | undefined; \"user-agent\"?: string | string[] | undefined; vary?: string | string[] | undefined; via?: string | string[] | undefined; warning?: string | string[] | undefined; \"www-authenticate\"?: string | string[] | undefined; } & { [header: string]: string | string[] | undefined; }"
+              "{ from?: string | string[] | undefined; date?: string | string[] | undefined; origin?: string | string[] | undefined; range?: string | string[] | undefined; warning?: string | string[] | undefined; location?: string | string[] | undefined; allow?: string | string[] | undefined; accept?: string | string[] | undefined; \"accept-language\"?: string | string[] | undefined; \"accept-patch\"?: string | string[] | undefined; \"accept-ranges\"?: string | string[] | undefined; \"access-control-allow-credentials\"?: string | string[] | undefined; \"access-control-allow-headers\"?: string | string[] | undefined; \"access-control-allow-methods\"?: string | string[] | undefined; \"access-control-allow-origin\"?: string | string[] | undefined; \"access-control-expose-headers\"?: string | string[] | undefined; \"access-control-max-age\"?: string | string[] | undefined; \"access-control-request-headers\"?: string | string[] | undefined; \"access-control-request-method\"?: string | string[] | undefined; age?: string | string[] | undefined; \"alt-svc\"?: string | string[] | undefined; authorization?: string | string[] | undefined; \"cache-control\"?: string | string[] | undefined; connection?: string | string[] | undefined; \"content-disposition\"?: string | string[] | undefined; \"content-encoding\"?: string | string[] | undefined; \"content-language\"?: string | string[] | undefined; \"content-length\"?: string | string[] | undefined; \"content-location\"?: string | string[] | undefined; \"content-range\"?: string | string[] | undefined; \"content-type\"?: string | string[] | undefined; cookie?: string | string[] | undefined; expect?: string | string[] | undefined; expires?: string | string[] | undefined; forwarded?: string | string[] | undefined; host?: string | string[] | undefined; \"if-match\"?: string | string[] | undefined; \"if-modified-since\"?: string | string[] | undefined; \"if-none-match\"?: string | string[] | undefined; \"if-unmodified-since\"?: string | string[] | undefined; \"last-modified\"?: string | string[] | undefined; pragma?: string | string[] | undefined; \"proxy-authenticate\"?: string | string[] | undefined; \"proxy-authorization\"?: string | string[] | undefined; \"public-key-pins\"?: string | string[] | undefined; referer?: string | string[] | undefined; \"retry-after\"?: string | string[] | undefined; \"sec-websocket-accept\"?: string | string[] | undefined; \"sec-websocket-extensions\"?: string | string[] | undefined; \"sec-websocket-key\"?: string | string[] | undefined; \"sec-websocket-protocol\"?: string | string[] | undefined; \"sec-websocket-version\"?: string | string[] | undefined; \"set-cookie\"?: string | string[] | undefined; \"strict-transport-security\"?: string | string[] | undefined; tk?: string | string[] | undefined; trailer?: string | string[] | undefined; \"transfer-encoding\"?: string | string[] | undefined; upgrade?: string | string[] | undefined; \"user-agent\"?: string | string[] | undefined; vary?: string | string[] | undefined; via?: string | string[] | undefined; \"www-authenticate\"?: string | string[] | undefined; } & { [header: string]: string | string[] | undefined; }"
             ],
             "path": "src/core/server/http/router/request.ts",
             "deprecated": false
@@ -2697,7 +2697,7 @@
               "\nHeaders to attach for auth redirect.\nMust include \"location\" header"
             ],
             "signature": [
-              "({ location: string; } & Record<\"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"allow\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"date\" | \"expect\" | \"expires\" | \"forwarded\" | \"from\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"location\" | \"origin\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"range\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"warning\" | \"www-authenticate\", string | string[]>) | ({ location: string; } & Record<string, string | string[]>)"
+              "({ location: string; } & Record<\"from\" | \"date\" | \"origin\" | \"range\" | \"warning\" | \"location\" | \"allow\" | \"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"expect\" | \"expires\" | \"forwarded\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"www-authenticate\", string | string[]>) | ({ location: string; } & Record<string, string | string[]>)"
             ],
             "path": "src/core/server/http/lifecycle/auth.ts",
             "deprecated": false
@@ -2863,7 +2863,7 @@
               "\nRedirects user to another location to complete authentication when authRequired: true\nAllows user to access a resource without redirection when authRequired: 'optional'"
             ],
             "signature": [
-              "(headers: ({ location: string; } & Record<\"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"allow\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"date\" | \"expect\" | \"expires\" | \"forwarded\" | \"from\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"location\" | \"origin\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"range\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"warning\" | \"www-authenticate\", string | string[]>) | ({ location: string; } & Record<string, string | string[]>)) => ",
+              "(headers: ({ location: string; } & Record<\"from\" | \"date\" | \"origin\" | \"range\" | \"warning\" | \"location\" | \"allow\" | \"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"expect\" | \"expires\" | \"forwarded\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"www-authenticate\", string | string[]>) | ({ location: string; } & Record<string, string | string[]>)) => ",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -2883,7 +2883,7 @@
                 "label": "headers",
                 "description": [],
                 "signature": [
-                  "({ location: string; } & Record<\"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"allow\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"date\" | \"expect\" | \"expires\" | \"forwarded\" | \"from\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"location\" | \"origin\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"range\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"warning\" | \"www-authenticate\", string | string[]>) | ({ location: string; } & Record<string, string | string[]>)"
+                  "({ location: string; } & Record<\"from\" | \"date\" | \"origin\" | \"range\" | \"warning\" | \"location\" | \"allow\" | \"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"expect\" | \"expires\" | \"forwarded\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"www-authenticate\", string | string[]>) | ({ location: string; } & Record<string, string | string[]>)"
                 ],
                 "path": "src/core/server/http/lifecycle/auth.ts",
                 "deprecated": false,
@@ -2942,7 +2942,7 @@
               "HTTP Headers with additional information about response"
             ],
             "signature": [
-              "Record<\"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"allow\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"date\" | \"expect\" | \"expires\" | \"forwarded\" | \"from\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"location\" | \"origin\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"range\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"warning\" | \"www-authenticate\", string | string[]> | Record<string, string | string[]> | undefined"
+              "Record<\"from\" | \"date\" | \"origin\" | \"range\" | \"warning\" | \"location\" | \"allow\" | \"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"expect\" | \"expires\" | \"forwarded\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"www-authenticate\", string | string[]> | Record<string, string | string[]> | undefined"
             ],
             "path": "src/core/server/http/router/response.ts",
             "deprecated": false
@@ -3012,7 +3012,7 @@
               "HTTP Headers with additional information about response"
             ],
             "signature": [
-              "Record<\"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"allow\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"date\" | \"expect\" | \"expires\" | \"forwarded\" | \"from\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"location\" | \"origin\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"range\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"warning\" | \"www-authenticate\", string | string[]> | Record<string, string | string[]> | undefined"
+              "Record<\"from\" | \"date\" | \"origin\" | \"range\" | \"warning\" | \"location\" | \"allow\" | \"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"expect\" | \"expires\" | \"forwarded\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"www-authenticate\", string | string[]> | Record<string, string | string[]> | undefined"
             ],
             "path": "src/core/server/http/router/response.ts",
             "deprecated": false
@@ -3172,7 +3172,7 @@
               "HTTP Headers with additional information about response"
             ],
             "signature": [
-              "Record<\"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"allow\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"date\" | \"expect\" | \"expires\" | \"forwarded\" | \"from\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"location\" | \"origin\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"range\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"warning\" | \"www-authenticate\", string | string[]> | Record<string, string | string[]> | undefined"
+              "Record<\"from\" | \"date\" | \"origin\" | \"range\" | \"warning\" | \"location\" | \"allow\" | \"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"expect\" | \"expires\" | \"forwarded\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"www-authenticate\", string | string[]> | Record<string, string | string[]> | undefined"
             ],
             "path": "src/core/server/http/router/response.ts",
             "deprecated": false
@@ -7505,7 +7505,7 @@
               "additional headers to attach to the response"
             ],
             "signature": [
-              "Record<\"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"allow\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"date\" | \"expect\" | \"expires\" | \"forwarded\" | \"from\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"location\" | \"origin\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"range\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"warning\" | \"www-authenticate\", string | string[]> | Record<string, string | string[]> | undefined"
+              "Record<\"from\" | \"date\" | \"origin\" | \"range\" | \"warning\" | \"location\" | \"allow\" | \"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"expect\" | \"expires\" | \"forwarded\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"www-authenticate\", string | string[]> | Record<string, string | string[]> | undefined"
             ],
             "path": "src/core/server/http/lifecycle/on_pre_response.ts",
             "deprecated": false
@@ -7560,7 +7560,7 @@
               "additional headers to attach to the response"
             ],
             "signature": [
-              "Record<\"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"allow\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"date\" | \"expect\" | \"expires\" | \"forwarded\" | \"from\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"location\" | \"origin\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"range\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"warning\" | \"www-authenticate\", string | string[]> | Record<string, string | string[]> | undefined"
+              "Record<\"from\" | \"date\" | \"origin\" | \"range\" | \"warning\" | \"location\" | \"allow\" | \"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"expect\" | \"expires\" | \"forwarded\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"www-authenticate\", string | string[]> | Record<string, string | string[]> | undefined"
             ],
             "path": "src/core/server/http/lifecycle/on_pre_response.ts",
             "deprecated": false
@@ -9130,7 +9130,7 @@
           "\nSet of HTTP methods changing the state of the server."
         ],
         "signature": [
-          "\"post\" | \"put\" | \"delete\" | \"patch\""
+          "\"delete\" | \"post\" | \"put\" | \"patch\""
         ],
         "path": "src/core/server/http/router/route.ts",
         "deprecated": false,
@@ -9252,7 +9252,7 @@
           "\nHttp request headers to read."
         ],
         "signature": [
-          "{ accept?: string | string[] | undefined; \"accept-language\"?: string | string[] | undefined; \"accept-patch\"?: string | string[] | undefined; \"accept-ranges\"?: string | string[] | undefined; \"access-control-allow-credentials\"?: string | string[] | undefined; \"access-control-allow-headers\"?: string | string[] | undefined; \"access-control-allow-methods\"?: string | string[] | undefined; \"access-control-allow-origin\"?: string | string[] | undefined; \"access-control-expose-headers\"?: string | string[] | undefined; \"access-control-max-age\"?: string | string[] | undefined; \"access-control-request-headers\"?: string | string[] | undefined; \"access-control-request-method\"?: string | string[] | undefined; age?: string | string[] | undefined; allow?: string | string[] | undefined; \"alt-svc\"?: string | string[] | undefined; authorization?: string | string[] | undefined; \"cache-control\"?: string | string[] | undefined; connection?: string | string[] | undefined; \"content-disposition\"?: string | string[] | undefined; \"content-encoding\"?: string | string[] | undefined; \"content-language\"?: string | string[] | undefined; \"content-length\"?: string | string[] | undefined; \"content-location\"?: string | string[] | undefined; \"content-range\"?: string | string[] | undefined; \"content-type\"?: string | string[] | undefined; cookie?: string | string[] | undefined; date?: string | string[] | undefined; expect?: string | string[] | undefined; expires?: string | string[] | undefined; forwarded?: string | string[] | undefined; from?: string | string[] | undefined; host?: string | string[] | undefined; \"if-match\"?: string | string[] | undefined; \"if-modified-since\"?: string | string[] | undefined; \"if-none-match\"?: string | string[] | undefined; \"if-unmodified-since\"?: string | string[] | undefined; \"last-modified\"?: string | string[] | undefined; location?: string | string[] | undefined; origin?: string | string[] | undefined; pragma?: string | string[] | undefined; \"proxy-authenticate\"?: string | string[] | undefined; \"proxy-authorization\"?: string | string[] | undefined; \"public-key-pins\"?: string | string[] | undefined; range?: string | string[] | undefined; referer?: string | string[] | undefined; \"retry-after\"?: string | string[] | undefined; \"sec-websocket-accept\"?: string | string[] | undefined; \"sec-websocket-extensions\"?: string | string[] | undefined; \"sec-websocket-key\"?: string | string[] | undefined; \"sec-websocket-protocol\"?: string | string[] | undefined; \"sec-websocket-version\"?: string | string[] | undefined; \"set-cookie\"?: string | string[] | undefined; \"strict-transport-security\"?: string | string[] | undefined; tk?: string | string[] | undefined; trailer?: string | string[] | undefined; \"transfer-encoding\"?: string | string[] | undefined; upgrade?: string | string[] | undefined; \"user-agent\"?: string | string[] | undefined; vary?: string | string[] | undefined; via?: string | string[] | undefined; warning?: string | string[] | undefined; \"www-authenticate\"?: string | string[] | undefined; } & { [header: string]: string | string[] | undefined; }"
+          "{ from?: string | string[] | undefined; date?: string | string[] | undefined; origin?: string | string[] | undefined; range?: string | string[] | undefined; warning?: string | string[] | undefined; location?: string | string[] | undefined; allow?: string | string[] | undefined; accept?: string | string[] | undefined; \"accept-language\"?: string | string[] | undefined; \"accept-patch\"?: string | string[] | undefined; \"accept-ranges\"?: string | string[] | undefined; \"access-control-allow-credentials\"?: string | string[] | undefined; \"access-control-allow-headers\"?: string | string[] | undefined; \"access-control-allow-methods\"?: string | string[] | undefined; \"access-control-allow-origin\"?: string | string[] | undefined; \"access-control-expose-headers\"?: string | string[] | undefined; \"access-control-max-age\"?: string | string[] | undefined; \"access-control-request-headers\"?: string | string[] | undefined; \"access-control-request-method\"?: string | string[] | undefined; age?: string | string[] | undefined; \"alt-svc\"?: string | string[] | undefined; authorization?: string | string[] | undefined; \"cache-control\"?: string | string[] | undefined; connection?: string | string[] | undefined; \"content-disposition\"?: string | string[] | undefined; \"content-encoding\"?: string | string[] | undefined; \"content-language\"?: string | string[] | undefined; \"content-length\"?: string | string[] | undefined; \"content-location\"?: string | string[] | undefined; \"content-range\"?: string | string[] | undefined; \"content-type\"?: string | string[] | undefined; cookie?: string | string[] | undefined; expect?: string | string[] | undefined; expires?: string | string[] | undefined; forwarded?: string | string[] | undefined; host?: string | string[] | undefined; \"if-match\"?: string | string[] | undefined; \"if-modified-since\"?: string | string[] | undefined; \"if-none-match\"?: string | string[] | undefined; \"if-unmodified-since\"?: string | string[] | undefined; \"last-modified\"?: string | string[] | undefined; pragma?: string | string[] | undefined; \"proxy-authenticate\"?: string | string[] | undefined; \"proxy-authorization\"?: string | string[] | undefined; \"public-key-pins\"?: string | string[] | undefined; referer?: string | string[] | undefined; \"retry-after\"?: string | string[] | undefined; \"sec-websocket-accept\"?: string | string[] | undefined; \"sec-websocket-extensions\"?: string | string[] | undefined; \"sec-websocket-key\"?: string | string[] | undefined; \"sec-websocket-protocol\"?: string | string[] | undefined; \"sec-websocket-version\"?: string | string[] | undefined; \"set-cookie\"?: string | string[] | undefined; \"strict-transport-security\"?: string | string[] | undefined; tk?: string | string[] | undefined; trailer?: string | string[] | undefined; \"transfer-encoding\"?: string | string[] | undefined; upgrade?: string | string[] | undefined; \"user-agent\"?: string | string[] | undefined; vary?: string | string[] | undefined; via?: string | string[] | undefined; \"www-authenticate\"?: string | string[] | undefined; } & { [header: string]: string | string[] | undefined; }"
         ],
         "path": "src/core/server/http/router/headers.ts",
         "deprecated": false,
@@ -9595,7 +9595,7 @@
           "\nSet of well-known HTTP headers."
         ],
         "signature": [
-          "\"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"allow\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"date\" | \"expect\" | \"expires\" | \"forwarded\" | \"from\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"location\" | \"origin\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"range\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"warning\" | \"www-authenticate\""
+          "\"from\" | \"date\" | \"origin\" | \"range\" | \"warning\" | \"location\" | \"allow\" | \"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"expect\" | \"expires\" | \"forwarded\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"www-authenticate\""
         ],
         "path": "src/core/server/http/router/headers.ts",
         "deprecated": false,
@@ -11965,7 +11965,7 @@
           "\nHttp response headers to set."
         ],
         "signature": [
-          "Record<\"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"allow\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"date\" | \"expect\" | \"expires\" | \"forwarded\" | \"from\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"location\" | \"origin\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"range\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"warning\" | \"www-authenticate\", string | string[]> | Record<string, string | string[]>"
+          "Record<\"from\" | \"date\" | \"origin\" | \"range\" | \"warning\" | \"location\" | \"allow\" | \"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"expect\" | \"expires\" | \"forwarded\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"www-authenticate\", string | string[]> | Record<string, string | string[]>"
         ],
         "path": "src/core/server/http/router/headers.ts",
         "deprecated": false,
@@ -11997,7 +11997,7 @@
           "\nThe set of common HTTP methods supported by Kibana routing."
         ],
         "signature": [
-          "\"get\" | \"options\" | \"post\" | \"put\" | \"delete\" | \"patch\""
+          "\"options\" | \"delete\" | \"get\" | \"post\" | \"put\" | \"patch\""
         ],
         "path": "src/core/server/http/router/route.ts",
         "deprecated": false,
@@ -12638,7 +12638,7 @@
           "\nSet of HTTP methods not changing the state of the server."
         ],
         "signature": [
-          "\"get\" | \"options\""
+          "\"options\" | \"get\""
         ],
         "path": "src/core/server/http/router/route.ts",
         "deprecated": false,
diff --git a/api_docs/core_http.mdx b/api_docs/core_http.mdx
index ae5747c711b97d..d0f9967052fba9 100644
--- a/api_docs/core_http.mdx
+++ b/api_docs/core_http.mdx
@@ -18,7 +18,7 @@ Contact [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) for que
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 2300 | 27 | 1019 | 29 |
+| 2298 | 27 | 1018 | 29 |
 
 ## Client
 
diff --git a/api_docs/core_saved_objects.json b/api_docs/core_saved_objects.json
index 91af1d2465c3df..9fbd4881680857 100644
--- a/api_docs/core_saved_objects.json
+++ b/api_docs/core_saved_objects.json
@@ -847,7 +847,7 @@
                     "section": "def-public.SavedObjectsClient",
                     "text": "SavedObjectsClient"
                   },
-                  ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"bulkUpdate\">"
+                  ", \"create\" | \"bulkCreate\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"bulkUpdate\">"
                 ],
                 "path": "src/core/public/saved_objects/simple_saved_object.ts",
                 "deprecated": false,
@@ -1513,17 +1513,7 @@
               "{@link SavedObjectsClient}"
             ],
             "signature": [
-              "{ get: <T = unknown>(type: string, id: string) => Promise<",
-              {
-                "pluginId": "core",
-                "scope": "public",
-                "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-public.SimpleSavedObject",
-                "text": "SimpleSavedObject"
-              },
-              "<T>>; delete: (type: string, id: string, options?: ",
-              "SavedObjectsDeleteOptions",
-              " | undefined) => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: ",
+              "{ create: <T = unknown>(type: string, attributes: T, options?: ",
               {
                 "pluginId": "core",
                 "scope": "public",
@@ -1563,7 +1553,9 @@
                 "section": "def-public.SavedObjectsBatchResponse",
                 "text": "SavedObjectsBatchResponse"
               },
-              "<unknown>>; find: <T = unknown, A = unknown>(options: Pick<",
+              "<unknown>>; delete: (type: string, id: string, options?: ",
+              "SavedObjectsDeleteOptions",
+              " | undefined) => Promise<{}>; find: <T = unknown, A = unknown>(options: Pick<",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -1595,7 +1587,15 @@
                 "section": "def-public.ResolvedSimpleSavedObject",
                 "text": "ResolvedSimpleSavedObject"
               },
-              "<T>[]; }>; resolve: <T = unknown>(type: string, id: string) => Promise<",
+              "<T>[]; }>; get: <T = unknown>(type: string, id: string) => Promise<",
+              {
+                "pluginId": "core",
+                "scope": "public",
+                "docId": "kibCoreSavedObjectsPluginApi",
+                "section": "def-public.SimpleSavedObject",
+                "text": "SimpleSavedObject"
+              },
+              "<T>>; resolve: <T = unknown>(type: string, id: string) => Promise<",
               {
                 "pluginId": "core",
                 "scope": "public",
@@ -1719,17 +1719,7 @@
           "\nSavedObjectsClientContract as implemented by the {@link SavedObjectsClient}\n"
         ],
         "signature": [
-          "{ get: <T = unknown>(type: string, id: string) => Promise<",
-          {
-            "pluginId": "core",
-            "scope": "public",
-            "docId": "kibCoreSavedObjectsPluginApi",
-            "section": "def-public.SimpleSavedObject",
-            "text": "SimpleSavedObject"
-          },
-          "<T>>; delete: (type: string, id: string, options?: ",
-          "SavedObjectsDeleteOptions",
-          " | undefined) => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: ",
+          "{ create: <T = unknown>(type: string, attributes: T, options?: ",
           {
             "pluginId": "core",
             "scope": "public",
@@ -1769,7 +1759,9 @@
             "section": "def-public.SavedObjectsBatchResponse",
             "text": "SavedObjectsBatchResponse"
           },
-          "<unknown>>; find: <T = unknown, A = unknown>(options: Pick<",
+          "<unknown>>; delete: (type: string, id: string, options?: ",
+          "SavedObjectsDeleteOptions",
+          " | undefined) => Promise<{}>; find: <T = unknown, A = unknown>(options: Pick<",
           {
             "pluginId": "core",
             "scope": "server",
@@ -1801,7 +1793,15 @@
             "section": "def-public.ResolvedSimpleSavedObject",
             "text": "ResolvedSimpleSavedObject"
           },
-          "<T>[]; }>; resolve: <T = unknown>(type: string, id: string) => Promise<",
+          "<T>[]; }>; get: <T = unknown>(type: string, id: string) => Promise<",
+          {
+            "pluginId": "core",
+            "scope": "public",
+            "docId": "kibCoreSavedObjectsPluginApi",
+            "section": "def-public.SimpleSavedObject",
+            "text": "SimpleSavedObject"
+          },
+          "<T>>; resolve: <T = unknown>(type: string, id: string) => Promise<",
           {
             "pluginId": "core",
             "scope": "public",
@@ -4493,25 +4493,7 @@
             "label": "#savedObjectsClient",
             "description": [],
             "signature": [
-              "{ get: <T = unknown>(type: string, id: string, options?: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsBaseOptions",
-                "text": "SavedObjectsBaseOptions"
-              },
-              ") => Promise<",
-              "SavedObject",
-              "<T>>; delete: (type: string, id: string, options?: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsDeleteOptions",
-                "text": "SavedObjectsDeleteOptions"
-              },
-              ") => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: ",
+              "{ create: <T = unknown>(type: string, attributes: T, options?: ",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -4569,7 +4551,15 @@
                 "section": "def-server.SavedObjectsCheckConflictsResponse",
                 "text": "SavedObjectsCheckConflictsResponse"
               },
-              ">; find: <T = unknown, A = unknown>(options: ",
+              ">; delete: (type: string, id: string, options?: ",
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCoreSavedObjectsPluginApi",
+                "section": "def-server.SavedObjectsDeleteOptions",
+                "text": "SavedObjectsDeleteOptions"
+              },
+              ") => Promise<{}>; find: <T = unknown, A = unknown>(options: ",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -4633,6 +4623,16 @@
                 "section": "def-server.SavedObjectsBulkResolveResponse",
                 "text": "SavedObjectsBulkResolveResponse"
               },
+              "<T>>; get: <T = unknown>(type: string, id: string, options?: ",
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCoreSavedObjectsPluginApi",
+                "section": "def-server.SavedObjectsBaseOptions",
+                "text": "SavedObjectsBaseOptions"
+              },
+              ") => Promise<",
+              "SavedObject",
               "<T>>; resolve: <T = unknown>(type: string, id: string, options?: ",
               {
                 "pluginId": "core",
@@ -4927,25 +4927,7 @@
                     "label": "savedObjectsClient",
                     "description": [],
                     "signature": [
-                      "{ get: <T = unknown>(type: string, id: string, options?: ",
-                      {
-                        "pluginId": "core",
-                        "scope": "server",
-                        "docId": "kibCoreSavedObjectsPluginApi",
-                        "section": "def-server.SavedObjectsBaseOptions",
-                        "text": "SavedObjectsBaseOptions"
-                      },
-                      ") => Promise<",
-                      "SavedObject",
-                      "<T>>; delete: (type: string, id: string, options?: ",
-                      {
-                        "pluginId": "core",
-                        "scope": "server",
-                        "docId": "kibCoreSavedObjectsPluginApi",
-                        "section": "def-server.SavedObjectsDeleteOptions",
-                        "text": "SavedObjectsDeleteOptions"
-                      },
-                      ") => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: ",
+                      "{ create: <T = unknown>(type: string, attributes: T, options?: ",
                       {
                         "pluginId": "core",
                         "scope": "server",
@@ -5003,7 +4985,15 @@
                         "section": "def-server.SavedObjectsCheckConflictsResponse",
                         "text": "SavedObjectsCheckConflictsResponse"
                       },
-                      ">; find: <T = unknown, A = unknown>(options: ",
+                      ">; delete: (type: string, id: string, options?: ",
+                      {
+                        "pluginId": "core",
+                        "scope": "server",
+                        "docId": "kibCoreSavedObjectsPluginApi",
+                        "section": "def-server.SavedObjectsDeleteOptions",
+                        "text": "SavedObjectsDeleteOptions"
+                      },
+                      ") => Promise<{}>; find: <T = unknown, A = unknown>(options: ",
                       {
                         "pluginId": "core",
                         "scope": "server",
@@ -5067,6 +5057,16 @@
                         "section": "def-server.SavedObjectsBulkResolveResponse",
                         "text": "SavedObjectsBulkResolveResponse"
                       },
+                      "<T>>; get: <T = unknown>(type: string, id: string, options?: ",
+                      {
+                        "pluginId": "core",
+                        "scope": "server",
+                        "docId": "kibCoreSavedObjectsPluginApi",
+                        "section": "def-server.SavedObjectsBaseOptions",
+                        "text": "SavedObjectsBaseOptions"
+                      },
+                      ") => Promise<",
+                      "SavedObject",
                       "<T>>; resolve: <T = unknown>(type: string, id: string, options?: ",
                       {
                         "pluginId": "core",
@@ -5709,25 +5709,7 @@
             "label": "#savedObjectsClient",
             "description": [],
             "signature": [
-              "{ get: <T = unknown>(type: string, id: string, options?: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsBaseOptions",
-                "text": "SavedObjectsBaseOptions"
-              },
-              ") => Promise<",
-              "SavedObject",
-              "<T>>; delete: (type: string, id: string, options?: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsDeleteOptions",
-                "text": "SavedObjectsDeleteOptions"
-              },
-              ") => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: ",
+              "{ create: <T = unknown>(type: string, attributes: T, options?: ",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -5785,7 +5767,15 @@
                 "section": "def-server.SavedObjectsCheckConflictsResponse",
                 "text": "SavedObjectsCheckConflictsResponse"
               },
-              ">; find: <T = unknown, A = unknown>(options: ",
+              ">; delete: (type: string, id: string, options?: ",
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCoreSavedObjectsPluginApi",
+                "section": "def-server.SavedObjectsDeleteOptions",
+                "text": "SavedObjectsDeleteOptions"
+              },
+              ") => Promise<{}>; find: <T = unknown, A = unknown>(options: ",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -5849,6 +5839,16 @@
                 "section": "def-server.SavedObjectsBulkResolveResponse",
                 "text": "SavedObjectsBulkResolveResponse"
               },
+              "<T>>; get: <T = unknown>(type: string, id: string, options?: ",
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCoreSavedObjectsPluginApi",
+                "section": "def-server.SavedObjectsBaseOptions",
+                "text": "SavedObjectsBaseOptions"
+              },
+              ") => Promise<",
+              "SavedObject",
               "<T>>; resolve: <T = unknown>(type: string, id: string, options?: ",
               {
                 "pluginId": "core",
@@ -6145,25 +6145,7 @@
                     "label": "savedObjectsClient",
                     "description": [],
                     "signature": [
-                      "{ get: <T = unknown>(type: string, id: string, options?: ",
-                      {
-                        "pluginId": "core",
-                        "scope": "server",
-                        "docId": "kibCoreSavedObjectsPluginApi",
-                        "section": "def-server.SavedObjectsBaseOptions",
-                        "text": "SavedObjectsBaseOptions"
-                      },
-                      ") => Promise<",
-                      "SavedObject",
-                      "<T>>; delete: (type: string, id: string, options?: ",
-                      {
-                        "pluginId": "core",
-                        "scope": "server",
-                        "docId": "kibCoreSavedObjectsPluginApi",
-                        "section": "def-server.SavedObjectsDeleteOptions",
-                        "text": "SavedObjectsDeleteOptions"
-                      },
-                      ") => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: ",
+                      "{ create: <T = unknown>(type: string, attributes: T, options?: ",
                       {
                         "pluginId": "core",
                         "scope": "server",
@@ -6221,7 +6203,15 @@
                         "section": "def-server.SavedObjectsCheckConflictsResponse",
                         "text": "SavedObjectsCheckConflictsResponse"
                       },
-                      ">; find: <T = unknown, A = unknown>(options: ",
+                      ">; delete: (type: string, id: string, options?: ",
+                      {
+                        "pluginId": "core",
+                        "scope": "server",
+                        "docId": "kibCoreSavedObjectsPluginApi",
+                        "section": "def-server.SavedObjectsDeleteOptions",
+                        "text": "SavedObjectsDeleteOptions"
+                      },
+                      ") => Promise<{}>; find: <T = unknown, A = unknown>(options: ",
                       {
                         "pluginId": "core",
                         "scope": "server",
@@ -6285,6 +6275,16 @@
                         "section": "def-server.SavedObjectsBulkResolveResponse",
                         "text": "SavedObjectsBulkResolveResponse"
                       },
+                      "<T>>; get: <T = unknown>(type: string, id: string, options?: ",
+                      {
+                        "pluginId": "core",
+                        "scope": "server",
+                        "docId": "kibCoreSavedObjectsPluginApi",
+                        "section": "def-server.SavedObjectsBaseOptions",
+                        "text": "SavedObjectsBaseOptions"
+                      },
+                      ") => Promise<",
+                      "SavedObject",
                       "<T>>; resolve: <T = unknown>(type: string, id: string, options?: ",
                       {
                         "pluginId": "core",
@@ -10596,25 +10596,7 @@
             "label": "client",
             "description": [],
             "signature": [
-              "{ get: <T = unknown>(type: string, id: string, options?: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsBaseOptions",
-                "text": "SavedObjectsBaseOptions"
-              },
-              ") => Promise<",
-              "SavedObject",
-              "<T>>; delete: (type: string, id: string, options?: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsDeleteOptions",
-                "text": "SavedObjectsDeleteOptions"
-              },
-              ") => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: ",
+              "{ create: <T = unknown>(type: string, attributes: T, options?: ",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -10672,7 +10654,15 @@
                 "section": "def-server.SavedObjectsCheckConflictsResponse",
                 "text": "SavedObjectsCheckConflictsResponse"
               },
-              ">; find: <T = unknown, A = unknown>(options: ",
+              ">; delete: (type: string, id: string, options?: ",
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCoreSavedObjectsPluginApi",
+                "section": "def-server.SavedObjectsDeleteOptions",
+                "text": "SavedObjectsDeleteOptions"
+              },
+              ") => Promise<{}>; find: <T = unknown, A = unknown>(options: ",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -10736,6 +10726,16 @@
                 "section": "def-server.SavedObjectsBulkResolveResponse",
                 "text": "SavedObjectsBulkResolveResponse"
               },
+              "<T>>; get: <T = unknown>(type: string, id: string, options?: ",
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCoreSavedObjectsPluginApi",
+                "section": "def-server.SavedObjectsBaseOptions",
+                "text": "SavedObjectsBaseOptions"
+              },
+              ") => Promise<",
+              "SavedObject",
               "<T>>; resolve: <T = unknown>(type: string, id: string, options?: ",
               {
                 "pluginId": "core",
@@ -13862,7 +13862,7 @@
                 "section": "def-server.SavedObjectsRepository",
                 "text": "SavedObjectsRepository"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">"
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">"
             ],
             "path": "src/core/server/saved_objects/saved_objects_service.ts",
             "deprecated": false,
@@ -13925,7 +13925,7 @@
                 "section": "def-server.SavedObjectsRepository",
                 "text": "SavedObjectsRepository"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">"
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">"
             ],
             "path": "src/core/server/saved_objects/saved_objects_service.ts",
             "deprecated": false,
@@ -14330,7 +14330,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
             ],
             "path": "src/core/server/saved_objects/saved_objects_service.ts",
             "deprecated": false,
@@ -14406,7 +14406,7 @@
                 "section": "def-server.SavedObjectsRepository",
                 "text": "SavedObjectsRepository"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">"
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">"
             ],
             "path": "src/core/server/saved_objects/saved_objects_service.ts",
             "deprecated": false,
@@ -14471,7 +14471,7 @@
                 "section": "def-server.SavedObjectsRepository",
                 "text": "SavedObjectsRepository"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">"
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">"
             ],
             "path": "src/core/server/saved_objects/saved_objects_service.ts",
             "deprecated": false,
@@ -14537,7 +14537,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => Pick<",
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => Pick<",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -14566,7 +14566,7 @@
                     "section": "def-server.SavedObjectsClient",
                     "text": "SavedObjectsClient"
                   },
-                  ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+                  ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
                 ],
                 "path": "src/core/server/saved_objects/saved_objects_service.ts",
                 "deprecated": false,
@@ -14593,7 +14593,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => Pick<",
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => Pick<",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -14622,7 +14622,7 @@
                     "section": "def-server.SavedObjectsClient",
                     "text": "SavedObjectsClient"
                   },
-                  ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+                  ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
                 ],
                 "path": "src/core/server/saved_objects/saved_objects_service.ts",
                 "deprecated": false,
@@ -15638,25 +15638,7 @@
           "\nSee {@link SavedObjectsRepository}\n"
         ],
         "signature": [
-          "{ get: <T = unknown>(type: string, id: string, options?: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreSavedObjectsPluginApi",
-            "section": "def-server.SavedObjectsBaseOptions",
-            "text": "SavedObjectsBaseOptions"
-          },
-          ") => Promise<",
-          "SavedObject",
-          "<T>>; delete: (type: string, id: string, options?: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreSavedObjectsPluginApi",
-            "section": "def-server.SavedObjectsDeleteOptions",
-            "text": "SavedObjectsDeleteOptions"
-          },
-          ") => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: ",
+          "{ create: <T = unknown>(type: string, attributes: T, options?: ",
           {
             "pluginId": "core",
             "scope": "server",
@@ -15714,7 +15696,15 @@
             "section": "def-server.SavedObjectsCheckConflictsResponse",
             "text": "SavedObjectsCheckConflictsResponse"
           },
-          ">; deleteByNamespace: (namespace: string, options?: ",
+          ">; delete: (type: string, id: string, options?: ",
+          {
+            "pluginId": "core",
+            "scope": "server",
+            "docId": "kibCoreSavedObjectsPluginApi",
+            "section": "def-server.SavedObjectsDeleteOptions",
+            "text": "SavedObjectsDeleteOptions"
+          },
+          ") => Promise<{}>; deleteByNamespace: (namespace: string, options?: ",
           {
             "pluginId": "core",
             "scope": "server",
@@ -15786,6 +15776,16 @@
             "section": "def-server.SavedObjectsBulkResolveResponse",
             "text": "SavedObjectsBulkResolveResponse"
           },
+          "<T>>; get: <T = unknown>(type: string, id: string, options?: ",
+          {
+            "pluginId": "core",
+            "scope": "server",
+            "docId": "kibCoreSavedObjectsPluginApi",
+            "section": "def-server.SavedObjectsBaseOptions",
+            "text": "SavedObjectsBaseOptions"
+          },
+          ") => Promise<",
+          "SavedObject",
           "<T>>; resolve: <T = unknown>(type: string, id: string, options?: ",
           {
             "pluginId": "core",
@@ -16151,25 +16151,7 @@
           "\nSaved Objects is Kibana's data persisentence mechanism allowing plugins to\nuse Elasticsearch for storing plugin state.\n\n## SavedObjectsClient errors\n\nSince the SavedObjectsClient has its hands in everything we\nare a little paranoid about the way we present errors back to\nto application code. Ideally, all errors will be either:\n\n  1. Caused by bad implementation (ie. undefined is not a function) and\n     as such unpredictable\n  2. An error that has been classified and decorated appropriately\n     by the decorators in {@link SavedObjectsErrorHelpers}\n\nType 1 errors are inevitable, but since all expected/handle-able errors\nshould be Type 2 the `isXYZError()` helpers exposed at\n`SavedObjectsErrorHelpers` should be used to understand and manage error\nresponses from the `SavedObjectsClient`.\n\nType 2 errors are decorated versions of the source error, so if\nthe elasticsearch client threw an error it will be decorated based\non its type. That means that rather than looking for `error.body.error.type` or\ndoing substring checks on `error.body.error.reason`, just use the helpers to\nunderstand the meaning of the error:\n\n  ```js\n  if (SavedObjectsErrorHelpers.isNotFoundError(error)) {\n     // handle 404\n  }\n\n  if (SavedObjectsErrorHelpers.isNotAuthorizedError(error)) {\n     // 401 handling should be automatic, but in case you wanted to know\n  }\n\n  // always rethrow the error unless you handle it\n  throw error;\n  ```\n\n### 404s from missing index\n\nFrom the perspective of application code and APIs the SavedObjectsClient is\na black box that persists objects. One of the internal details that users have\nno control over is that we use an elasticsearch index for persistence and that\nindex might be missing.\n\nAt the time of writing we are in the process of transitioning away from the\noperating assumption that the SavedObjects index is always available. Part of\nthis transition is handling errors resulting from an index missing. These used\nto trigger a 500 error in most cases, and in others cause 404s with different\nerror messages.\n\nFrom my (Spencer) perspective, a 404 from the SavedObjectsApi is a 404; The\nobject the request/call was targeting could not be found. This is why #14141\ntakes special care to ensure that 404 errors are generic and don't distinguish\nbetween index missing or document missing.\n\nSee {@link SavedObjectsClient}\nSee {@link SavedObjectsErrorHelpers}\n"
         ],
         "signature": [
-          "{ get: <T = unknown>(type: string, id: string, options?: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreSavedObjectsPluginApi",
-            "section": "def-server.SavedObjectsBaseOptions",
-            "text": "SavedObjectsBaseOptions"
-          },
-          ") => Promise<",
-          "SavedObject",
-          "<T>>; delete: (type: string, id: string, options?: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreSavedObjectsPluginApi",
-            "section": "def-server.SavedObjectsDeleteOptions",
-            "text": "SavedObjectsDeleteOptions"
-          },
-          ") => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: ",
+          "{ create: <T = unknown>(type: string, attributes: T, options?: ",
           {
             "pluginId": "core",
             "scope": "server",
@@ -16227,7 +16209,15 @@
             "section": "def-server.SavedObjectsCheckConflictsResponse",
             "text": "SavedObjectsCheckConflictsResponse"
           },
-          ">; find: <T = unknown, A = unknown>(options: ",
+          ">; delete: (type: string, id: string, options?: ",
+          {
+            "pluginId": "core",
+            "scope": "server",
+            "docId": "kibCoreSavedObjectsPluginApi",
+            "section": "def-server.SavedObjectsDeleteOptions",
+            "text": "SavedObjectsDeleteOptions"
+          },
+          ") => Promise<{}>; find: <T = unknown, A = unknown>(options: ",
           {
             "pluginId": "core",
             "scope": "server",
@@ -16291,6 +16281,16 @@
             "section": "def-server.SavedObjectsBulkResolveResponse",
             "text": "SavedObjectsBulkResolveResponse"
           },
+          "<T>>; get: <T = unknown>(type: string, id: string, options?: ",
+          {
+            "pluginId": "core",
+            "scope": "server",
+            "docId": "kibCoreSavedObjectsPluginApi",
+            "section": "def-server.SavedObjectsBaseOptions",
+            "text": "SavedObjectsBaseOptions"
+          },
+          ") => Promise<",
+          "SavedObject",
           "<T>>; resolve: <T = unknown>(type: string, id: string, options?: ",
           {
             "pluginId": "core",
@@ -16507,7 +16507,7 @@
             "section": "def-server.SavedObjectsClient",
             "text": "SavedObjectsClient"
           },
-          ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+          ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
         ],
         "path": "src/core/server/saved_objects/service/lib/scoped_client_provider.ts",
         "deprecated": false,
@@ -16616,7 +16616,7 @@
             "section": "def-server.SavedObjectsClient",
             "text": "SavedObjectsClient"
           },
-          ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+          ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
         ],
         "path": "src/core/server/saved_objects/service/lib/scoped_client_provider.ts",
         "deprecated": false,
diff --git a/api_docs/core_saved_objects.mdx b/api_docs/core_saved_objects.mdx
index 5fc7bc63466b12..3d2d82e9f18214 100644
--- a/api_docs/core_saved_objects.mdx
+++ b/api_docs/core_saved_objects.mdx
@@ -18,7 +18,7 @@ Contact [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) for que
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 2300 | 27 | 1019 | 29 |
+| 2298 | 27 | 1018 | 29 |
 
 ## Client
 
diff --git a/api_docs/custom_integrations.json b/api_docs/custom_integrations.json
index 7cf82e84cfafcc..3a693af2b696ae 100644
--- a/api_docs/custom_integrations.json
+++ b/api_docs/custom_integrations.json
@@ -290,7 +290,9 @@
         "type": "Interface",
         "tags": [],
         "label": "CustomIntegration",
-        "description": [],
+        "description": [
+          "\nA definition of a dataintegration, which can be registered with Kibana."
+        ],
         "path": "src/plugins/custom_integrations/common/index.ts",
         "deprecated": false,
         "children": [
@@ -385,7 +387,7 @@
             "label": "categories",
             "description": [],
             "signature": [
-              "(\"custom\" | \"aws\" | \"azure\" | \"cloud\" | \"config_management\" | \"containers\" | \"crm\" | \"datastore\" | \"elastic_stack\" | \"google_cloud\" | \"kubernetes\" | \"languages\" | \"message_queue\" | \"monitoring\" | \"network\" | \"notification\" | \"os_system\" | \"productivity\" | \"security\" | \"sample_data\" | \"support\" | \"ticketing\" | \"version_control\" | \"web\" | \"upload_file\" | \"language_client\" | \"updates_available\")[]"
+              "(\"custom\" | \"sample_data\" | \"aws\" | \"azure\" | \"cloud\" | \"config_management\" | \"containers\" | \"crm\" | \"datastore\" | \"elastic_stack\" | \"google_cloud\" | \"kubernetes\" | \"languages\" | \"message_queue\" | \"monitoring\" | \"network\" | \"notification\" | \"os_system\" | \"productivity\" | \"security\" | \"support\" | \"ticketing\" | \"version_control\" | \"web\" | \"upload_file\" | \"language_client\")[]"
             ],
             "path": "src/plugins/custom_integrations/common/index.ts",
             "deprecated": false
@@ -393,10 +395,13 @@
           {
             "parentPluginId": "customIntegrations",
             "id": "def-server.CustomIntegration.shipper",
-            "type": "string",
+            "type": "CompoundType",
             "tags": [],
             "label": "shipper",
             "description": [],
+            "signature": [
+              "\"beats\" | \"language_clients\" | \"other\" | \"sample_data\" | \"tests\" | \"tutorial\""
+            ],
             "path": "src/plugins/custom_integrations/common/index.ts",
             "deprecated": false
           },
@@ -415,42 +420,6 @@
           }
         ],
         "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "customIntegrations",
-        "id": "def-server.IntegrationCategoryCount",
-        "type": "Interface",
-        "tags": [],
-        "label": "IntegrationCategoryCount",
-        "description": [],
-        "path": "src/plugins/custom_integrations/common/index.ts",
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "customIntegrations",
-            "id": "def-server.IntegrationCategoryCount.count",
-            "type": "number",
-            "tags": [],
-            "label": "count",
-            "description": [],
-            "path": "src/plugins/custom_integrations/common/index.ts",
-            "deprecated": false
-          },
-          {
-            "parentPluginId": "customIntegrations",
-            "id": "def-server.IntegrationCategoryCount.id",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "id",
-            "description": [],
-            "signature": [
-              "\"custom\" | \"aws\" | \"azure\" | \"cloud\" | \"config_management\" | \"containers\" | \"crm\" | \"datastore\" | \"elastic_stack\" | \"google_cloud\" | \"kubernetes\" | \"languages\" | \"message_queue\" | \"monitoring\" | \"network\" | \"notification\" | \"os_system\" | \"productivity\" | \"security\" | \"sample_data\" | \"support\" | \"ticketing\" | \"version_control\" | \"web\" | \"upload_file\" | \"language_client\" | \"updates_available\""
-            ],
-            "path": "src/plugins/custom_integrations/common/index.ts",
-            "deprecated": false
-          }
-        ],
-        "initialIsOpen": false
       }
     ],
     "enums": [],
@@ -461,9 +430,11 @@
         "type": "Type",
         "tags": [],
         "label": "IntegrationCategory",
-        "description": [],
+        "description": [
+          "\nA category applicable to an Integration."
+        ],
         "signature": [
-          "\"custom\" | \"aws\" | \"azure\" | \"cloud\" | \"config_management\" | \"containers\" | \"crm\" | \"datastore\" | \"elastic_stack\" | \"google_cloud\" | \"kubernetes\" | \"languages\" | \"message_queue\" | \"monitoring\" | \"network\" | \"notification\" | \"os_system\" | \"productivity\" | \"security\" | \"sample_data\" | \"support\" | \"ticketing\" | \"version_control\" | \"web\" | \"upload_file\" | \"language_client\" | \"updates_available\""
+          "\"custom\" | \"sample_data\" | \"aws\" | \"azure\" | \"cloud\" | \"config_management\" | \"containers\" | \"crm\" | \"datastore\" | \"elastic_stack\" | \"google_cloud\" | \"kubernetes\" | \"languages\" | \"message_queue\" | \"monitoring\" | \"network\" | \"notification\" | \"os_system\" | \"productivity\" | \"security\" | \"support\" | \"ticketing\" | \"version_control\" | \"web\" | \"upload_file\" | \"language_client\""
         ],
         "path": "src/plugins/custom_integrations/common/index.ts",
         "deprecated": false,
@@ -578,7 +549,9 @@
         "type": "Interface",
         "tags": [],
         "label": "CustomIntegration",
-        "description": [],
+        "description": [
+          "\nA definition of a dataintegration, which can be registered with Kibana."
+        ],
         "path": "src/plugins/custom_integrations/common/index.ts",
         "deprecated": false,
         "children": [
@@ -673,7 +646,7 @@
             "label": "categories",
             "description": [],
             "signature": [
-              "(\"custom\" | \"aws\" | \"azure\" | \"cloud\" | \"config_management\" | \"containers\" | \"crm\" | \"datastore\" | \"elastic_stack\" | \"google_cloud\" | \"kubernetes\" | \"languages\" | \"message_queue\" | \"monitoring\" | \"network\" | \"notification\" | \"os_system\" | \"productivity\" | \"security\" | \"sample_data\" | \"support\" | \"ticketing\" | \"version_control\" | \"web\" | \"upload_file\" | \"language_client\" | \"updates_available\")[]"
+              "(\"custom\" | \"sample_data\" | \"aws\" | \"azure\" | \"cloud\" | \"config_management\" | \"containers\" | \"crm\" | \"datastore\" | \"elastic_stack\" | \"google_cloud\" | \"kubernetes\" | \"languages\" | \"message_queue\" | \"monitoring\" | \"network\" | \"notification\" | \"os_system\" | \"productivity\" | \"security\" | \"support\" | \"ticketing\" | \"version_control\" | \"web\" | \"upload_file\" | \"language_client\")[]"
             ],
             "path": "src/plugins/custom_integrations/common/index.ts",
             "deprecated": false
@@ -681,10 +654,13 @@
           {
             "parentPluginId": "customIntegrations",
             "id": "def-common.CustomIntegration.shipper",
-            "type": "string",
+            "type": "CompoundType",
             "tags": [],
             "label": "shipper",
             "description": [],
+            "signature": [
+              "\"beats\" | \"language_clients\" | \"other\" | \"sample_data\" | \"tests\" | \"tutorial\""
+            ],
             "path": "src/plugins/custom_integrations/common/index.ts",
             "deprecated": false
           },
@@ -710,7 +686,9 @@
         "type": "Interface",
         "tags": [],
         "label": "CustomIntegrationIcon",
-        "description": [],
+        "description": [
+          "\nAn icon representing an Integration."
+        ],
         "path": "src/plugins/custom_integrations/common/index.ts",
         "deprecated": false,
         "children": [
@@ -746,7 +724,9 @@
         "type": "Interface",
         "tags": [],
         "label": "IntegrationCategoryCount",
-        "description": [],
+        "description": [
+          "\nAn object containing the id of an `IntegrationCategory` and the count of all Integrations in that category."
+        ],
         "path": "src/plugins/custom_integrations/common/index.ts",
         "deprecated": false,
         "children": [
@@ -768,7 +748,7 @@
             "label": "id",
             "description": [],
             "signature": [
-              "\"custom\" | \"aws\" | \"azure\" | \"cloud\" | \"config_management\" | \"containers\" | \"crm\" | \"datastore\" | \"elastic_stack\" | \"google_cloud\" | \"kubernetes\" | \"languages\" | \"message_queue\" | \"monitoring\" | \"network\" | \"notification\" | \"os_system\" | \"productivity\" | \"security\" | \"sample_data\" | \"support\" | \"ticketing\" | \"version_control\" | \"web\" | \"upload_file\" | \"language_client\" | \"updates_available\""
+              "\"custom\" | \"sample_data\" | \"aws\" | \"azure\" | \"cloud\" | \"config_management\" | \"containers\" | \"crm\" | \"datastore\" | \"elastic_stack\" | \"google_cloud\" | \"kubernetes\" | \"languages\" | \"message_queue\" | \"monitoring\" | \"network\" | \"notification\" | \"os_system\" | \"productivity\" | \"security\" | \"support\" | \"ticketing\" | \"version_control\" | \"web\" | \"upload_file\" | \"language_client\""
             ],
             "path": "src/plugins/custom_integrations/common/index.ts",
             "deprecated": false
@@ -779,15 +759,33 @@
     ],
     "enums": [],
     "misc": [
+      {
+        "parentPluginId": "customIntegrations",
+        "id": "def-common.category",
+        "type": "Array",
+        "tags": [],
+        "label": "category",
+        "description": [
+          "\nThe list of all available categories."
+        ],
+        "signature": [
+          "(\"custom\" | \"sample_data\" | \"aws\" | \"azure\" | \"cloud\" | \"config_management\" | \"containers\" | \"crm\" | \"datastore\" | \"elastic_stack\" | \"google_cloud\" | \"kubernetes\" | \"languages\" | \"message_queue\" | \"monitoring\" | \"network\" | \"notification\" | \"os_system\" | \"productivity\" | \"security\" | \"support\" | \"ticketing\" | \"version_control\" | \"web\" | \"upload_file\" | \"language_client\")[]"
+        ],
+        "path": "src/plugins/custom_integrations/common/index.ts",
+        "deprecated": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "customIntegrations",
         "id": "def-common.IntegrationCategory",
         "type": "Type",
         "tags": [],
         "label": "IntegrationCategory",
-        "description": [],
+        "description": [
+          "\nA category applicable to an Integration."
+        ],
         "signature": [
-          "\"custom\" | \"aws\" | \"azure\" | \"cloud\" | \"config_management\" | \"containers\" | \"crm\" | \"datastore\" | \"elastic_stack\" | \"google_cloud\" | \"kubernetes\" | \"languages\" | \"message_queue\" | \"monitoring\" | \"network\" | \"notification\" | \"os_system\" | \"productivity\" | \"security\" | \"sample_data\" | \"support\" | \"ticketing\" | \"version_control\" | \"web\" | \"upload_file\" | \"language_client\" | \"updates_available\""
+          "\"custom\" | \"sample_data\" | \"aws\" | \"azure\" | \"cloud\" | \"config_management\" | \"containers\" | \"crm\" | \"datastore\" | \"elastic_stack\" | \"google_cloud\" | \"kubernetes\" | \"languages\" | \"message_queue\" | \"monitoring\" | \"network\" | \"notification\" | \"os_system\" | \"productivity\" | \"security\" | \"support\" | \"ticketing\" | \"version_control\" | \"web\" | \"upload_file\" | \"language_client\""
         ],
         "path": "src/plugins/custom_integrations/common/index.ts",
         "deprecated": false,
@@ -842,6 +840,38 @@
         "path": "src/plugins/custom_integrations/common/index.ts",
         "deprecated": false,
         "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "customIntegrations",
+        "id": "def-common.shipper",
+        "type": "Array",
+        "tags": [],
+        "label": "shipper",
+        "description": [
+          "\nThe list of all known shippers."
+        ],
+        "signature": [
+          "(\"beats\" | \"language_clients\" | \"other\" | \"sample_data\" | \"tests\" | \"tutorial\")[]"
+        ],
+        "path": "src/plugins/custom_integrations/common/index.ts",
+        "deprecated": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "customIntegrations",
+        "id": "def-common.Shipper",
+        "type": "Type",
+        "tags": [],
+        "label": "Shipper",
+        "description": [
+          "\nA shipper-- an internal or external system capable of storing data in ES/Kibana-- applicable to an Integration."
+        ],
+        "signature": [
+          "\"beats\" | \"language_clients\" | \"other\" | \"sample_data\" | \"tests\" | \"tutorial\""
+        ],
+        "path": "src/plugins/custom_integrations/common/index.ts",
+        "deprecated": false,
+        "initialIsOpen": false
       }
     ],
     "objects": [
@@ -851,7 +881,9 @@
         "type": "Object",
         "tags": [],
         "label": "INTEGRATION_CATEGORY_DISPLAY",
-        "description": [],
+        "description": [
+          "\nA map of category names and their corresponding titles."
+        ],
         "path": "src/plugins/custom_integrations/common/index.ts",
         "deprecated": false,
         "children": [
@@ -861,9 +893,7 @@
             "type": "string",
             "tags": [],
             "label": "aws",
-            "description": [
-              "// Known EPR"
-            ],
+            "description": [],
             "path": "src/plugins/custom_integrations/common/index.ts",
             "deprecated": false
           },
@@ -1118,16 +1148,79 @@
             "description": [],
             "path": "src/plugins/custom_integrations/common/index.ts",
             "deprecated": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "customIntegrations",
+        "id": "def-common.SHIPPER_DISPLAY",
+        "type": "Object",
+        "tags": [],
+        "label": "SHIPPER_DISPLAY",
+        "description": [
+          "\nA map of shipper names and their corresponding titles."
+        ],
+        "path": "src/plugins/custom_integrations/common/index.ts",
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "customIntegrations",
+            "id": "def-common.SHIPPER_DISPLAY.beats",
+            "type": "string",
+            "tags": [],
+            "label": "beats",
+            "description": [],
+            "path": "src/plugins/custom_integrations/common/index.ts",
+            "deprecated": false
           },
           {
             "parentPluginId": "customIntegrations",
-            "id": "def-common.INTEGRATION_CATEGORY_DISPLAY.updates_available",
+            "id": "def-common.SHIPPER_DISPLAY.language_clients",
             "type": "string",
             "tags": [],
-            "label": "updates_available",
-            "description": [
-              "// Internal"
-            ],
+            "label": "language_clients",
+            "description": [],
+            "path": "src/plugins/custom_integrations/common/index.ts",
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "customIntegrations",
+            "id": "def-common.SHIPPER_DISPLAY.other",
+            "type": "string",
+            "tags": [],
+            "label": "other",
+            "description": [],
+            "path": "src/plugins/custom_integrations/common/index.ts",
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "customIntegrations",
+            "id": "def-common.SHIPPER_DISPLAY.sample_data",
+            "type": "string",
+            "tags": [],
+            "label": "sample_data",
+            "description": [],
+            "path": "src/plugins/custom_integrations/common/index.ts",
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "customIntegrations",
+            "id": "def-common.SHIPPER_DISPLAY.tests",
+            "type": "string",
+            "tags": [],
+            "label": "tests",
+            "description": [],
+            "path": "src/plugins/custom_integrations/common/index.ts",
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "customIntegrations",
+            "id": "def-common.SHIPPER_DISPLAY.tutorial",
+            "type": "string",
+            "tags": [],
+            "label": "tutorial",
+            "description": [],
             "path": "src/plugins/custom_integrations/common/index.ts",
             "deprecated": false
           }
diff --git a/api_docs/custom_integrations.mdx b/api_docs/custom_integrations.mdx
index 378d3b16c57fa0..a5c470066ad71d 100644
--- a/api_docs/custom_integrations.mdx
+++ b/api_docs/custom_integrations.mdx
@@ -18,7 +18,7 @@ Contact [Fleet](https://github.com/orgs/elastic/teams/fleet) for questions regar
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 85 | 1 | 78 | 1 |
+| 91 | 1 | 75 | 1 |
 
 ## Client
 
diff --git a/api_docs/dashboard.json b/api_docs/dashboard.json
index b42846c747bfa1..48be2a07d8236d 100644
--- a/api_docs/dashboard.json
+++ b/api_docs/dashboard.json
@@ -1560,7 +1560,7 @@
                 "section": "def-common.SearchSource",
                 "text": "SearchSource"
               },
-              "; history: Record<string, any>[]; setPreferredSearchStrategyId: (searchStrategyId: string) => void; setField: <K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, value: ",
+              "; history: Record<string, any>[]; setPreferredSearchStrategyId: (searchStrategyId: string) => void; setField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, value: ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -1576,7 +1576,7 @@
                 "section": "def-common.SearchSource",
                 "text": "SearchSource"
               },
-              "; removeField: <K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
+              "; removeField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -1608,7 +1608,7 @@
                 "section": "def-common.SearchSourceFields",
                 "text": "SearchSourceFields"
               },
-              "; getField: <K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, recurse?: boolean) => ",
+              "; getField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, recurse?: boolean) => ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -1616,7 +1616,7 @@
                 "section": "def-common.SearchSourceFields",
                 "text": "SearchSourceFields"
               },
-              "[K]; getOwnField: <K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
+              "[K]; getOwnField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -2501,7 +2501,7 @@
             "section": "def-server.SavedObjectsRepository",
             "text": "SavedObjectsRepository"
           },
-          ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">, \"find\">, embeddableType: string) => Promise<{ [key: string]: ",
+          ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">, \"find\">, embeddableType: string) => Promise<{ [key: string]: ",
           {
             "pluginId": "@kbn/utility-types",
             "scope": "server",
@@ -2530,7 +2530,7 @@
                 "section": "def-server.SavedObjectsRepository",
                 "text": "SavedObjectsRepository"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">, \"find\">"
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">, \"find\">"
             ],
             "path": "src/plugins/dashboard/server/usage/find_by_value_embeddables.ts",
             "deprecated": false,
diff --git a/api_docs/data.json b/api_docs/data.json
index ab02b81539cf2d..532c629784c385 100644
--- a/api_docs/data.json
+++ b/api_docs/data.json
@@ -248,7 +248,7 @@
                     "section": "def-server.SerializableRecord",
                     "text": "SerializableRecord"
                   },
-                  " | undefined; schema?: string | undefined; }, \"enabled\" | \"id\" | \"schema\" | \"params\"> & Pick<{ type: ",
+                  " | undefined; schema?: string | undefined; }, \"id\" | \"enabled\" | \"schema\" | \"params\"> & Pick<{ type: ",
                   {
                     "pluginId": "data",
                     "scope": "common",
@@ -264,7 +264,7 @@
                     "section": "def-common.IAggType",
                     "text": "IAggType"
                   },
-                  "; }, never>, \"type\" | \"enabled\" | \"id\" | \"schema\" | \"params\">"
+                  "; }, never>, \"type\" | \"id\" | \"enabled\" | \"schema\" | \"params\">"
                 ],
                 "path": "src/plugins/data/common/search/aggs/agg_config.ts",
                 "deprecated": false,
@@ -1315,7 +1315,7 @@
                     "section": "def-server.SerializableRecord",
                     "text": "SerializableRecord"
                   },
-                  " | undefined; schema?: string | undefined; }, \"enabled\" | \"id\" | \"schema\" | \"params\"> & Pick<{ type: string | ",
+                  " | undefined; schema?: string | undefined; }, \"id\" | \"enabled\" | \"schema\" | \"params\"> & Pick<{ type: string | ",
                   {
                     "pluginId": "data",
                     "scope": "common",
@@ -1331,7 +1331,7 @@
                     "section": "def-common.IAggType",
                     "text": "IAggType"
                   },
-                  "; }, never>, \"type\" | \"enabled\" | \"id\" | \"schema\" | \"params\">[]"
+                  "; }, never>, \"type\" | \"id\" | \"enabled\" | \"schema\" | \"params\">[]"
                 ],
                 "path": "src/plugins/data/common/search/aggs/agg_configs.ts",
                 "deprecated": false,
@@ -1560,7 +1560,7 @@
                 "section": "def-server.SerializableRecord",
                 "text": "SerializableRecord"
               },
-              " | undefined; schema?: string | undefined; }, \"enabled\" | \"id\" | \"schema\" | \"params\"> & Pick<{ type: string | ",
+              " | undefined; schema?: string | undefined; }, \"id\" | \"enabled\" | \"schema\" | \"params\"> & Pick<{ type: string | ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -1576,7 +1576,7 @@
                 "section": "def-common.IAggType",
                 "text": "IAggType"
               },
-              "; }, never>, \"type\" | \"enabled\" | \"id\" | \"schema\" | \"params\">, { addToAggConfigs }?: { addToAggConfigs?: boolean | undefined; }) => T"
+              "; }, never>, \"type\" | \"id\" | \"enabled\" | \"schema\" | \"params\">, { addToAggConfigs }?: { addToAggConfigs?: boolean | undefined; }) => T"
             ],
             "path": "src/plugins/data/common/search/aggs/agg_configs.ts",
             "deprecated": false,
@@ -1597,7 +1597,7 @@
                     "section": "def-server.SerializableRecord",
                     "text": "SerializableRecord"
                   },
-                  " | undefined; schema?: string | undefined; }, \"enabled\" | \"id\" | \"schema\" | \"params\"> & Pick<{ type: string | ",
+                  " | undefined; schema?: string | undefined; }, \"id\" | \"enabled\" | \"schema\" | \"params\"> & Pick<{ type: string | ",
                   {
                     "pluginId": "data",
                     "scope": "common",
@@ -1613,7 +1613,7 @@
                     "section": "def-common.IAggType",
                     "text": "IAggType"
                   },
-                  "; }, never>, \"type\" | \"enabled\" | \"id\" | \"schema\" | \"params\">"
+                  "; }, never>, \"type\" | \"id\" | \"enabled\" | \"schema\" | \"params\">"
                 ],
                 "path": "src/plugins/data/common/search/aggs/agg_configs.ts",
                 "deprecated": false,
@@ -2504,7 +2504,7 @@
                     "section": "def-public.PluginInitializerContext",
                     "text": "PluginInitializerContext"
                   },
-                  "<Readonly<{} & { search: Readonly<{} & { aggs: Readonly<{} & { shardDelay: Readonly<{} & { enabled: boolean; }>; }>; }>; autocomplete: Readonly<{} & { querySuggestions: Readonly<{} & { enabled: boolean; }>; valueSuggestions: Readonly<{} & { enabled: boolean; timeout: moment.Duration; tiers: string[]; terminateAfter: moment.Duration; }>; }>; }>>"
+                  "<Readonly<{} & { search: Readonly<{} & { aggs: Readonly<{} & { shardDelay: Readonly<{} & { enabled: boolean; }>; }>; }>; autocomplete: Readonly<{} & { querySuggestions: Readonly<{} & { enabled: boolean; }>; valueSuggestions: Readonly<{} & { timeout: moment.Duration; enabled: boolean; tiers: string[]; terminateAfter: moment.Duration; }>; }>; }>>"
                 ],
                 "path": "src/plugins/data/public/plugin.ts",
                 "deprecated": false,
@@ -3120,18 +3120,6 @@
             "plugin": "observability",
             "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_app_index_pattern.tsx"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
           {
             "plugin": "maps",
             "path": "x-pack/plugins/maps/public/embeddable/types.ts"
@@ -3304,30 +3292,6 @@
             "plugin": "dataVisualizer",
             "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/embeddables/types.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/embeddables/types.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx"
-          },
           {
             "plugin": "apm",
             "path": "x-pack/plugins/apm/public/components/app/RumDashboard/LocalUIFilters/SelectedFilters.tsx"
@@ -3456,14 +3420,6 @@
             "plugin": "transform",
             "path": "x-pack/plugins/transform/common/types/index_pattern.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
           {
             "plugin": "lens",
             "path": "x-pack/plugins/lens/server/routes/existing_fields.test.ts"
@@ -3496,14 +3452,6 @@
             "plugin": "dataVisualizer",
             "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/saved_search_utils.test.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
           {
             "plugin": "lens",
             "path": "x-pack/plugins/lens/target/types/server/routes/existing_fields.d.ts"
@@ -3636,6 +3584,22 @@
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/main/components/doc_table/doc_table_wrapper.d.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.predecessors.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.predecessors.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.successors.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.successors.test.ts"
+          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/utils/get_switch_index_pattern_app_state.test.ts"
@@ -3784,6 +3748,18 @@
             "plugin": "dataViews",
             "path": "src/plugins/data_views/common/fields/data_view_field.test.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_fetch.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_fetch.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_fetch.test.ts"
+          },
           {
             "plugin": "dataViews",
             "path": "src/plugins/data_views/public/index.ts"
@@ -3970,11 +3946,11 @@
           },
           {
             "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_state.ts"
+            "path": "src/plugins/discover/public/application/apps/context/services/anchor.ts"
           },
           {
             "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_state.ts"
+            "path": "src/plugins/discover/public/application/apps/context/services/anchor.ts"
           },
           {
             "plugin": "discover",
@@ -3982,7 +3958,11 @@
           },
           {
             "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/anchor.ts"
+            "path": "src/plugins/discover/public/application/apps/context/services/context.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.ts"
           },
           {
             "plugin": "discover",
@@ -4408,250 +4388,6 @@
             "plugin": "dataVisualizer",
             "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/full_time_range_selector/full_time_range_selector.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/field_format_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/field_format_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/scatterplot_matrix/use_scatterplot_field_options.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/scatterplot_matrix/use_scatterplot_field_options.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/scatterplot_matrix/scatterplot_matrix.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/scatterplot_matrix/scatterplot_matrix.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/single_metric_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/single_metric_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/multi_metric_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/multi_metric_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/population_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/population_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/advanced_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/advanced_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/categorization_examples_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/categorization_examples_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/categorization_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/categorization_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/rare_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/rare_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator_factory.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator_factory.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/expandable_section/expandable_section_results.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/expandable_section/expandable_section_results.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/outlier_exploration/use_outlier_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/outlier_exploration/use_outlier_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/use_exploration_results.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/use_exploration_results.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/exploration_results_table.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/exploration_results_table.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
           {
             "plugin": "apm",
             "path": "x-pack/plugins/apm/public/components/shared/kuery_bar/index.tsx"
@@ -4952,22 +4688,6 @@
             "plugin": "maps",
             "path": "x-pack/plugins/maps/target/types/public/components/geo_index_pattern_select.d.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities._service.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities._service.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/remove_nested_field_children.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/remove_nested_field_children.test.ts"
-          },
           {
             "plugin": "maps",
             "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/util/get_docvalue_source_fields.test.ts"
@@ -4980,14 +4700,6 @@
             "plugin": "maps",
             "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/util/get_docvalue_source_fields.test.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_pattern.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_pattern.ts"
-          },
           {
             "plugin": "maps",
             "path": "x-pack/plugins/maps/target/types/public/classes/fields/agg/count_agg_field.d.ts"
@@ -5052,14 +4764,6 @@
             "plugin": "maps",
             "path": "x-pack/plugins/maps/target/types/public/connected_components/edit_layer_panel/filter_editor/filter_editor.d.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/components/full_time_range_selector/full_time_range_selector.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/components/full_time_range_selector/full_time_range_selector.d.ts"
-          },
           {
             "plugin": "dataVisualizer",
             "path": "x-pack/plugins/data_visualizer/target/types/public/application/index_data_visualizer/components/full_time_range_selector/full_time_range_selector.d.ts"
@@ -5580,6 +5284,14 @@
             "plugin": "visDefaultEditor",
             "path": "src/plugins/vis_default_editor/target/types/public/components/agg_select.d.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/anchor.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/anchor.test.ts"
+          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/utils/get_sharing_data.test.ts"
@@ -5628,6 +5340,14 @@
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
+          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/main/utils/nested_fields.d.ts"
@@ -7576,7 +7296,7 @@
               "\nsets value to a single search source field"
             ],
             "signature": [
-              "<K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, value: ",
+              "<K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, value: ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -7641,7 +7361,7 @@
               "\nremove field"
             ],
             "signature": [
-              "<K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => this"
+              "<K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => this"
             ],
             "path": "src/plugins/data/common/search/search_source/search_source.ts",
             "deprecated": false,
@@ -7766,7 +7486,7 @@
               "\nGets a single field from the fields"
             ],
             "signature": [
-              "<K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, recurse?: boolean) => ",
+              "<K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, recurse?: boolean) => ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -7820,7 +7540,7 @@
               "\nGet the field from our own fields, don't traverse up the chain"
             ],
             "signature": [
-              "<K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
+              "<K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -9284,7 +9004,7 @@
                 "section": "def-common.BUCKET_TYPES",
                 "text": "BUCKET_TYPES"
               },
-              ".FILTER>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ geo_bounding_box?: ({ type: \"geo_bounding_box\"; } & GeoBox) | ({ type: \"geo_bounding_box\"; } & { top_left: ",
+              ".FILTER>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ geo_bounding_box?: ({ type: \"geo_bounding_box\"; } & GeoBox) | ({ type: \"geo_bounding_box\"; } & { top_left: ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -9380,7 +9100,7 @@
                 "section": "def-common.Query",
                 "text": "Query"
               },
-              "> | undefined; }, never>, \"enabled\" | \"id\" | \"filter\" | \"schema\" | \"geo_bounding_box\" | \"json\" | \"customLabel\" | \"timeShift\">, ",
+              "> | undefined; }, never>, \"id\" | \"filter\" | \"enabled\" | \"schema\" | \"geo_bounding_box\" | \"json\" | \"customLabel\" | \"timeShift\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -9436,7 +9156,7 @@
                 "section": "def-common.BUCKET_TYPES",
                 "text": "BUCKET_TYPES"
               },
-              ".FILTERS>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"timeShift\"> & Pick<{ filters?: ",
+              ".FILTERS>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"timeShift\"> & Pick<{ filters?: ",
               {
                 "pluginId": "expressions",
                 "scope": "common",
@@ -9468,7 +9188,7 @@
                 "section": "def-common.QueryFilter",
                 "text": "QueryFilter"
               },
-              ">[] | undefined; }, never>, \"enabled\" | \"id\" | \"filters\" | \"schema\" | \"json\" | \"timeShift\">, ",
+              ">[] | undefined; }, never>, \"id\" | \"filters\" | \"enabled\" | \"schema\" | \"json\" | \"timeShift\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -9580,7 +9300,7 @@
                 "section": "def-common.BUCKET_TYPES",
                 "text": "BUCKET_TYPES"
               },
-              ".IP_RANGE>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\"> & Pick<{ ranges?: (",
+              ".IP_RANGE>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\"> & Pick<{ ranges?: (",
               {
                 "pluginId": "expressions",
                 "scope": "common",
@@ -9644,7 +9364,7 @@
                 "section": "def-common.IpRange",
                 "text": "IpRange"
               },
-              ">)[] | undefined; ipRangeType?: string | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"ipRangeType\" | \"ranges\">, ",
+              ">)[] | undefined; ipRangeType?: string | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"ipRangeType\" | \"ranges\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -9700,7 +9420,7 @@
                 "section": "def-common.BUCKET_TYPES",
                 "text": "BUCKET_TYPES"
               },
-              ".DATE_RANGE>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"time_zone\"> & Pick<{ ranges?: ",
+              ".DATE_RANGE>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"time_zone\"> & Pick<{ ranges?: ",
               {
                 "pluginId": "expressions",
                 "scope": "common",
@@ -9732,7 +9452,7 @@
                 "section": "def-common.DateRange",
                 "text": "DateRange"
               },
-              ">[] | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"ranges\" | \"time_zone\">, ",
+              ">[] | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"ranges\" | \"time_zone\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -9788,7 +9508,7 @@
                 "section": "def-common.BUCKET_TYPES",
                 "text": "BUCKET_TYPES"
               },
-              ".RANGE>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\"> & Pick<{ ranges?: ",
+              ".RANGE>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\"> & Pick<{ ranges?: ",
               {
                 "pluginId": "expressions",
                 "scope": "common",
@@ -9820,7 +9540,7 @@
                 "section": "def-common.NumericalRange",
                 "text": "NumericalRange"
               },
-              ">[] | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"ranges\">, ",
+              ">[] | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"ranges\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -9932,7 +9652,7 @@
                 "section": "def-common.BUCKET_TYPES",
                 "text": "BUCKET_TYPES"
               },
-              ".GEOHASH_GRID>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"autoPrecision\" | \"precision\" | \"useGeocentroid\" | \"isFilteredByCollar\"> & Pick<{ boundingBox?: ({ type: \"geo_bounding_box\"; } & GeoBox) | ({ type: \"geo_bounding_box\"; } & { top_left: ",
+              ".GEOHASH_GRID>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"autoPrecision\" | \"precision\" | \"useGeocentroid\" | \"isFilteredByCollar\"> & Pick<{ boundingBox?: ({ type: \"geo_bounding_box\"; } & GeoBox) | ({ type: \"geo_bounding_box\"; } & { top_left: ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -9996,7 +9716,7 @@
                 "section": "def-common.GeoPoint",
                 "text": "GeoPoint"
               },
-              "; }) | ({ type: \"geo_bounding_box\"; } & WellKnownText) | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"autoPrecision\" | \"precision\" | \"useGeocentroid\" | \"isFilteredByCollar\" | \"boundingBox\">, ",
+              "; }) | ({ type: \"geo_bounding_box\"; } & WellKnownText) | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"autoPrecision\" | \"precision\" | \"useGeocentroid\" | \"isFilteredByCollar\" | \"boundingBox\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -10052,7 +9772,7 @@
                 "section": "def-common.BUCKET_TYPES",
                 "text": "BUCKET_TYPES"
               },
-              ".HISTOGRAM>, \"enabled\" | \"interval\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"used_interval\" | \"maxBars\" | \"intervalBase\" | \"min_doc_count\" | \"has_extended_bounds\"> & Pick<{ extended_bounds?: ",
+              ".HISTOGRAM>, \"interval\" | \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"used_interval\" | \"maxBars\" | \"intervalBase\" | \"min_doc_count\" | \"has_extended_bounds\"> & Pick<{ extended_bounds?: ",
               {
                 "pluginId": "expressions",
                 "scope": "common",
@@ -10084,7 +9804,7 @@
                 "section": "def-common.ExtendedBounds",
                 "text": "ExtendedBounds"
               },
-              "> | undefined; }, never>, \"enabled\" | \"interval\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"used_interval\" | \"maxBars\" | \"intervalBase\" | \"min_doc_count\" | \"has_extended_bounds\" | \"extended_bounds\">, ",
+              "> | undefined; }, never>, \"interval\" | \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"used_interval\" | \"maxBars\" | \"intervalBase\" | \"min_doc_count\" | \"has_extended_bounds\" | \"extended_bounds\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -10140,7 +9860,7 @@
                 "section": "def-common.BUCKET_TYPES",
                 "text": "BUCKET_TYPES"
               },
-              ".DATE_HISTOGRAM>, \"enabled\" | \"interval\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"time_zone\" | \"used_interval\" | \"min_doc_count\" | \"useNormalizedEsInterval\" | \"scaleMetricValues\" | \"used_time_zone\" | \"drop_partials\" | \"format\"> & Pick<{ timeRange?: ",
+              ".DATE_HISTOGRAM>, \"interval\" | \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"time_zone\" | \"used_interval\" | \"min_doc_count\" | \"useNormalizedEsInterval\" | \"scaleMetricValues\" | \"used_time_zone\" | \"drop_partials\" | \"format\"> & Pick<{ timeRange?: ",
               {
                 "pluginId": "expressions",
                 "scope": "common",
@@ -10204,7 +9924,7 @@
                 "section": "def-common.ExtendedBounds",
                 "text": "ExtendedBounds"
               },
-              "> | undefined; }, never>, \"enabled\" | \"interval\" | \"id\" | \"timeRange\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"time_zone\" | \"used_interval\" | \"min_doc_count\" | \"extended_bounds\" | \"useNormalizedEsInterval\" | \"scaleMetricValues\" | \"used_time_zone\" | \"drop_partials\" | \"format\">, ",
+              "> | undefined; }, never>, \"interval\" | \"id\" | \"timeRange\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"time_zone\" | \"used_interval\" | \"min_doc_count\" | \"extended_bounds\" | \"useNormalizedEsInterval\" | \"scaleMetricValues\" | \"used_time_zone\" | \"drop_partials\" | \"format\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -10260,11 +9980,11 @@
                 "section": "def-common.BUCKET_TYPES",
                 "text": "BUCKET_TYPES"
               },
-              ".TERMS>, \"enabled\" | \"id\" | \"size\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"orderBy\" | \"order\" | \"missingBucket\" | \"missingBucketLabel\" | \"otherBucket\" | \"otherBucketLabel\" | \"exclude\" | \"include\"> & Pick<{ orderAgg?: ",
+              ".TERMS>, \"id\" | \"size\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"orderBy\" | \"order\" | \"missingBucket\" | \"missingBucketLabel\" | \"otherBucket\" | \"otherBucketLabel\" | \"exclude\" | \"include\"> & Pick<{ orderAgg?: ",
               "AggExpressionType",
               " | undefined; }, \"orderAgg\"> & Pick<{ orderAgg?: ",
               "AggExpressionType",
-              " | undefined; }, never>, \"enabled\" | \"id\" | \"size\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"orderBy\" | \"orderAgg\" | \"order\" | \"missingBucket\" | \"missingBucketLabel\" | \"otherBucket\" | \"otherBucketLabel\" | \"exclude\" | \"include\">, ",
+              " | undefined; }, never>, \"id\" | \"size\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"orderBy\" | \"orderAgg\" | \"order\" | \"missingBucket\" | \"missingBucketLabel\" | \"otherBucket\" | \"otherBucketLabel\" | \"exclude\" | \"include\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -10376,7 +10096,7 @@
                 "section": "def-common.METRIC_TYPES",
                 "text": "METRIC_TYPES"
               },
-              ".AVG_BUCKET>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ customBucket?: ",
+              ".AVG_BUCKET>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ customBucket?: ",
               "AggExpressionType",
               " | undefined; customMetric?: ",
               "AggExpressionType",
@@ -10384,7 +10104,7 @@
               "AggExpressionType",
               " | undefined; customMetric?: ",
               "AggExpressionType",
-              " | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"customBucket\">, ",
+              " | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"customBucket\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -10440,7 +10160,7 @@
                 "section": "def-common.METRIC_TYPES",
                 "text": "METRIC_TYPES"
               },
-              ".MAX_BUCKET>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ customBucket?: ",
+              ".MAX_BUCKET>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ customBucket?: ",
               "AggExpressionType",
               " | undefined; customMetric?: ",
               "AggExpressionType",
@@ -10448,7 +10168,7 @@
               "AggExpressionType",
               " | undefined; customMetric?: ",
               "AggExpressionType",
-              " | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"customBucket\">, ",
+              " | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"customBucket\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -10504,7 +10224,7 @@
                 "section": "def-common.METRIC_TYPES",
                 "text": "METRIC_TYPES"
               },
-              ".MIN_BUCKET>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ customBucket?: ",
+              ".MIN_BUCKET>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ customBucket?: ",
               "AggExpressionType",
               " | undefined; customMetric?: ",
               "AggExpressionType",
@@ -10512,7 +10232,7 @@
               "AggExpressionType",
               " | undefined; customMetric?: ",
               "AggExpressionType",
-              " | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"customBucket\">, ",
+              " | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"customBucket\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -10568,7 +10288,7 @@
                 "section": "def-common.METRIC_TYPES",
                 "text": "METRIC_TYPES"
               },
-              ".SUM_BUCKET>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ customBucket?: ",
+              ".SUM_BUCKET>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ customBucket?: ",
               "AggExpressionType",
               " | undefined; customMetric?: ",
               "AggExpressionType",
@@ -10576,7 +10296,7 @@
               "AggExpressionType",
               " | undefined; customMetric?: ",
               "AggExpressionType",
-              " | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"customBucket\">, ",
+              " | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"customBucket\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -10632,7 +10352,7 @@
                 "section": "def-common.METRIC_TYPES",
                 "text": "METRIC_TYPES"
               },
-              ".FILTERED_METRIC>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ customBucket?: ",
+              ".FILTERED_METRIC>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ customBucket?: ",
               "AggExpressionType",
               " | undefined; customMetric?: ",
               "AggExpressionType",
@@ -10640,7 +10360,7 @@
               "AggExpressionType",
               " | undefined; customMetric?: ",
               "AggExpressionType",
-              " | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"customBucket\">, ",
+              " | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"customBucket\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -10808,11 +10528,11 @@
                 "section": "def-common.METRIC_TYPES",
                 "text": "METRIC_TYPES"
               },
-              ".CUMULATIVE_SUM>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"buckets_path\" | \"metricAgg\"> & Pick<{ customMetric?: ",
+              ".CUMULATIVE_SUM>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"buckets_path\" | \"metricAgg\"> & Pick<{ customMetric?: ",
               "AggExpressionType",
               " | undefined; }, \"customMetric\"> & Pick<{ customMetric?: ",
               "AggExpressionType",
-              " | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"buckets_path\" | \"metricAgg\">, ",
+              " | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"buckets_path\" | \"metricAgg\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -10868,11 +10588,11 @@
                 "section": "def-common.METRIC_TYPES",
                 "text": "METRIC_TYPES"
               },
-              ".DERIVATIVE>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"buckets_path\" | \"metricAgg\"> & Pick<{ customMetric?: ",
+              ".DERIVATIVE>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"buckets_path\" | \"metricAgg\"> & Pick<{ customMetric?: ",
               "AggExpressionType",
               " | undefined; }, \"customMetric\"> & Pick<{ customMetric?: ",
               "AggExpressionType",
-              " | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"buckets_path\" | \"metricAgg\">, ",
+              " | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"buckets_path\" | \"metricAgg\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -11264,11 +10984,11 @@
                 "section": "def-common.METRIC_TYPES",
                 "text": "METRIC_TYPES"
               },
-              ".MOVING_FN>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"buckets_path\" | \"metricAgg\" | \"window\" | \"script\"> & Pick<{ customMetric?: ",
+              ".MOVING_FN>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"buckets_path\" | \"metricAgg\" | \"window\" | \"script\"> & Pick<{ customMetric?: ",
               "AggExpressionType",
               " | undefined; }, \"customMetric\"> & Pick<{ customMetric?: ",
               "AggExpressionType",
-              " | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"buckets_path\" | \"metricAgg\" | \"window\" | \"script\">, ",
+              " | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"buckets_path\" | \"metricAgg\" | \"window\" | \"script\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -11436,11 +11156,11 @@
                 "section": "def-common.METRIC_TYPES",
                 "text": "METRIC_TYPES"
               },
-              ".SERIAL_DIFF>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"buckets_path\" | \"metricAgg\"> & Pick<{ customMetric?: ",
+              ".SERIAL_DIFF>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"buckets_path\" | \"metricAgg\"> & Pick<{ customMetric?: ",
               "AggExpressionType",
               " | undefined; }, \"customMetric\"> & Pick<{ customMetric?: ",
               "AggExpressionType",
-              " | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"buckets_path\" | \"metricAgg\">, ",
+              " | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"buckets_path\" | \"metricAgg\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -12387,14 +12107,6 @@
             "plugin": "fleet",
             "path": "x-pack/plugins/fleet/public/applications/fleet/components/search_bar.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
           {
             "plugin": "infra",
             "path": "x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/custom_metric_form.tsx"
@@ -12567,34 +12279,6 @@
             "plugin": "stackAlerts",
             "path": "x-pack/plugins/stack_alerts/public/alert_types/geo_containment/query_builder/util_components/single_field_select.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.test.ts"
-          },
           {
             "plugin": "infra",
             "path": "x-pack/plugins/infra/target/types/public/alerting/common/group_by_expression/group_by_expression.d.ts"
@@ -13137,142 +12821,6 @@
             "plugin": "timelines",
             "path": "x-pack/plugins/timelines/public/container/source/index.tsx"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/with_kuery_autocompletion.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/with_kuery_autocompletion.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/kuery_bar.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/kuery_bar.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service_analytics.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service_analytics.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_recognizer/data_recognizer.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_recognizer/data_recognizer.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/inventory_view/components/toolbars/toolbar.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/inventory_view/components/toolbars/toolbar.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/utils/kuery.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/utils/kuery.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_data.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_data.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/alerting/metric_threshold/hooks/use_metrics_explorer_chart_data.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/alerting/metric_threshold/hooks/use_metrics_explorer_chart_data.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/alerting/metric_threshold/components/expression_chart.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/alerting/metric_threshold/components/expression_chart.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/logs/log_filter/log_filter_state.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/logs/log_filter/log_filter_state.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/with_source/with_source.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/with_source/with_source.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/toolbar.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/toolbar.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metric_explorer_state.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metric_explorer_state.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/index.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/index.tsx"
-          },
           {
             "plugin": "monitoring",
             "path": "x-pack/plugins/monitoring/public/alerts/components/param_details_form/use_derived_index_pattern.tsx"
@@ -13517,30 +13065,6 @@
             "plugin": "timelines",
             "path": "x-pack/plugins/timelines/public/mock/index_pattern.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/containers/with_kuery_autocompletion.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/containers/with_kuery_autocompletion.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/containers/with_source/with_source.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/containers/with_source/with_source.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/index_pattern_context.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/index_pattern_context.ts"
-          },
           {
             "plugin": "monitoring",
             "path": "x-pack/plugins/monitoring/target/types/public/components/kuery_bar/with_kuery_autocompletion.d.ts"
@@ -13585,30 +13109,6 @@
             "plugin": "securitySolution",
             "path": "x-pack/plugins/security_solution/target/types/public/network/components/network_top_countries_table/columns.d.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/alerting/metric_threshold/components/expression_chart.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/alerting/metric_threshold/components/expression_chart.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/alerting/metric_threshold/hooks/use_metrics_explorer_chart_data.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/alerting/metric_threshold/hooks/use_metrics_explorer_chart_data.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/pages/metrics/metrics_explorer/index.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/pages/metrics/metrics_explorer/index.d.ts"
-          },
           {
             "plugin": "monitoring",
             "path": "x-pack/plugins/monitoring/target/types/public/alerts/components/param_details_form/use_derived_index_pattern.d.ts"
@@ -13657,34 +13157,6 @@
             "plugin": "securitySolution",
             "path": "x-pack/plugins/security_solution/target/types/public/ueba/pages/details/types.d.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/pages/metrics/metrics_explorer/hooks/use_metric_explorer_state.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/pages/metrics/metrics_explorer/hooks/use_metric_explorer_state.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_data.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_data.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/jobs/new_job/common/index_pattern_context.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/jobs/new_job/common/index_pattern_context.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/jobs/new_job/common/index_pattern_context.d.ts"
-          },
           {
             "plugin": "indexPatternManagement",
             "path": "src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/components/table/table.tsx"
@@ -13717,70 +13189,6 @@
             "plugin": "indexPatternManagement",
             "path": "src/plugins/index_pattern_management/target/types/public/components/edit_index_pattern/index_header/index_header.d.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_query_bar/exploration_query_bar.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_query_bar/exploration_query_bar.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/clone_action_name.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/clone_action_name.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/use_delete_action.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/use_delete_action.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/utils.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/utils.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/editor.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/editor.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_utils.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_utils.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/tabs/custom_urls.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/tabs/custom_urls.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/index.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/index.tsx"
-          },
           {
             "plugin": "securitySolution",
             "path": "x-pack/plugins/security_solution/common/search_strategy/index_fields/index.ts"
@@ -13889,14 +13297,6 @@
             "plugin": "transform",
             "path": "x-pack/plugins/transform/server/routes/api/transforms.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
           {
             "plugin": "securitySolution",
             "path": "x-pack/plugins/security_solution/public/common/mock/index_pattern.ts"
@@ -13904,34 +13304,6 @@
           {
             "plugin": "securitySolution",
             "path": "x-pack/plugins/security_solution/public/common/mock/index_pattern.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/explorer/components/explorer_query_bar/explorer_query_bar.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/explorer/components/explorer_query_bar/explorer_query_bar.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/explorer/components/explorer_query_bar/explorer_query_bar.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.test.ts"
           }
         ],
         "children": [
@@ -14026,9 +13398,9 @@
             "signature": [
               "Record<string, ",
               {
-                "pluginId": "expressions",
+                "pluginId": "fieldFormats",
                 "scope": "common",
-                "docId": "kibExpressionsPluginApi",
+                "docId": "kibFieldFormatsPluginApi",
                 "section": "def-common.SerializedFieldFormat",
                 "text": "SerializedFieldFormat"
               },
@@ -15223,7 +14595,7 @@
             "section": "def-common.IAggType",
             "text": "IAggType"
           },
-          "; enabled?: boolean | undefined; id?: string | undefined; schema?: string | undefined; params?: {} | ",
+          "; id?: string | undefined; enabled?: boolean | undefined; schema?: string | undefined; params?: {} | ",
           {
             "pluginId": "@kbn/utility-types",
             "scope": "server",
@@ -15404,7 +14776,7 @@
             "section": "def-server.SerializableRecord",
             "text": "SerializableRecord"
           },
-          " | undefined; schema?: string | undefined; }, \"enabled\" | \"id\" | \"schema\" | \"params\"> & Pick<{ type: string | ",
+          " | undefined; schema?: string | undefined; }, \"id\" | \"enabled\" | \"schema\" | \"params\"> & Pick<{ type: string | ",
           {
             "pluginId": "data",
             "scope": "common",
@@ -15420,7 +14792,7 @@
             "section": "def-common.IAggType",
             "text": "IAggType"
           },
-          "; }, never>, \"type\" | \"enabled\" | \"id\" | \"schema\" | \"params\">[] | undefined) => ",
+          "; }, never>, \"type\" | \"id\" | \"enabled\" | \"schema\" | \"params\">[] | undefined) => ",
           {
             "pluginId": "data",
             "scope": "common",
@@ -15492,23 +14864,23 @@
         "label": "DataViewsContract",
         "description": [],
         "signature": [
-          "{ get: (id: string) => Promise<",
+          "{ create: (spec: ",
           {
             "pluginId": "dataViews",
             "scope": "common",
             "docId": "kibDataViewsPluginApi",
-            "section": "def-common.DataView",
-            "text": "DataView"
+            "section": "def-common.DataViewSpec",
+            "text": "DataViewSpec"
           },
-          ">; delete: (indexPatternId: string) => Promise<{}>; create: (spec: ",
+          ", skipFetchFields?: boolean) => Promise<",
           {
             "pluginId": "dataViews",
             "scope": "common",
             "docId": "kibDataViewsPluginApi",
-            "section": "def-common.DataViewSpec",
-            "text": "DataViewSpec"
+            "section": "def-common.DataView",
+            "text": "DataView"
           },
-          ", skipFetchFields?: boolean) => Promise<",
+          ">; delete: (indexPatternId: string) => Promise<{}>; find: (search: string, size?: number) => Promise<",
           {
             "pluginId": "dataViews",
             "scope": "common",
@@ -15516,7 +14888,7 @@
             "section": "def-common.DataView",
             "text": "DataView"
           },
-          ">; find: (search: string, size?: number) => Promise<",
+          "[]>; get: (id: string) => Promise<",
           {
             "pluginId": "dataViews",
             "scope": "common",
@@ -15524,7 +14896,7 @@
             "section": "def-common.DataView",
             "text": "DataView"
           },
-          "[]>; ensureDefaultDataView: ",
+          ">; ensureDefaultDataView: ",
           "EnsureDefaultDataView",
           "; getIds: (refresh?: boolean) => Promise<string[]>; getTitles: (refresh?: boolean) => Promise<string[]>; getIdsWithTitle: (refresh?: boolean) => Promise<",
           {
@@ -15674,7 +15046,15 @@
             "section": "def-common.DataView",
             "text": "DataView"
           },
-          ", saveAttempts?: number, ignoreErrors?: boolean) => Promise<void | Error>; }"
+          ", saveAttempts?: number, ignoreErrors?: boolean) => Promise<void | Error>; getDefaultDataView: () => Promise<",
+          {
+            "pluginId": "dataViews",
+            "scope": "common",
+            "docId": "kibDataViewsPluginApi",
+            "section": "def-common.DataView",
+            "text": "DataView"
+          },
+          " | undefined>; }"
         ],
         "path": "src/plugins/data_views/common/data_views/data_views.ts",
         "deprecated": false,
@@ -17638,6 +17018,10 @@
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
+          },
           {
             "plugin": "securitySolution",
             "path": "x-pack/plugins/security_solution/server/lib/detection_engine/types.ts"
@@ -18191,14 +17575,6 @@
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/components/sidebar/discover_index_pattern.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
           {
             "plugin": "transform",
             "path": "x-pack/plugins/transform/public/app/hooks/use_search_items/common.ts"
@@ -18227,34 +17603,6 @@
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/main/components/sidebar/discover_index_pattern.d.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts"
-          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/components/sidebar/discover_sidebar_responsive.tsx"
@@ -18290,22 +17638,6 @@
           {
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/discover_main_route.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/common/types/kibana.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/common/types/kibana.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/common/types/kibana.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/common/types/kibana.d.ts"
           }
         ],
         "initialIsOpen": false
@@ -18429,23 +17761,23 @@
         "label": "IndexPatternsContract",
         "description": [],
         "signature": [
-          "{ get: (id: string) => Promise<",
+          "{ create: (spec: ",
           {
             "pluginId": "dataViews",
             "scope": "common",
             "docId": "kibDataViewsPluginApi",
-            "section": "def-common.DataView",
-            "text": "DataView"
+            "section": "def-common.DataViewSpec",
+            "text": "DataViewSpec"
           },
-          ">; delete: (indexPatternId: string) => Promise<{}>; create: (spec: ",
+          ", skipFetchFields?: boolean) => Promise<",
           {
             "pluginId": "dataViews",
             "scope": "common",
             "docId": "kibDataViewsPluginApi",
-            "section": "def-common.DataViewSpec",
-            "text": "DataViewSpec"
+            "section": "def-common.DataView",
+            "text": "DataView"
           },
-          ", skipFetchFields?: boolean) => Promise<",
+          ">; delete: (indexPatternId: string) => Promise<{}>; find: (search: string, size?: number) => Promise<",
           {
             "pluginId": "dataViews",
             "scope": "common",
@@ -18453,7 +17785,7 @@
             "section": "def-common.DataView",
             "text": "DataView"
           },
-          ">; find: (search: string, size?: number) => Promise<",
+          "[]>; get: (id: string) => Promise<",
           {
             "pluginId": "dataViews",
             "scope": "common",
@@ -18461,7 +17793,7 @@
             "section": "def-common.DataView",
             "text": "DataView"
           },
-          "[]>; ensureDefaultDataView: ",
+          ">; ensureDefaultDataView: ",
           "EnsureDefaultDataView",
           "; getIds: (refresh?: boolean) => Promise<string[]>; getTitles: (refresh?: boolean) => Promise<string[]>; getIdsWithTitle: (refresh?: boolean) => Promise<",
           {
@@ -18611,7 +17943,15 @@
             "section": "def-common.DataView",
             "text": "DataView"
           },
-          ", saveAttempts?: number, ignoreErrors?: boolean) => Promise<void | Error>; }"
+          ", saveAttempts?: number, ignoreErrors?: boolean) => Promise<void | Error>; getDefaultDataView: () => Promise<",
+          {
+            "pluginId": "dataViews",
+            "scope": "common",
+            "docId": "kibDataViewsPluginApi",
+            "section": "def-common.DataView",
+            "text": "DataView"
+          },
+          " | undefined>; }"
         ],
         "path": "src/plugins/data_views/common/data_views/data_views.ts",
         "deprecated": true,
@@ -18644,50 +17984,6 @@
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/utils/resolve_index_pattern.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/logs/log_source/log_source.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/logs/log_source/log_source.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
           {
             "plugin": "observability",
             "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/rtl_helpers.tsx"
@@ -18776,22 +18072,6 @@
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/doc/components/doc.tsx"
           },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/anchor.ts"
-          },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/anchor.ts"
-          },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/context.ts"
-          },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/context.ts"
-          },
           {
             "plugin": "visualizations",
             "path": "src/plugins/visualizations/public/saved_visualizations/_saved_vis.ts"
@@ -18864,66 +18144,6 @@
             "plugin": "maps",
             "path": "x-pack/plugins/maps/public/lazy_load_bundle/index.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/dependency_cache.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/dependency_cache.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/routing/resolvers.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/routing/resolvers.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/routing/router.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/routing/router.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts"
-          },
           {
             "plugin": "graph",
             "path": "x-pack/plugins/graph/public/application.ts"
@@ -18988,30 +18208,6 @@
             "plugin": "maps",
             "path": "x-pack/plugins/maps/target/types/public/lazy_load_bundle/index.d.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_patterns.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_patterns.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/routing/router.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/routing/router.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/util/dependency_cache.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/util/dependency_cache.d.ts"
-          },
           {
             "plugin": "security",
             "path": "x-pack/plugins/security/target/types/public/management/roles/edit_role/edit_role_page.d.ts"
@@ -19148,14 +18344,6 @@
             "plugin": "indexPatternManagement",
             "path": "src/plugins/index_pattern_management/target/types/public/components/utils.d.ts"
           },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/_stubs.ts"
-          },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/_stubs.ts"
-          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/doc/components/doc.d.ts"
@@ -19163,14 +18351,6 @@
           {
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/doc/components/doc.d.ts"
-          },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
-          },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
           }
         ],
         "initialIsOpen": false
@@ -19361,7 +18541,7 @@
             "section": "def-common.SearchSource",
             "text": "SearchSource"
           },
-          "; history: Record<string, any>[]; setPreferredSearchStrategyId: (searchStrategyId: string) => void; setField: <K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, value: ",
+          "; history: Record<string, any>[]; setPreferredSearchStrategyId: (searchStrategyId: string) => void; setField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, value: ",
           {
             "pluginId": "data",
             "scope": "common",
@@ -19377,7 +18557,7 @@
             "section": "def-common.SearchSource",
             "text": "SearchSource"
           },
-          "; removeField: <K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
+          "; removeField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
           {
             "pluginId": "data",
             "scope": "common",
@@ -19409,7 +18589,7 @@
             "section": "def-common.SearchSourceFields",
             "text": "SearchSourceFields"
           },
-          "; getField: <K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, recurse?: boolean) => ",
+          "; getField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, recurse?: boolean) => ",
           {
             "pluginId": "data",
             "scope": "common",
@@ -19417,7 +18597,7 @@
             "section": "def-common.SearchSourceFields",
             "text": "SearchSourceFields"
           },
-          "[K]; getOwnField: <K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
+          "[K]; getOwnField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
           {
             "pluginId": "data",
             "scope": "common",
@@ -25388,23 +24568,23 @@
             "\ndata views service\n{@link DataViewsContract}"
           ],
           "signature": [
-            "{ get: (id: string) => Promise<",
+            "{ create: (spec: ",
             {
               "pluginId": "dataViews",
               "scope": "common",
               "docId": "kibDataViewsPluginApi",
-              "section": "def-common.DataView",
-              "text": "DataView"
+              "section": "def-common.DataViewSpec",
+              "text": "DataViewSpec"
             },
-            ">; delete: (indexPatternId: string) => Promise<{}>; create: (spec: ",
+            ", skipFetchFields?: boolean) => Promise<",
             {
               "pluginId": "dataViews",
               "scope": "common",
               "docId": "kibDataViewsPluginApi",
-              "section": "def-common.DataViewSpec",
-              "text": "DataViewSpec"
+              "section": "def-common.DataView",
+              "text": "DataView"
             },
-            ", skipFetchFields?: boolean) => Promise<",
+            ">; delete: (indexPatternId: string) => Promise<{}>; find: (search: string, size?: number) => Promise<",
             {
               "pluginId": "dataViews",
               "scope": "common",
@@ -25412,7 +24592,7 @@
               "section": "def-common.DataView",
               "text": "DataView"
             },
-            ">; find: (search: string, size?: number) => Promise<",
+            "[]>; get: (id: string) => Promise<",
             {
               "pluginId": "dataViews",
               "scope": "common",
@@ -25420,7 +24600,7 @@
               "section": "def-common.DataView",
               "text": "DataView"
             },
-            "[]>; ensureDefaultDataView: ",
+            ">; ensureDefaultDataView: ",
             "EnsureDefaultDataView",
             "; getIds: (refresh?: boolean) => Promise<string[]>; getTitles: (refresh?: boolean) => Promise<string[]>; getIdsWithTitle: (refresh?: boolean) => Promise<",
             {
@@ -25570,7 +24750,15 @@
               "section": "def-common.DataView",
               "text": "DataView"
             },
-            ", saveAttempts?: number, ignoreErrors?: boolean) => Promise<void | Error>; }"
+            ", saveAttempts?: number, ignoreErrors?: boolean) => Promise<void | Error>; getDefaultDataView: () => Promise<",
+            {
+              "pluginId": "dataViews",
+              "scope": "common",
+              "docId": "kibDataViewsPluginApi",
+              "section": "def-common.DataView",
+              "text": "DataView"
+            },
+            " | undefined>; }"
           ],
           "path": "src/plugins/data/public/types.ts",
           "deprecated": false
@@ -25587,23 +24775,23 @@
             "\nindex patterns service\n{@link DataViewsContract}"
           ],
           "signature": [
-            "{ get: (id: string) => Promise<",
+            "{ create: (spec: ",
             {
               "pluginId": "dataViews",
               "scope": "common",
               "docId": "kibDataViewsPluginApi",
-              "section": "def-common.DataView",
-              "text": "DataView"
+              "section": "def-common.DataViewSpec",
+              "text": "DataViewSpec"
             },
-            ">; delete: (indexPatternId: string) => Promise<{}>; create: (spec: ",
+            ", skipFetchFields?: boolean) => Promise<",
             {
               "pluginId": "dataViews",
               "scope": "common",
               "docId": "kibDataViewsPluginApi",
-              "section": "def-common.DataViewSpec",
-              "text": "DataViewSpec"
+              "section": "def-common.DataView",
+              "text": "DataView"
             },
-            ", skipFetchFields?: boolean) => Promise<",
+            ">; delete: (indexPatternId: string) => Promise<{}>; find: (search: string, size?: number) => Promise<",
             {
               "pluginId": "dataViews",
               "scope": "common",
@@ -25611,7 +24799,7 @@
               "section": "def-common.DataView",
               "text": "DataView"
             },
-            ">; find: (search: string, size?: number) => Promise<",
+            "[]>; get: (id: string) => Promise<",
             {
               "pluginId": "dataViews",
               "scope": "common",
@@ -25619,7 +24807,7 @@
               "section": "def-common.DataView",
               "text": "DataView"
             },
-            "[]>; ensureDefaultDataView: ",
+            ">; ensureDefaultDataView: ",
             "EnsureDefaultDataView",
             "; getIds: (refresh?: boolean) => Promise<string[]>; getTitles: (refresh?: boolean) => Promise<string[]>; getIdsWithTitle: (refresh?: boolean) => Promise<",
             {
@@ -25769,7 +24957,15 @@
               "section": "def-common.DataView",
               "text": "DataView"
             },
-            ", saveAttempts?: number, ignoreErrors?: boolean) => Promise<void | Error>; }"
+            ", saveAttempts?: number, ignoreErrors?: boolean) => Promise<void | Error>; getDefaultDataView: () => Promise<",
+            {
+              "pluginId": "dataViews",
+              "scope": "common",
+              "docId": "kibDataViewsPluginApi",
+              "section": "def-common.DataView",
+              "text": "DataView"
+            },
+            " | undefined>; }"
           ],
           "path": "src/plugins/data/public/types.ts",
           "deprecated": true,
@@ -26672,7 +25868,7 @@
                     "section": "def-server.PluginInitializerContext",
                     "text": "PluginInitializerContext"
                   },
-                  "<Readonly<{} & { search: Readonly<{} & { aggs: Readonly<{} & { shardDelay: Readonly<{} & { enabled: boolean; }>; }>; }>; autocomplete: Readonly<{} & { querySuggestions: Readonly<{} & { enabled: boolean; }>; valueSuggestions: Readonly<{} & { enabled: boolean; timeout: moment.Duration; tiers: string[]; terminateAfter: moment.Duration; }>; }>; }>>"
+                  "<Readonly<{} & { search: Readonly<{} & { aggs: Readonly<{} & { shardDelay: Readonly<{} & { enabled: boolean; }>; }>; }>; autocomplete: Readonly<{} & { querySuggestions: Readonly<{} & { enabled: boolean; }>; valueSuggestions: Readonly<{} & { timeout: moment.Duration; enabled: boolean; tiers: string[]; terminateAfter: moment.Duration; }>; }>; }>>"
                 ],
                 "path": "src/plugins/data/server/plugin.ts",
                 "deprecated": false,
@@ -28323,13 +27519,21 @@
             "signature": [
               "(fieldName: string, format: ",
               {
-                "pluginId": "expressions",
+                "pluginId": "fieldFormats",
                 "scope": "common",
-                "docId": "kibExpressionsPluginApi",
+                "docId": "kibFieldFormatsPluginApi",
                 "section": "def-common.SerializedFieldFormat",
                 "text": "SerializedFieldFormat"
               },
-              "<Record<string, any>>) => void"
+              "<",
+              {
+                "pluginId": "fieldFormats",
+                "scope": "common",
+                "docId": "kibFieldFormatsPluginApi",
+                "section": "def-common.FieldFormatParams",
+                "text": "FieldFormatParams"
+              },
+              ">) => void"
             ],
             "path": "src/plugins/data_views/common/data_views/data_view.ts",
             "deprecated": false,
@@ -28357,13 +27561,21 @@
                 "description": [],
                 "signature": [
                   {
-                    "pluginId": "expressions",
+                    "pluginId": "fieldFormats",
                     "scope": "common",
-                    "docId": "kibExpressionsPluginApi",
+                    "docId": "kibFieldFormatsPluginApi",
                     "section": "def-common.SerializedFieldFormat",
                     "text": "SerializedFieldFormat"
                   },
-                  "<Record<string, any>>"
+                  "<",
+                  {
+                    "pluginId": "fieldFormats",
+                    "scope": "common",
+                    "docId": "kibFieldFormatsPluginApi",
+                    "section": "def-common.FieldFormatParams",
+                    "text": "FieldFormatParams"
+                  },
+                  ">"
                 ],
                 "path": "src/plugins/data_views/common/data_views/data_view.ts",
                 "deprecated": false,
@@ -28786,18 +27998,6 @@
             "plugin": "observability",
             "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_app_index_pattern.tsx"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
           {
             "plugin": "maps",
             "path": "x-pack/plugins/maps/public/embeddable/types.ts"
@@ -28970,30 +28170,6 @@
             "plugin": "dataVisualizer",
             "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/embeddables/types.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/embeddables/types.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx"
-          },
           {
             "plugin": "apm",
             "path": "x-pack/plugins/apm/public/components/app/RumDashboard/LocalUIFilters/SelectedFilters.tsx"
@@ -29122,14 +28298,6 @@
             "plugin": "transform",
             "path": "x-pack/plugins/transform/common/types/index_pattern.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
           {
             "plugin": "lens",
             "path": "x-pack/plugins/lens/server/routes/existing_fields.test.ts"
@@ -29162,14 +28330,6 @@
             "plugin": "dataVisualizer",
             "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/saved_search_utils.test.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
           {
             "plugin": "lens",
             "path": "x-pack/plugins/lens/target/types/server/routes/existing_fields.d.ts"
@@ -29302,6 +28462,22 @@
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/main/components/doc_table/doc_table_wrapper.d.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.predecessors.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.predecessors.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.successors.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.successors.test.ts"
+          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/utils/get_switch_index_pattern_app_state.test.ts"
@@ -29450,6 +28626,18 @@
             "plugin": "dataViews",
             "path": "src/plugins/data_views/common/fields/data_view_field.test.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_fetch.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_fetch.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_fetch.test.ts"
+          },
           {
             "plugin": "dataViews",
             "path": "src/plugins/data_views/public/index.ts"
@@ -29636,11 +28824,11 @@
           },
           {
             "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_state.ts"
+            "path": "src/plugins/discover/public/application/apps/context/services/anchor.ts"
           },
           {
             "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_state.ts"
+            "path": "src/plugins/discover/public/application/apps/context/services/anchor.ts"
           },
           {
             "plugin": "discover",
@@ -29648,7 +28836,11 @@
           },
           {
             "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/anchor.ts"
+            "path": "src/plugins/discover/public/application/apps/context/services/context.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.ts"
           },
           {
             "plugin": "discover",
@@ -30074,250 +29266,6 @@
             "plugin": "dataVisualizer",
             "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/full_time_range_selector/full_time_range_selector.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/field_format_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/field_format_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/scatterplot_matrix/use_scatterplot_field_options.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/scatterplot_matrix/use_scatterplot_field_options.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/scatterplot_matrix/scatterplot_matrix.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/scatterplot_matrix/scatterplot_matrix.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/single_metric_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/single_metric_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/multi_metric_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/multi_metric_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/population_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/population_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/advanced_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/advanced_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/categorization_examples_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/categorization_examples_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/categorization_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/categorization_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/rare_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/rare_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator_factory.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator_factory.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/expandable_section/expandable_section_results.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/expandable_section/expandable_section_results.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/outlier_exploration/use_outlier_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/outlier_exploration/use_outlier_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/use_exploration_results.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/use_exploration_results.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/exploration_results_table.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/exploration_results_table.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
           {
             "plugin": "apm",
             "path": "x-pack/plugins/apm/public/components/shared/kuery_bar/index.tsx"
@@ -30618,22 +29566,6 @@
             "plugin": "maps",
             "path": "x-pack/plugins/maps/target/types/public/components/geo_index_pattern_select.d.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities._service.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities._service.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/remove_nested_field_children.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/remove_nested_field_children.test.ts"
-          },
           {
             "plugin": "maps",
             "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/util/get_docvalue_source_fields.test.ts"
@@ -30646,14 +29578,6 @@
             "plugin": "maps",
             "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/util/get_docvalue_source_fields.test.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_pattern.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_pattern.ts"
-          },
           {
             "plugin": "maps",
             "path": "x-pack/plugins/maps/target/types/public/classes/fields/agg/count_agg_field.d.ts"
@@ -30718,14 +29642,6 @@
             "plugin": "maps",
             "path": "x-pack/plugins/maps/target/types/public/connected_components/edit_layer_panel/filter_editor/filter_editor.d.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/components/full_time_range_selector/full_time_range_selector.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/components/full_time_range_selector/full_time_range_selector.d.ts"
-          },
           {
             "plugin": "dataVisualizer",
             "path": "x-pack/plugins/data_visualizer/target/types/public/application/index_data_visualizer/components/full_time_range_selector/full_time_range_selector.d.ts"
@@ -31246,6 +30162,14 @@
             "plugin": "visDefaultEditor",
             "path": "src/plugins/vis_default_editor/target/types/public/components/agg_select.d.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/anchor.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/anchor.test.ts"
+          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/utils/get_sharing_data.test.ts"
@@ -31294,6 +30218,14 @@
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
+          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/main/utils/nested_fields.d.ts"
@@ -34123,14 +33055,6 @@
             "plugin": "fleet",
             "path": "x-pack/plugins/fleet/public/applications/fleet/components/search_bar.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
           {
             "plugin": "infra",
             "path": "x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/custom_metric_form.tsx"
@@ -34303,34 +33227,6 @@
             "plugin": "stackAlerts",
             "path": "x-pack/plugins/stack_alerts/public/alert_types/geo_containment/query_builder/util_components/single_field_select.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.test.ts"
-          },
           {
             "plugin": "infra",
             "path": "x-pack/plugins/infra/target/types/public/alerting/common/group_by_expression/group_by_expression.d.ts"
@@ -36660,6 +35556,10 @@
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
+          },
           {
             "plugin": "securitySolution",
             "path": "x-pack/plugins/security_solution/server/lib/detection_engine/types.ts"
@@ -37096,14 +35996,6 @@
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/components/sidebar/discover_index_pattern.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
           {
             "plugin": "transform",
             "path": "x-pack/plugins/transform/public/app/hooks/use_search_items/common.ts"
@@ -37132,34 +36024,6 @@
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/main/components/sidebar/discover_index_pattern.d.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts"
-          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/components/sidebar/discover_sidebar_responsive.tsx"
@@ -37195,22 +36059,6 @@
           {
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/discover_main_route.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/common/types/kibana.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/common/types/kibana.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/common/types/kibana.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/common/types/kibana.d.ts"
           }
         ],
         "initialIsOpen": false
@@ -40706,13 +39554,21 @@
             "signature": [
               "(fieldName: string, format: ",
               {
-                "pluginId": "expressions",
+                "pluginId": "fieldFormats",
                 "scope": "common",
-                "docId": "kibExpressionsPluginApi",
+                "docId": "kibFieldFormatsPluginApi",
                 "section": "def-common.SerializedFieldFormat",
                 "text": "SerializedFieldFormat"
               },
-              "<Record<string, any>>) => void"
+              "<",
+              {
+                "pluginId": "fieldFormats",
+                "scope": "common",
+                "docId": "kibFieldFormatsPluginApi",
+                "section": "def-common.FieldFormatParams",
+                "text": "FieldFormatParams"
+              },
+              ">) => void"
             ],
             "path": "src/plugins/data_views/common/data_views/data_view.ts",
             "deprecated": false,
@@ -40740,13 +39596,21 @@
                 "description": [],
                 "signature": [
                   {
-                    "pluginId": "expressions",
+                    "pluginId": "fieldFormats",
                     "scope": "common",
-                    "docId": "kibExpressionsPluginApi",
+                    "docId": "kibFieldFormatsPluginApi",
                     "section": "def-common.SerializedFieldFormat",
                     "text": "SerializedFieldFormat"
                   },
-                  "<Record<string, any>>"
+                  "<",
+                  {
+                    "pluginId": "fieldFormats",
+                    "scope": "common",
+                    "docId": "kibFieldFormatsPluginApi",
+                    "section": "def-common.FieldFormatParams",
+                    "text": "FieldFormatParams"
+                  },
+                  ">"
                 ],
                 "path": "src/plugins/data_views/common/data_views/data_view.ts",
                 "deprecated": false,
@@ -41478,14 +40342,38 @@
             "parentPluginId": "data",
             "id": "def-common.DataViewsService.ensureDefaultDataView",
             "type": "Function",
-            "tags": [],
+            "tags": [
+              "deprecated"
+            ],
             "label": "ensureDefaultDataView",
             "description": [],
             "signature": [
               "() => Promise<unknown> | undefined"
             ],
             "path": "src/plugins/data_views/common/data_views/data_views.ts",
-            "deprecated": false,
+            "deprecated": true,
+            "references": [
+              {
+                "plugin": "dataViews",
+                "path": "src/plugins/data_views/common/data_views/data_views.ts"
+              },
+              {
+                "plugin": "discover",
+                "path": "src/plugins/discover/public/application/apps/main/discover_main_route.tsx"
+              },
+              {
+                "plugin": "dashboard",
+                "path": "src/plugins/dashboard/public/application/lib/load_saved_dashboard_state.ts"
+              },
+              {
+                "plugin": "lens",
+                "path": "x-pack/plugins/lens/public/plugin.ts"
+              },
+              {
+                "plugin": "visualize",
+                "path": "src/plugins/visualize/public/plugin.ts"
+              }
+            ],
             "returnComment": [],
             "children": []
           },
@@ -42559,6 +41447,33 @@
               }
             ],
             "returnComment": []
+          },
+          {
+            "parentPluginId": "data",
+            "id": "def-common.DataViewsService.getDefaultDataView",
+            "type": "Function",
+            "tags": [],
+            "label": "getDefaultDataView",
+            "description": [
+              "\nReturns the default data view as an object. If no default is found, or it is missing\nanother data view is selected as default and returned."
+            ],
+            "signature": [
+              "() => Promise<",
+              {
+                "pluginId": "dataViews",
+                "scope": "common",
+                "docId": "kibDataViewsPluginApi",
+                "section": "def-common.DataView",
+                "text": "DataView"
+              },
+              " | undefined>"
+            ],
+            "path": "src/plugins/data_views/common/data_views/data_views.ts",
+            "deprecated": false,
+            "children": [],
+            "returnComment": [
+              "default data view"
+            ]
           }
         ],
         "initialIsOpen": false
@@ -42997,18 +41912,6 @@
             "plugin": "observability",
             "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_app_index_pattern.tsx"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
           {
             "plugin": "maps",
             "path": "x-pack/plugins/maps/public/embeddable/types.ts"
@@ -43181,30 +42084,6 @@
             "plugin": "dataVisualizer",
             "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/embeddables/types.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/embeddables/types.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx"
-          },
           {
             "plugin": "apm",
             "path": "x-pack/plugins/apm/public/components/app/RumDashboard/LocalUIFilters/SelectedFilters.tsx"
@@ -43333,14 +42212,6 @@
             "plugin": "transform",
             "path": "x-pack/plugins/transform/common/types/index_pattern.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
           {
             "plugin": "lens",
             "path": "x-pack/plugins/lens/server/routes/existing_fields.test.ts"
@@ -43373,14 +42244,6 @@
             "plugin": "dataVisualizer",
             "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/saved_search_utils.test.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
           {
             "plugin": "lens",
             "path": "x-pack/plugins/lens/target/types/server/routes/existing_fields.d.ts"
@@ -43513,6 +42376,22 @@
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/main/components/doc_table/doc_table_wrapper.d.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.predecessors.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.predecessors.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.successors.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.successors.test.ts"
+          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/utils/get_switch_index_pattern_app_state.test.ts"
@@ -43661,6 +42540,18 @@
             "plugin": "dataViews",
             "path": "src/plugins/data_views/common/fields/data_view_field.test.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_fetch.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_fetch.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_fetch.test.ts"
+          },
           {
             "plugin": "dataViews",
             "path": "src/plugins/data_views/public/index.ts"
@@ -43847,11 +42738,11 @@
           },
           {
             "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_state.ts"
+            "path": "src/plugins/discover/public/application/apps/context/services/anchor.ts"
           },
           {
             "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_state.ts"
+            "path": "src/plugins/discover/public/application/apps/context/services/anchor.ts"
           },
           {
             "plugin": "discover",
@@ -43859,7 +42750,11 @@
           },
           {
             "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/anchor.ts"
+            "path": "src/plugins/discover/public/application/apps/context/services/context.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.ts"
           },
           {
             "plugin": "discover",
@@ -44285,250 +43180,6 @@
             "plugin": "dataVisualizer",
             "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/full_time_range_selector/full_time_range_selector.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/field_format_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/field_format_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/scatterplot_matrix/use_scatterplot_field_options.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/scatterplot_matrix/use_scatterplot_field_options.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/scatterplot_matrix/scatterplot_matrix.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/scatterplot_matrix/scatterplot_matrix.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/single_metric_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/single_metric_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/multi_metric_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/multi_metric_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/population_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/population_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/advanced_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/advanced_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/categorization_examples_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/categorization_examples_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/categorization_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/categorization_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/rare_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/rare_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator_factory.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator_factory.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/expandable_section/expandable_section_results.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/expandable_section/expandable_section_results.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/outlier_exploration/use_outlier_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/outlier_exploration/use_outlier_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/use_exploration_results.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/use_exploration_results.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/exploration_results_table.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/exploration_results_table.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
           {
             "plugin": "apm",
             "path": "x-pack/plugins/apm/public/components/shared/kuery_bar/index.tsx"
@@ -44829,22 +43480,6 @@
             "plugin": "maps",
             "path": "x-pack/plugins/maps/target/types/public/components/geo_index_pattern_select.d.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities._service.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities._service.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/remove_nested_field_children.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/remove_nested_field_children.test.ts"
-          },
           {
             "plugin": "maps",
             "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/util/get_docvalue_source_fields.test.ts"
@@ -44857,14 +43492,6 @@
             "plugin": "maps",
             "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/util/get_docvalue_source_fields.test.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_pattern.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_pattern.ts"
-          },
           {
             "plugin": "maps",
             "path": "x-pack/plugins/maps/target/types/public/classes/fields/agg/count_agg_field.d.ts"
@@ -44929,14 +43556,6 @@
             "plugin": "maps",
             "path": "x-pack/plugins/maps/target/types/public/connected_components/edit_layer_panel/filter_editor/filter_editor.d.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/components/full_time_range_selector/full_time_range_selector.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/components/full_time_range_selector/full_time_range_selector.d.ts"
-          },
           {
             "plugin": "dataVisualizer",
             "path": "x-pack/plugins/data_visualizer/target/types/public/application/index_data_visualizer/components/full_time_range_selector/full_time_range_selector.d.ts"
@@ -45457,6 +44076,14 @@
             "plugin": "visDefaultEditor",
             "path": "src/plugins/vis_default_editor/target/types/public/components/agg_select.d.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/anchor.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/anchor.test.ts"
+          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/utils/get_sharing_data.test.ts"
@@ -45505,6 +44132,14 @@
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
+          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/main/utils/nested_fields.d.ts"
@@ -49402,7 +48037,7 @@
             "section": "def-common.IndexPatternLoadExpressionFunctionDefinition",
             "text": "IndexPatternLoadExpressionFunctionDefinition"
           },
-          ", \"type\" | \"telemetry\" | \"inject\" | \"extract\" | \"migrations\" | \"name\" | \"disabled\" | \"help\" | \"inputTypes\" | \"args\" | \"aliases\" | \"context\">"
+          ", \"telemetry\" | \"inject\" | \"extract\" | \"migrations\" | \"type\" | \"name\" | \"disabled\" | \"help\" | \"inputTypes\" | \"args\" | \"aliases\" | \"context\">"
         ],
         "path": "src/plugins/data_views/common/expressions/load_index_pattern.ts",
         "deprecated": false,
@@ -51306,13 +49941,21 @@
             "signature": [
               "Record<string, ",
               {
-                "pluginId": "expressions",
+                "pluginId": "fieldFormats",
                 "scope": "common",
-                "docId": "kibExpressionsPluginApi",
+                "docId": "kibFieldFormatsPluginApi",
                 "section": "def-common.SerializedFieldFormat",
                 "text": "SerializedFieldFormat"
               },
-              "<Record<string, any>>> | undefined"
+              "<",
+              {
+                "pluginId": "fieldFormats",
+                "scope": "common",
+                "docId": "kibFieldFormatsPluginApi",
+                "section": "def-common.FieldFormatParams",
+                "text": "FieldFormatParams"
+              },
+              ">> | undefined"
             ],
             "path": "src/plugins/data_views/common/types.ts",
             "deprecated": false
@@ -51505,13 +50148,21 @@
             "description": [],
             "signature": [
               {
-                "pluginId": "expressions",
+                "pluginId": "fieldFormats",
                 "scope": "common",
-                "docId": "kibExpressionsPluginApi",
+                "docId": "kibFieldFormatsPluginApi",
                 "section": "def-common.SerializedFieldFormat",
                 "text": "SerializedFieldFormat"
               },
-              "<Record<string, any>> | undefined"
+              "<",
+              {
+                "pluginId": "fieldFormats",
+                "scope": "common",
+                "docId": "kibFieldFormatsPluginApi",
+                "section": "def-common.FieldFormatParams",
+                "text": "FieldFormatParams"
+              },
+              "> | undefined"
             ],
             "path": "src/plugins/data_views/common/types.ts",
             "deprecated": false
@@ -51809,13 +50460,21 @@
             "description": [],
             "signature": [
               {
-                "pluginId": "expressions",
+                "pluginId": "fieldFormats",
                 "scope": "common",
-                "docId": "kibExpressionsPluginApi",
+                "docId": "kibFieldFormatsPluginApi",
                 "section": "def-common.SerializedFieldFormat",
                 "text": "SerializedFieldFormat"
               },
-              "<Record<string, any>> | undefined"
+              "<",
+              {
+                "pluginId": "fieldFormats",
+                "scope": "common",
+                "docId": "kibFieldFormatsPluginApi",
+                "section": "def-common.FieldFormatParams",
+                "text": "FieldFormatParams"
+              },
+              "> | undefined"
             ],
             "path": "src/plugins/data_views/common/types.ts",
             "deprecated": false
@@ -52282,14 +50941,6 @@
             "plugin": "fleet",
             "path": "x-pack/plugins/fleet/public/applications/fleet/components/search_bar.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
           {
             "plugin": "infra",
             "path": "x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/custom_metric_form.tsx"
@@ -52462,34 +51113,6 @@
             "plugin": "stackAlerts",
             "path": "x-pack/plugins/stack_alerts/public/alert_types/geo_containment/query_builder/util_components/single_field_select.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.test.ts"
-          },
           {
             "plugin": "infra",
             "path": "x-pack/plugins/infra/target/types/public/alerting/common/group_by_expression/group_by_expression.d.ts"
@@ -53032,142 +51655,6 @@
             "plugin": "timelines",
             "path": "x-pack/plugins/timelines/public/container/source/index.tsx"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/with_kuery_autocompletion.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/with_kuery_autocompletion.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/kuery_bar.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/kuery_bar.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service_analytics.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service_analytics.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_recognizer/data_recognizer.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_recognizer/data_recognizer.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/inventory_view/components/toolbars/toolbar.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/inventory_view/components/toolbars/toolbar.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/utils/kuery.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/utils/kuery.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_data.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_data.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/alerting/metric_threshold/hooks/use_metrics_explorer_chart_data.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/alerting/metric_threshold/hooks/use_metrics_explorer_chart_data.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/alerting/metric_threshold/components/expression_chart.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/alerting/metric_threshold/components/expression_chart.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/logs/log_filter/log_filter_state.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/logs/log_filter/log_filter_state.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/with_source/with_source.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/with_source/with_source.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/toolbar.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/toolbar.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metric_explorer_state.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metric_explorer_state.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/index.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/index.tsx"
-          },
           {
             "plugin": "monitoring",
             "path": "x-pack/plugins/monitoring/public/alerts/components/param_details_form/use_derived_index_pattern.tsx"
@@ -53412,30 +51899,6 @@
             "plugin": "timelines",
             "path": "x-pack/plugins/timelines/public/mock/index_pattern.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/containers/with_kuery_autocompletion.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/containers/with_kuery_autocompletion.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/containers/with_source/with_source.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/containers/with_source/with_source.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/index_pattern_context.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/index_pattern_context.ts"
-          },
           {
             "plugin": "monitoring",
             "path": "x-pack/plugins/monitoring/target/types/public/components/kuery_bar/with_kuery_autocompletion.d.ts"
@@ -53480,30 +51943,6 @@
             "plugin": "securitySolution",
             "path": "x-pack/plugins/security_solution/target/types/public/network/components/network_top_countries_table/columns.d.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/alerting/metric_threshold/components/expression_chart.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/alerting/metric_threshold/components/expression_chart.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/alerting/metric_threshold/hooks/use_metrics_explorer_chart_data.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/alerting/metric_threshold/hooks/use_metrics_explorer_chart_data.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/pages/metrics/metrics_explorer/index.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/pages/metrics/metrics_explorer/index.d.ts"
-          },
           {
             "plugin": "monitoring",
             "path": "x-pack/plugins/monitoring/target/types/public/alerts/components/param_details_form/use_derived_index_pattern.d.ts"
@@ -53552,34 +51991,6 @@
             "plugin": "securitySolution",
             "path": "x-pack/plugins/security_solution/target/types/public/ueba/pages/details/types.d.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/pages/metrics/metrics_explorer/hooks/use_metric_explorer_state.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/pages/metrics/metrics_explorer/hooks/use_metric_explorer_state.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_data.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_data.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/jobs/new_job/common/index_pattern_context.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/jobs/new_job/common/index_pattern_context.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/jobs/new_job/common/index_pattern_context.d.ts"
-          },
           {
             "plugin": "indexPatternManagement",
             "path": "src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/components/table/table.tsx"
@@ -53612,70 +52023,6 @@
             "plugin": "indexPatternManagement",
             "path": "src/plugins/index_pattern_management/target/types/public/components/edit_index_pattern/index_header/index_header.d.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_query_bar/exploration_query_bar.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_query_bar/exploration_query_bar.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/clone_action_name.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/clone_action_name.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/use_delete_action.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/use_delete_action.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/utils.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/utils.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/editor.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/editor.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_utils.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_utils.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/tabs/custom_urls.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/tabs/custom_urls.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/index.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/index.tsx"
-          },
           {
             "plugin": "securitySolution",
             "path": "x-pack/plugins/security_solution/common/search_strategy/index_fields/index.ts"
@@ -53784,14 +52131,6 @@
             "plugin": "transform",
             "path": "x-pack/plugins/transform/server/routes/api/transforms.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
           {
             "plugin": "securitySolution",
             "path": "x-pack/plugins/security_solution/public/common/mock/index_pattern.ts"
@@ -53799,34 +52138,6 @@
           {
             "plugin": "securitySolution",
             "path": "x-pack/plugins/security_solution/public/common/mock/index_pattern.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/explorer/components/explorer_query_bar/explorer_query_bar.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/explorer/components/explorer_query_bar/explorer_query_bar.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/explorer/components/explorer_query_bar/explorer_query_bar.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.test.ts"
           }
         ],
         "children": [
@@ -53921,9 +52232,9 @@
             "signature": [
               "Record<string, ",
               {
-                "pluginId": "expressions",
+                "pluginId": "fieldFormats",
                 "scope": "common",
-                "docId": "kibExpressionsPluginApi",
+                "docId": "kibFieldFormatsPluginApi",
                 "section": "def-common.SerializedFieldFormat",
                 "text": "SerializedFieldFormat"
               },
@@ -54582,7 +52893,7 @@
             "label": "type",
             "description": [],
             "signature": [
-              "\"boolean\" | \"date\" | \"keyword\" | \"geo_point\" | \"ip\" | \"long\" | \"double\""
+              "\"boolean\" | \"keyword\" | \"date\" | \"geo_point\" | \"ip\" | \"long\" | \"double\""
             ],
             "path": "src/plugins/data_views/common/types.ts",
             "deprecated": false
@@ -55524,23 +53835,23 @@
         "label": "DataViewsContract",
         "description": [],
         "signature": [
-          "{ get: (id: string) => Promise<",
+          "{ create: (spec: ",
           {
             "pluginId": "dataViews",
             "scope": "common",
             "docId": "kibDataViewsPluginApi",
-            "section": "def-common.DataView",
-            "text": "DataView"
+            "section": "def-common.DataViewSpec",
+            "text": "DataViewSpec"
           },
-          ">; delete: (indexPatternId: string) => Promise<{}>; create: (spec: ",
+          ", skipFetchFields?: boolean) => Promise<",
           {
             "pluginId": "dataViews",
             "scope": "common",
             "docId": "kibDataViewsPluginApi",
-            "section": "def-common.DataViewSpec",
-            "text": "DataViewSpec"
+            "section": "def-common.DataView",
+            "text": "DataView"
           },
-          ", skipFetchFields?: boolean) => Promise<",
+          ">; delete: (indexPatternId: string) => Promise<{}>; find: (search: string, size?: number) => Promise<",
           {
             "pluginId": "dataViews",
             "scope": "common",
@@ -55548,7 +53859,7 @@
             "section": "def-common.DataView",
             "text": "DataView"
           },
-          ">; find: (search: string, size?: number) => Promise<",
+          "[]>; get: (id: string) => Promise<",
           {
             "pluginId": "dataViews",
             "scope": "common",
@@ -55556,7 +53867,7 @@
             "section": "def-common.DataView",
             "text": "DataView"
           },
-          "[]>; ensureDefaultDataView: ",
+          ">; ensureDefaultDataView: ",
           "EnsureDefaultDataView",
           "; getIds: (refresh?: boolean) => Promise<string[]>; getTitles: (refresh?: boolean) => Promise<string[]>; getIdsWithTitle: (refresh?: boolean) => Promise<",
           {
@@ -55706,7 +54017,15 @@
             "section": "def-common.DataView",
             "text": "DataView"
           },
-          ", saveAttempts?: number, ignoreErrors?: boolean) => Promise<void | Error>; }"
+          ", saveAttempts?: number, ignoreErrors?: boolean) => Promise<void | Error>; getDefaultDataView: () => Promise<",
+          {
+            "pluginId": "dataViews",
+            "scope": "common",
+            "docId": "kibDataViewsPluginApi",
+            "section": "def-common.DataView",
+            "text": "DataView"
+          },
+          " | undefined>; }"
         ],
         "path": "src/plugins/data_views/common/data_views/data_views.ts",
         "deprecated": false,
@@ -55820,13 +54139,21 @@
         "signature": [
           "{ [x: string]: ",
           {
-            "pluginId": "expressions",
+            "pluginId": "fieldFormats",
             "scope": "common",
-            "docId": "kibExpressionsPluginApi",
+            "docId": "kibFieldFormatsPluginApi",
             "section": "def-common.SerializedFieldFormat",
             "text": "SerializedFieldFormat"
           },
-          "<Record<string, any>>; }"
+          "<",
+          {
+            "pluginId": "fieldFormats",
+            "scope": "common",
+            "docId": "kibFieldFormatsPluginApi",
+            "section": "def-common.FieldFormatParams",
+            "text": "FieldFormatParams"
+          },
+          ">; }"
         ],
         "path": "src/plugins/data_views/common/types.ts",
         "deprecated": false,
@@ -57434,6 +55761,10 @@
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
+          },
           {
             "plugin": "securitySolution",
             "path": "x-pack/plugins/security_solution/server/lib/detection_engine/types.ts"
@@ -58021,14 +56352,6 @@
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/components/sidebar/discover_index_pattern.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
           {
             "plugin": "transform",
             "path": "x-pack/plugins/transform/public/app/hooks/use_search_items/common.ts"
@@ -58057,34 +56380,6 @@
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/main/components/sidebar/discover_index_pattern.d.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts"
-          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/components/sidebar/discover_sidebar_responsive.tsx"
@@ -58120,22 +56415,6 @@
           {
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/discover_main_route.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/common/types/kibana.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/common/types/kibana.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/common/types/kibana.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/common/types/kibana.d.ts"
           }
         ],
         "initialIsOpen": false
@@ -58289,23 +56568,23 @@
         "label": "IndexPatternsContract",
         "description": [],
         "signature": [
-          "{ get: (id: string) => Promise<",
+          "{ create: (spec: ",
           {
             "pluginId": "dataViews",
             "scope": "common",
             "docId": "kibDataViewsPluginApi",
-            "section": "def-common.DataView",
-            "text": "DataView"
+            "section": "def-common.DataViewSpec",
+            "text": "DataViewSpec"
           },
-          ">; delete: (indexPatternId: string) => Promise<{}>; create: (spec: ",
+          ", skipFetchFields?: boolean) => Promise<",
           {
             "pluginId": "dataViews",
             "scope": "common",
             "docId": "kibDataViewsPluginApi",
-            "section": "def-common.DataViewSpec",
-            "text": "DataViewSpec"
+            "section": "def-common.DataView",
+            "text": "DataView"
           },
-          ", skipFetchFields?: boolean) => Promise<",
+          ">; delete: (indexPatternId: string) => Promise<{}>; find: (search: string, size?: number) => Promise<",
           {
             "pluginId": "dataViews",
             "scope": "common",
@@ -58313,7 +56592,7 @@
             "section": "def-common.DataView",
             "text": "DataView"
           },
-          ">; find: (search: string, size?: number) => Promise<",
+          "[]>; get: (id: string) => Promise<",
           {
             "pluginId": "dataViews",
             "scope": "common",
@@ -58321,7 +56600,7 @@
             "section": "def-common.DataView",
             "text": "DataView"
           },
-          "[]>; ensureDefaultDataView: ",
+          ">; ensureDefaultDataView: ",
           "EnsureDefaultDataView",
           "; getIds: (refresh?: boolean) => Promise<string[]>; getTitles: (refresh?: boolean) => Promise<string[]>; getIdsWithTitle: (refresh?: boolean) => Promise<",
           {
@@ -58471,7 +56750,15 @@
             "section": "def-common.DataView",
             "text": "DataView"
           },
-          ", saveAttempts?: number, ignoreErrors?: boolean) => Promise<void | Error>; }"
+          ", saveAttempts?: number, ignoreErrors?: boolean) => Promise<void | Error>; getDefaultDataView: () => Promise<",
+          {
+            "pluginId": "dataViews",
+            "scope": "common",
+            "docId": "kibDataViewsPluginApi",
+            "section": "def-common.DataView",
+            "text": "DataView"
+          },
+          " | undefined>; }"
         ],
         "path": "src/plugins/data_views/common/data_views/data_views.ts",
         "deprecated": true,
@@ -58504,50 +56791,6 @@
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/utils/resolve_index_pattern.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/logs/log_source/log_source.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/logs/log_source/log_source.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
           {
             "plugin": "observability",
             "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/rtl_helpers.tsx"
@@ -58636,22 +56879,6 @@
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/doc/components/doc.tsx"
           },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/anchor.ts"
-          },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/anchor.ts"
-          },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/context.ts"
-          },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/context.ts"
-          },
           {
             "plugin": "visualizations",
             "path": "src/plugins/visualizations/public/saved_visualizations/_saved_vis.ts"
@@ -58724,66 +56951,6 @@
             "plugin": "maps",
             "path": "x-pack/plugins/maps/public/lazy_load_bundle/index.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/dependency_cache.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/dependency_cache.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/routing/resolvers.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/routing/resolvers.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/routing/router.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/routing/router.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts"
-          },
           {
             "plugin": "graph",
             "path": "x-pack/plugins/graph/public/application.ts"
@@ -58848,30 +57015,6 @@
             "plugin": "maps",
             "path": "x-pack/plugins/maps/target/types/public/lazy_load_bundle/index.d.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_patterns.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_patterns.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/routing/router.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/routing/router.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/util/dependency_cache.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/util/dependency_cache.d.ts"
-          },
           {
             "plugin": "security",
             "path": "x-pack/plugins/security/target/types/public/management/roles/edit_role/edit_role_page.d.ts"
@@ -59008,14 +57151,6 @@
             "plugin": "indexPatternManagement",
             "path": "src/plugins/index_pattern_management/target/types/public/components/utils.d.ts"
           },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/_stubs.ts"
-          },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/_stubs.ts"
-          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/doc/components/doc.d.ts"
@@ -59023,14 +57158,6 @@
           {
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/doc/components/doc.d.ts"
-          },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
-          },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
           }
         ],
         "initialIsOpen": false
@@ -59702,7 +57829,7 @@
         "label": "RuntimeType",
         "description": [],
         "signature": [
-          "\"boolean\" | \"date\" | \"keyword\" | \"geo_point\" | \"ip\" | \"long\" | \"double\""
+          "\"boolean\" | \"keyword\" | \"date\" | \"geo_point\" | \"ip\" | \"long\" | \"double\""
         ],
         "path": "src/plugins/data_views/common/types.ts",
         "deprecated": false,
diff --git a/api_docs/data.mdx b/api_docs/data.mdx
index 0734f19d6c3ebd..597810c06e8f43 100644
--- a/api_docs/data.mdx
+++ b/api_docs/data.mdx
@@ -18,7 +18,7 @@ Contact [App Services](https://github.com/orgs/elastic/teams/kibana-app-services
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 3192 | 43 | 2807 | 48 |
+| 3193 | 43 | 2807 | 48 |
 
 ## Client
 
diff --git a/api_docs/data_autocomplete.mdx b/api_docs/data_autocomplete.mdx
index 1eef9ef1c6932a..022bb799670dae 100644
--- a/api_docs/data_autocomplete.mdx
+++ b/api_docs/data_autocomplete.mdx
@@ -18,7 +18,7 @@ Contact [App Services](https://github.com/orgs/elastic/teams/kibana-app-services
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 3192 | 43 | 2807 | 48 |
+| 3193 | 43 | 2807 | 48 |
 
 ## Client
 
diff --git a/api_docs/data_query.json b/api_docs/data_query.json
index e711d7c5bbb761..858e25ebb2b09f 100644
--- a/api_docs/data_query.json
+++ b/api_docs/data_query.json
@@ -1167,7 +1167,7 @@
             "section": "def-public.SavedObjectsClient",
             "text": "SavedObjectsClient"
           },
-          ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"bulkUpdate\">) => ",
+          ", \"create\" | \"bulkCreate\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"bulkUpdate\">) => ",
           {
             "pluginId": "data",
             "scope": "public",
@@ -1195,7 +1195,7 @@
                 "section": "def-public.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"bulkUpdate\">"
+              ", \"create\" | \"bulkCreate\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"bulkUpdate\">"
             ],
             "path": "src/plugins/data/public/query/saved_query/saved_query_service.ts",
             "deprecated": false,
diff --git a/api_docs/data_query.mdx b/api_docs/data_query.mdx
index bb88e5868b6052..e83e8043e970d3 100644
--- a/api_docs/data_query.mdx
+++ b/api_docs/data_query.mdx
@@ -18,7 +18,7 @@ Contact [App Services](https://github.com/orgs/elastic/teams/kibana-app-services
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 3192 | 43 | 2807 | 48 |
+| 3193 | 43 | 2807 | 48 |
 
 ## Client
 
diff --git a/api_docs/data_search.json b/api_docs/data_search.json
index 25ed62f473bd39..01cfaaa5d781b7 100644
--- a/api_docs/data_search.json
+++ b/api_docs/data_search.json
@@ -217,11 +217,9 @@
               "\nSearch sessions SO CRUD\n{@link ISessionsClient}"
             ],
             "signature": [
-              "{ get: (sessionId: string) => Promise<",
+              "{ create: ({ name, appId, urlGeneratorId, initialState, restoreState, sessionId, }: { name: string; appId: string; initialState: Record<string, unknown>; restoreState: Record<string, unknown>; urlGeneratorId: string; sessionId: string; }) => Promise<",
               "SearchSessionSavedObject",
-              ">; delete: (sessionId: string) => Promise<void>; create: ({ name, appId, urlGeneratorId, initialState, restoreState, sessionId, }: { name: string; appId: string; initialState: Record<string, unknown>; restoreState: Record<string, unknown>; urlGeneratorId: string; sessionId: string; }) => Promise<",
-              "SearchSessionSavedObject",
-              ">; find: (options: Pick<",
+              ">; delete: (sessionId: string) => Promise<void>; find: (options: Pick<",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -237,7 +235,9 @@
                 "section": "def-server.SavedObjectsFindResponse",
                 "text": "SavedObjectsFindResponse"
               },
-              "<unknown, unknown>>; update: (sessionId: string, attributes: unknown) => Promise<",
+              "<unknown, unknown>>; get: (sessionId: string) => Promise<",
+              "SearchSessionSavedObject",
+              ">; update: (sessionId: string, attributes: unknown) => Promise<",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -379,7 +379,7 @@
                 "section": "def-server.SerializableRecord",
                 "text": "SerializableRecord"
               },
-              " | undefined; schema?: string | undefined; }, \"enabled\" | \"id\" | \"schema\" | \"params\"> & Pick<{ type: string | ",
+              " | undefined; schema?: string | undefined; }, \"id\" | \"enabled\" | \"schema\" | \"params\"> & Pick<{ type: string | ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -395,7 +395,7 @@
                 "section": "def-common.IAggType",
                 "text": "IAggType"
               },
-              "; }, never>, \"type\" | \"enabled\" | \"id\" | \"schema\" | \"params\">[] | undefined) => ",
+              "; }, never>, \"type\" | \"id\" | \"enabled\" | \"schema\" | \"params\">[] | undefined) => ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -617,11 +617,9 @@
               "\nSearch sessions SO CRUD\n{@link ISessionsClient}"
             ],
             "signature": [
-              "{ get: (sessionId: string) => Promise<",
+              "{ create: ({ name, appId, urlGeneratorId, initialState, restoreState, sessionId, }: { name: string; appId: string; initialState: Record<string, unknown>; restoreState: Record<string, unknown>; urlGeneratorId: string; sessionId: string; }) => Promise<",
               "SearchSessionSavedObject",
-              ">; delete: (sessionId: string) => Promise<void>; create: ({ name, appId, urlGeneratorId, initialState, restoreState, sessionId, }: { name: string; appId: string; initialState: Record<string, unknown>; restoreState: Record<string, unknown>; urlGeneratorId: string; sessionId: string; }) => Promise<",
-              "SearchSessionSavedObject",
-              ">; find: (options: Pick<",
+              ">; delete: (sessionId: string) => Promise<void>; find: (options: Pick<",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -637,7 +635,9 @@
                 "section": "def-server.SavedObjectsFindResponse",
                 "text": "SavedObjectsFindResponse"
               },
-              "<unknown, unknown>>; update: (sessionId: string, attributes: unknown) => Promise<",
+              "<unknown, unknown>>; get: (sessionId: string) => Promise<",
+              "SearchSessionSavedObject",
+              ">; update: (sessionId: string, attributes: unknown) => Promise<",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -957,11 +957,9 @@
         "label": "ISessionsClient",
         "description": [],
         "signature": [
-          "{ get: (sessionId: string) => Promise<",
+          "{ create: ({ name, appId, urlGeneratorId, initialState, restoreState, sessionId, }: { name: string; appId: string; initialState: Record<string, unknown>; restoreState: Record<string, unknown>; urlGeneratorId: string; sessionId: string; }) => Promise<",
           "SearchSessionSavedObject",
-          ">; delete: (sessionId: string) => Promise<void>; create: ({ name, appId, urlGeneratorId, initialState, restoreState, sessionId, }: { name: string; appId: string; initialState: Record<string, unknown>; restoreState: Record<string, unknown>; urlGeneratorId: string; sessionId: string; }) => Promise<",
-          "SearchSessionSavedObject",
-          ">; find: (options: Pick<",
+          ">; delete: (sessionId: string) => Promise<void>; find: (options: Pick<",
           {
             "pluginId": "core",
             "scope": "server",
@@ -977,7 +975,9 @@
             "section": "def-server.SavedObjectsFindResponse",
             "text": "SavedObjectsFindResponse"
           },
-          "<unknown, unknown>>; update: (sessionId: string, attributes: unknown) => Promise<",
+          "<unknown, unknown>>; get: (sessionId: string) => Promise<",
+          "SearchSessionSavedObject",
+          ">; update: (sessionId: string, attributes: unknown) => Promise<",
           {
             "pluginId": "core",
             "scope": "server",
@@ -1921,25 +1921,7 @@
             "label": "savedObjectsClient",
             "description": [],
             "signature": [
-              "{ get: <T = unknown>(type: string, id: string, options?: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsBaseOptions",
-                "text": "SavedObjectsBaseOptions"
-              },
-              ") => Promise<",
-              "SavedObject",
-              "<T>>; delete: (type: string, id: string, options?: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsDeleteOptions",
-                "text": "SavedObjectsDeleteOptions"
-              },
-              ") => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: ",
+              "{ create: <T = unknown>(type: string, attributes: T, options?: ",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -1997,7 +1979,15 @@
                 "section": "def-server.SavedObjectsCheckConflictsResponse",
                 "text": "SavedObjectsCheckConflictsResponse"
               },
-              ">; find: <T = unknown, A = unknown>(options: ",
+              ">; delete: (type: string, id: string, options?: ",
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCoreSavedObjectsPluginApi",
+                "section": "def-server.SavedObjectsDeleteOptions",
+                "text": "SavedObjectsDeleteOptions"
+              },
+              ") => Promise<{}>; find: <T = unknown, A = unknown>(options: ",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -2061,6 +2051,16 @@
                 "section": "def-server.SavedObjectsBulkResolveResponse",
                 "text": "SavedObjectsBulkResolveResponse"
               },
+              "<T>>; get: <T = unknown>(type: string, id: string, options?: ",
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCoreSavedObjectsPluginApi",
+                "section": "def-server.SavedObjectsBaseOptions",
+                "text": "SavedObjectsBaseOptions"
+              },
+              ") => Promise<",
+              "SavedObject",
               "<T>>; resolve: <T = unknown>(type: string, id: string, options?: ",
               {
                 "pluginId": "core",
@@ -2593,7 +2593,7 @@
                     "section": "def-server.SerializableRecord",
                     "text": "SerializableRecord"
                   },
-                  " | undefined; schema?: string | undefined; }, \"enabled\" | \"id\" | \"schema\" | \"params\"> & Pick<{ type: ",
+                  " | undefined; schema?: string | undefined; }, \"id\" | \"enabled\" | \"schema\" | \"params\"> & Pick<{ type: ",
                   {
                     "pluginId": "data",
                     "scope": "common",
@@ -2609,7 +2609,7 @@
                     "section": "def-common.IAggType",
                     "text": "IAggType"
                   },
-                  "; }, never>, \"type\" | \"enabled\" | \"id\" | \"schema\" | \"params\">"
+                  "; }, never>, \"type\" | \"id\" | \"enabled\" | \"schema\" | \"params\">"
                 ],
                 "path": "src/plugins/data/common/search/aggs/agg_config.ts",
                 "deprecated": false,
@@ -3660,7 +3660,7 @@
                     "section": "def-server.SerializableRecord",
                     "text": "SerializableRecord"
                   },
-                  " | undefined; schema?: string | undefined; }, \"enabled\" | \"id\" | \"schema\" | \"params\"> & Pick<{ type: string | ",
+                  " | undefined; schema?: string | undefined; }, \"id\" | \"enabled\" | \"schema\" | \"params\"> & Pick<{ type: string | ",
                   {
                     "pluginId": "data",
                     "scope": "common",
@@ -3676,7 +3676,7 @@
                     "section": "def-common.IAggType",
                     "text": "IAggType"
                   },
-                  "; }, never>, \"type\" | \"enabled\" | \"id\" | \"schema\" | \"params\">[]"
+                  "; }, never>, \"type\" | \"id\" | \"enabled\" | \"schema\" | \"params\">[]"
                 ],
                 "path": "src/plugins/data/common/search/aggs/agg_configs.ts",
                 "deprecated": false,
@@ -3905,7 +3905,7 @@
                 "section": "def-server.SerializableRecord",
                 "text": "SerializableRecord"
               },
-              " | undefined; schema?: string | undefined; }, \"enabled\" | \"id\" | \"schema\" | \"params\"> & Pick<{ type: string | ",
+              " | undefined; schema?: string | undefined; }, \"id\" | \"enabled\" | \"schema\" | \"params\"> & Pick<{ type: string | ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -3921,7 +3921,7 @@
                 "section": "def-common.IAggType",
                 "text": "IAggType"
               },
-              "; }, never>, \"type\" | \"enabled\" | \"id\" | \"schema\" | \"params\">, { addToAggConfigs }?: { addToAggConfigs?: boolean | undefined; }) => T"
+              "; }, never>, \"type\" | \"id\" | \"enabled\" | \"schema\" | \"params\">, { addToAggConfigs }?: { addToAggConfigs?: boolean | undefined; }) => T"
             ],
             "path": "src/plugins/data/common/search/aggs/agg_configs.ts",
             "deprecated": false,
@@ -3942,7 +3942,7 @@
                     "section": "def-server.SerializableRecord",
                     "text": "SerializableRecord"
                   },
-                  " | undefined; schema?: string | undefined; }, \"enabled\" | \"id\" | \"schema\" | \"params\"> & Pick<{ type: string | ",
+                  " | undefined; schema?: string | undefined; }, \"id\" | \"enabled\" | \"schema\" | \"params\"> & Pick<{ type: string | ",
                   {
                     "pluginId": "data",
                     "scope": "common",
@@ -3958,7 +3958,7 @@
                     "section": "def-common.IAggType",
                     "text": "IAggType"
                   },
-                  "; }, never>, \"type\" | \"enabled\" | \"id\" | \"schema\" | \"params\">"
+                  "; }, never>, \"type\" | \"id\" | \"enabled\" | \"schema\" | \"params\">"
                 ],
                 "path": "src/plugins/data/common/search/aggs/agg_configs.ts",
                 "deprecated": false,
@@ -4967,7 +4967,7 @@
               "\nThe type the values produced by this agg will have in the final data table.\nIf not specified, the type of the field is used."
             ],
             "signature": [
-              "\"string\" | \"number\" | \"boolean\" | \"object\" | \"date\" | \"_source\" | \"attachment\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"murmur3\" | \"unknown\" | \"conflict\" | \"nested\" | \"histogram\" | \"null\" | undefined"
+              "\"string\" | \"number\" | \"boolean\" | \"object\" | \"_source\" | \"attachment\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"murmur3\" | \"unknown\" | \"conflict\" | \"nested\" | \"histogram\" | \"null\" | undefined"
             ],
             "path": "src/plugins/data/common/search/aggs/agg_type.ts",
             "deprecated": false
@@ -5289,7 +5289,7 @@
                     "section": "def-common.SearchSource",
                     "text": "SearchSource"
                   },
-                  "; history: Record<string, any>[]; setPreferredSearchStrategyId: (searchStrategyId: string) => void; setField: <K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, value: ",
+                  "; history: Record<string, any>[]; setPreferredSearchStrategyId: (searchStrategyId: string) => void; setField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, value: ",
                   {
                     "pluginId": "data",
                     "scope": "common",
@@ -5305,7 +5305,7 @@
                     "section": "def-common.SearchSource",
                     "text": "SearchSource"
                   },
-                  "; removeField: <K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
+                  "; removeField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
                   {
                     "pluginId": "data",
                     "scope": "common",
@@ -5337,7 +5337,7 @@
                     "section": "def-common.SearchSourceFields",
                     "text": "SearchSourceFields"
                   },
-                  "; getField: <K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, recurse?: boolean) => ",
+                  "; getField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, recurse?: boolean) => ",
                   {
                     "pluginId": "data",
                     "scope": "common",
@@ -5345,7 +5345,7 @@
                     "section": "def-common.SearchSourceFields",
                     "text": "SearchSourceFields"
                   },
-                  "[K]; getOwnField: <K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
+                  "[K]; getOwnField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
                   {
                     "pluginId": "data",
                     "scope": "common",
@@ -5528,13 +5528,21 @@
             "signature": [
               "(agg: TAggConfig) => ",
               {
-                "pluginId": "expressions",
+                "pluginId": "fieldFormats",
                 "scope": "common",
-                "docId": "kibExpressionsPluginApi",
+                "docId": "kibFieldFormatsPluginApi",
                 "section": "def-common.SerializedFieldFormat",
                 "text": "SerializedFieldFormat"
               },
-              "<Record<string, any>>"
+              "<",
+              {
+                "pluginId": "fieldFormats",
+                "scope": "common",
+                "docId": "kibFieldFormatsPluginApi",
+                "section": "def-common.FieldFormatParams",
+                "text": "FieldFormatParams"
+              },
+              ">"
             ],
             "path": "src/plugins/data/common/search/aggs/agg_type.ts",
             "deprecated": false,
@@ -7556,7 +7564,7 @@
               "\nsets value to a single search source field"
             ],
             "signature": [
-              "<K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, value: ",
+              "<K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, value: ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -7621,7 +7629,7 @@
               "\nremove field"
             ],
             "signature": [
-              "<K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => this"
+              "<K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => this"
             ],
             "path": "src/plugins/data/common/search/search_source/search_source.ts",
             "deprecated": false,
@@ -7746,7 +7754,7 @@
               "\nGets a single field from the fields"
             ],
             "signature": [
-              "<K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, recurse?: boolean) => ",
+              "<K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, recurse?: boolean) => ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -7800,7 +7808,7 @@
               "\nGet the field from our own fields, don't traverse up the chain"
             ],
             "signature": [
-              "<K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
+              "<K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -8381,7 +8389,7 @@
                 "section": "def-common.DataViewsService",
                 "text": "DataViewsService"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"find\" | \"ensureDefaultDataView\" | \"getIds\" | \"getTitles\" | \"getIdsWithTitle\" | \"clearCache\" | \"getCache\" | \"getDefault\" | \"getDefaultId\" | \"setDefault\" | \"hasUserDataView\" | \"getFieldsForWildcard\" | \"getFieldsForIndexPattern\" | \"refreshFields\" | \"fieldArrayToMap\" | \"savedObjectToSpec\" | \"createAndSave\" | \"createSavedObject\" | \"updateSavedObject\">, dependencies: ",
+              ", \"create\" | \"delete\" | \"find\" | \"get\" | \"ensureDefaultDataView\" | \"getIds\" | \"getTitles\" | \"getIdsWithTitle\" | \"clearCache\" | \"getCache\" | \"getDefault\" | \"getDefaultId\" | \"setDefault\" | \"hasUserDataView\" | \"getFieldsForWildcard\" | \"getFieldsForIndexPattern\" | \"refreshFields\" | \"fieldArrayToMap\" | \"savedObjectToSpec\" | \"createAndSave\" | \"createSavedObject\" | \"updateSavedObject\" | \"getDefaultDataView\">, dependencies: ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -8434,7 +8442,7 @@
                     "section": "def-common.DataViewsService",
                     "text": "DataViewsService"
                   },
-                  ", \"get\" | \"delete\" | \"create\" | \"find\" | \"ensureDefaultDataView\" | \"getIds\" | \"getTitles\" | \"getIdsWithTitle\" | \"clearCache\" | \"getCache\" | \"getDefault\" | \"getDefaultId\" | \"setDefault\" | \"hasUserDataView\" | \"getFieldsForWildcard\" | \"getFieldsForIndexPattern\" | \"refreshFields\" | \"fieldArrayToMap\" | \"savedObjectToSpec\" | \"createAndSave\" | \"createSavedObject\" | \"updateSavedObject\">"
+                  ", \"create\" | \"delete\" | \"find\" | \"get\" | \"ensureDefaultDataView\" | \"getIds\" | \"getTitles\" | \"getIdsWithTitle\" | \"clearCache\" | \"getCache\" | \"getDefault\" | \"getDefaultId\" | \"setDefault\" | \"hasUserDataView\" | \"getFieldsForWildcard\" | \"getFieldsForIndexPattern\" | \"refreshFields\" | \"fieldArrayToMap\" | \"savedObjectToSpec\" | \"createAndSave\" | \"createSavedObject\" | \"updateSavedObject\" | \"getDefaultDataView\">"
                 ],
                 "path": "src/plugins/data/common/search/search_source/search_source_service.ts",
                 "deprecated": false,
@@ -9388,7 +9396,7 @@
             "section": "def-common.DataViewsService",
             "text": "DataViewsService"
           },
-          ", \"get\" | \"delete\" | \"create\" | \"find\" | \"ensureDefaultDataView\" | \"getIds\" | \"getTitles\" | \"getIdsWithTitle\" | \"clearCache\" | \"getCache\" | \"getDefault\" | \"getDefaultId\" | \"setDefault\" | \"hasUserDataView\" | \"getFieldsForWildcard\" | \"getFieldsForIndexPattern\" | \"refreshFields\" | \"fieldArrayToMap\" | \"savedObjectToSpec\" | \"createAndSave\" | \"createSavedObject\" | \"updateSavedObject\">, searchSourceDependencies: ",
+          ", \"create\" | \"delete\" | \"find\" | \"get\" | \"ensureDefaultDataView\" | \"getIds\" | \"getTitles\" | \"getIdsWithTitle\" | \"clearCache\" | \"getCache\" | \"getDefault\" | \"getDefaultId\" | \"setDefault\" | \"hasUserDataView\" | \"getFieldsForWildcard\" | \"getFieldsForIndexPattern\" | \"refreshFields\" | \"fieldArrayToMap\" | \"savedObjectToSpec\" | \"createAndSave\" | \"createSavedObject\" | \"updateSavedObject\" | \"getDefaultDataView\">, searchSourceDependencies: ",
           {
             "pluginId": "data",
             "scope": "common",
@@ -9435,7 +9443,7 @@
                 "section": "def-common.DataViewsService",
                 "text": "DataViewsService"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"find\" | \"ensureDefaultDataView\" | \"getIds\" | \"getTitles\" | \"getIdsWithTitle\" | \"clearCache\" | \"getCache\" | \"getDefault\" | \"getDefaultId\" | \"setDefault\" | \"hasUserDataView\" | \"getFieldsForWildcard\" | \"getFieldsForIndexPattern\" | \"refreshFields\" | \"fieldArrayToMap\" | \"savedObjectToSpec\" | \"createAndSave\" | \"createSavedObject\" | \"updateSavedObject\">"
+              ", \"create\" | \"delete\" | \"find\" | \"get\" | \"ensureDefaultDataView\" | \"getIds\" | \"getTitles\" | \"getIdsWithTitle\" | \"clearCache\" | \"getCache\" | \"getDefault\" | \"getDefaultId\" | \"setDefault\" | \"hasUserDataView\" | \"getFieldsForWildcard\" | \"getFieldsForIndexPattern\" | \"refreshFields\" | \"fieldArrayToMap\" | \"savedObjectToSpec\" | \"createAndSave\" | \"createSavedObject\" | \"updateSavedObject\" | \"getDefaultDataView\">"
             ],
             "path": "src/plugins/data/common/search/search_source/create_search_source.ts",
             "deprecated": false,
@@ -13382,7 +13390,7 @@
                 "section": "def-common.BUCKET_TYPES",
                 "text": "BUCKET_TYPES"
               },
-              ".FILTER>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ geo_bounding_box?: ({ type: \"geo_bounding_box\"; } & GeoBox) | ({ type: \"geo_bounding_box\"; } & { top_left: ",
+              ".FILTER>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ geo_bounding_box?: ({ type: \"geo_bounding_box\"; } & GeoBox) | ({ type: \"geo_bounding_box\"; } & { top_left: ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -13478,7 +13486,7 @@
                 "section": "def-common.Query",
                 "text": "Query"
               },
-              "> | undefined; }, never>, \"enabled\" | \"id\" | \"filter\" | \"schema\" | \"geo_bounding_box\" | \"json\" | \"customLabel\" | \"timeShift\">, ",
+              "> | undefined; }, never>, \"id\" | \"filter\" | \"enabled\" | \"schema\" | \"geo_bounding_box\" | \"json\" | \"customLabel\" | \"timeShift\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -13534,7 +13542,7 @@
                 "section": "def-common.BUCKET_TYPES",
                 "text": "BUCKET_TYPES"
               },
-              ".FILTERS>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"timeShift\"> & Pick<{ filters?: ",
+              ".FILTERS>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"timeShift\"> & Pick<{ filters?: ",
               {
                 "pluginId": "expressions",
                 "scope": "common",
@@ -13566,7 +13574,7 @@
                 "section": "def-common.QueryFilter",
                 "text": "QueryFilter"
               },
-              ">[] | undefined; }, never>, \"enabled\" | \"id\" | \"filters\" | \"schema\" | \"json\" | \"timeShift\">, ",
+              ">[] | undefined; }, never>, \"id\" | \"filters\" | \"enabled\" | \"schema\" | \"json\" | \"timeShift\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -13678,7 +13686,7 @@
                 "section": "def-common.BUCKET_TYPES",
                 "text": "BUCKET_TYPES"
               },
-              ".IP_RANGE>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\"> & Pick<{ ranges?: (",
+              ".IP_RANGE>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\"> & Pick<{ ranges?: (",
               {
                 "pluginId": "expressions",
                 "scope": "common",
@@ -13742,7 +13750,7 @@
                 "section": "def-common.IpRange",
                 "text": "IpRange"
               },
-              ">)[] | undefined; ipRangeType?: string | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"ipRangeType\" | \"ranges\">, ",
+              ">)[] | undefined; ipRangeType?: string | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"ipRangeType\" | \"ranges\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -13798,7 +13806,7 @@
                 "section": "def-common.BUCKET_TYPES",
                 "text": "BUCKET_TYPES"
               },
-              ".DATE_RANGE>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"time_zone\"> & Pick<{ ranges?: ",
+              ".DATE_RANGE>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"time_zone\"> & Pick<{ ranges?: ",
               {
                 "pluginId": "expressions",
                 "scope": "common",
@@ -13830,7 +13838,7 @@
                 "section": "def-common.DateRange",
                 "text": "DateRange"
               },
-              ">[] | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"ranges\" | \"time_zone\">, ",
+              ">[] | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"ranges\" | \"time_zone\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -13886,7 +13894,7 @@
                 "section": "def-common.BUCKET_TYPES",
                 "text": "BUCKET_TYPES"
               },
-              ".RANGE>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\"> & Pick<{ ranges?: ",
+              ".RANGE>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\"> & Pick<{ ranges?: ",
               {
                 "pluginId": "expressions",
                 "scope": "common",
@@ -13918,7 +13926,7 @@
                 "section": "def-common.NumericalRange",
                 "text": "NumericalRange"
               },
-              ">[] | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"ranges\">, ",
+              ">[] | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"ranges\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -14030,7 +14038,7 @@
                 "section": "def-common.BUCKET_TYPES",
                 "text": "BUCKET_TYPES"
               },
-              ".GEOHASH_GRID>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"autoPrecision\" | \"precision\" | \"useGeocentroid\" | \"isFilteredByCollar\"> & Pick<{ boundingBox?: ({ type: \"geo_bounding_box\"; } & GeoBox) | ({ type: \"geo_bounding_box\"; } & { top_left: ",
+              ".GEOHASH_GRID>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"autoPrecision\" | \"precision\" | \"useGeocentroid\" | \"isFilteredByCollar\"> & Pick<{ boundingBox?: ({ type: \"geo_bounding_box\"; } & GeoBox) | ({ type: \"geo_bounding_box\"; } & { top_left: ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -14094,7 +14102,7 @@
                 "section": "def-common.GeoPoint",
                 "text": "GeoPoint"
               },
-              "; }) | ({ type: \"geo_bounding_box\"; } & WellKnownText) | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"autoPrecision\" | \"precision\" | \"useGeocentroid\" | \"isFilteredByCollar\" | \"boundingBox\">, ",
+              "; }) | ({ type: \"geo_bounding_box\"; } & WellKnownText) | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"autoPrecision\" | \"precision\" | \"useGeocentroid\" | \"isFilteredByCollar\" | \"boundingBox\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -14150,7 +14158,7 @@
                 "section": "def-common.BUCKET_TYPES",
                 "text": "BUCKET_TYPES"
               },
-              ".HISTOGRAM>, \"enabled\" | \"interval\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"used_interval\" | \"maxBars\" | \"intervalBase\" | \"min_doc_count\" | \"has_extended_bounds\"> & Pick<{ extended_bounds?: ",
+              ".HISTOGRAM>, \"interval\" | \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"used_interval\" | \"maxBars\" | \"intervalBase\" | \"min_doc_count\" | \"has_extended_bounds\"> & Pick<{ extended_bounds?: ",
               {
                 "pluginId": "expressions",
                 "scope": "common",
@@ -14182,7 +14190,7 @@
                 "section": "def-common.ExtendedBounds",
                 "text": "ExtendedBounds"
               },
-              "> | undefined; }, never>, \"enabled\" | \"interval\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"used_interval\" | \"maxBars\" | \"intervalBase\" | \"min_doc_count\" | \"has_extended_bounds\" | \"extended_bounds\">, ",
+              "> | undefined; }, never>, \"interval\" | \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"used_interval\" | \"maxBars\" | \"intervalBase\" | \"min_doc_count\" | \"has_extended_bounds\" | \"extended_bounds\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -14238,7 +14246,7 @@
                 "section": "def-common.BUCKET_TYPES",
                 "text": "BUCKET_TYPES"
               },
-              ".DATE_HISTOGRAM>, \"enabled\" | \"interval\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"time_zone\" | \"used_interval\" | \"min_doc_count\" | \"useNormalizedEsInterval\" | \"scaleMetricValues\" | \"used_time_zone\" | \"drop_partials\" | \"format\"> & Pick<{ timeRange?: ",
+              ".DATE_HISTOGRAM>, \"interval\" | \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"time_zone\" | \"used_interval\" | \"min_doc_count\" | \"useNormalizedEsInterval\" | \"scaleMetricValues\" | \"used_time_zone\" | \"drop_partials\" | \"format\"> & Pick<{ timeRange?: ",
               {
                 "pluginId": "expressions",
                 "scope": "common",
@@ -14302,7 +14310,7 @@
                 "section": "def-common.ExtendedBounds",
                 "text": "ExtendedBounds"
               },
-              "> | undefined; }, never>, \"enabled\" | \"interval\" | \"id\" | \"timeRange\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"time_zone\" | \"used_interval\" | \"min_doc_count\" | \"extended_bounds\" | \"useNormalizedEsInterval\" | \"scaleMetricValues\" | \"used_time_zone\" | \"drop_partials\" | \"format\">, ",
+              "> | undefined; }, never>, \"interval\" | \"id\" | \"timeRange\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"time_zone\" | \"used_interval\" | \"min_doc_count\" | \"extended_bounds\" | \"useNormalizedEsInterval\" | \"scaleMetricValues\" | \"used_time_zone\" | \"drop_partials\" | \"format\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -14358,11 +14366,11 @@
                 "section": "def-common.BUCKET_TYPES",
                 "text": "BUCKET_TYPES"
               },
-              ".TERMS>, \"enabled\" | \"id\" | \"size\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"orderBy\" | \"order\" | \"missingBucket\" | \"missingBucketLabel\" | \"otherBucket\" | \"otherBucketLabel\" | \"exclude\" | \"include\"> & Pick<{ orderAgg?: ",
+              ".TERMS>, \"id\" | \"size\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"orderBy\" | \"order\" | \"missingBucket\" | \"missingBucketLabel\" | \"otherBucket\" | \"otherBucketLabel\" | \"exclude\" | \"include\"> & Pick<{ orderAgg?: ",
               "AggExpressionType",
               " | undefined; }, \"orderAgg\"> & Pick<{ orderAgg?: ",
               "AggExpressionType",
-              " | undefined; }, never>, \"enabled\" | \"id\" | \"size\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"orderBy\" | \"orderAgg\" | \"order\" | \"missingBucket\" | \"missingBucketLabel\" | \"otherBucket\" | \"otherBucketLabel\" | \"exclude\" | \"include\">, ",
+              " | undefined; }, never>, \"id\" | \"size\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"field\" | \"orderBy\" | \"orderAgg\" | \"order\" | \"missingBucket\" | \"missingBucketLabel\" | \"otherBucket\" | \"otherBucketLabel\" | \"exclude\" | \"include\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -14474,7 +14482,7 @@
                 "section": "def-common.METRIC_TYPES",
                 "text": "METRIC_TYPES"
               },
-              ".AVG_BUCKET>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ customBucket?: ",
+              ".AVG_BUCKET>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ customBucket?: ",
               "AggExpressionType",
               " | undefined; customMetric?: ",
               "AggExpressionType",
@@ -14482,7 +14490,7 @@
               "AggExpressionType",
               " | undefined; customMetric?: ",
               "AggExpressionType",
-              " | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"customBucket\">, ",
+              " | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"customBucket\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -14538,7 +14546,7 @@
                 "section": "def-common.METRIC_TYPES",
                 "text": "METRIC_TYPES"
               },
-              ".MAX_BUCKET>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ customBucket?: ",
+              ".MAX_BUCKET>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ customBucket?: ",
               "AggExpressionType",
               " | undefined; customMetric?: ",
               "AggExpressionType",
@@ -14546,7 +14554,7 @@
               "AggExpressionType",
               " | undefined; customMetric?: ",
               "AggExpressionType",
-              " | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"customBucket\">, ",
+              " | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"customBucket\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -14602,7 +14610,7 @@
                 "section": "def-common.METRIC_TYPES",
                 "text": "METRIC_TYPES"
               },
-              ".MIN_BUCKET>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ customBucket?: ",
+              ".MIN_BUCKET>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ customBucket?: ",
               "AggExpressionType",
               " | undefined; customMetric?: ",
               "AggExpressionType",
@@ -14610,7 +14618,7 @@
               "AggExpressionType",
               " | undefined; customMetric?: ",
               "AggExpressionType",
-              " | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"customBucket\">, ",
+              " | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"customBucket\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -14666,7 +14674,7 @@
                 "section": "def-common.METRIC_TYPES",
                 "text": "METRIC_TYPES"
               },
-              ".SUM_BUCKET>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ customBucket?: ",
+              ".SUM_BUCKET>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ customBucket?: ",
               "AggExpressionType",
               " | undefined; customMetric?: ",
               "AggExpressionType",
@@ -14674,7 +14682,7 @@
               "AggExpressionType",
               " | undefined; customMetric?: ",
               "AggExpressionType",
-              " | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"customBucket\">, ",
+              " | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"customBucket\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -14730,7 +14738,7 @@
                 "section": "def-common.METRIC_TYPES",
                 "text": "METRIC_TYPES"
               },
-              ".FILTERED_METRIC>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ customBucket?: ",
+              ".FILTERED_METRIC>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\"> & Pick<{ customBucket?: ",
               "AggExpressionType",
               " | undefined; customMetric?: ",
               "AggExpressionType",
@@ -14738,7 +14746,7 @@
               "AggExpressionType",
               " | undefined; customMetric?: ",
               "AggExpressionType",
-              " | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"customBucket\">, ",
+              " | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"customBucket\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -14906,11 +14914,11 @@
                 "section": "def-common.METRIC_TYPES",
                 "text": "METRIC_TYPES"
               },
-              ".CUMULATIVE_SUM>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"buckets_path\" | \"metricAgg\"> & Pick<{ customMetric?: ",
+              ".CUMULATIVE_SUM>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"buckets_path\" | \"metricAgg\"> & Pick<{ customMetric?: ",
               "AggExpressionType",
               " | undefined; }, \"customMetric\"> & Pick<{ customMetric?: ",
               "AggExpressionType",
-              " | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"buckets_path\" | \"metricAgg\">, ",
+              " | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"buckets_path\" | \"metricAgg\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -14966,11 +14974,11 @@
                 "section": "def-common.METRIC_TYPES",
                 "text": "METRIC_TYPES"
               },
-              ".DERIVATIVE>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"buckets_path\" | \"metricAgg\"> & Pick<{ customMetric?: ",
+              ".DERIVATIVE>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"buckets_path\" | \"metricAgg\"> & Pick<{ customMetric?: ",
               "AggExpressionType",
               " | undefined; }, \"customMetric\"> & Pick<{ customMetric?: ",
               "AggExpressionType",
-              " | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"buckets_path\" | \"metricAgg\">, ",
+              " | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"buckets_path\" | \"metricAgg\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -15362,11 +15370,11 @@
                 "section": "def-common.METRIC_TYPES",
                 "text": "METRIC_TYPES"
               },
-              ".MOVING_FN>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"buckets_path\" | \"metricAgg\" | \"window\" | \"script\"> & Pick<{ customMetric?: ",
+              ".MOVING_FN>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"buckets_path\" | \"metricAgg\" | \"window\" | \"script\"> & Pick<{ customMetric?: ",
               "AggExpressionType",
               " | undefined; }, \"customMetric\"> & Pick<{ customMetric?: ",
               "AggExpressionType",
-              " | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"buckets_path\" | \"metricAgg\" | \"window\" | \"script\">, ",
+              " | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"buckets_path\" | \"metricAgg\" | \"window\" | \"script\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -15534,11 +15542,11 @@
                 "section": "def-common.METRIC_TYPES",
                 "text": "METRIC_TYPES"
               },
-              ".SERIAL_DIFF>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"buckets_path\" | \"metricAgg\"> & Pick<{ customMetric?: ",
+              ".SERIAL_DIFF>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"buckets_path\" | \"metricAgg\"> & Pick<{ customMetric?: ",
               "AggExpressionType",
               " | undefined; }, \"customMetric\"> & Pick<{ customMetric?: ",
               "AggExpressionType",
-              " | undefined; }, never>, \"enabled\" | \"id\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"buckets_path\" | \"metricAgg\">, ",
+              " | undefined; }, never>, \"id\" | \"enabled\" | \"schema\" | \"json\" | \"customLabel\" | \"timeShift\" | \"customMetric\" | \"buckets_path\" | \"metricAgg\">, ",
               "AggExpressionType",
               ", ",
               {
@@ -18302,7 +18310,7 @@
             "label": "valueType",
             "description": [],
             "signature": [
-              "\"string\" | \"number\" | \"boolean\" | \"object\" | \"date\" | \"_source\" | \"attachment\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"murmur3\" | \"unknown\" | \"conflict\" | \"nested\" | \"histogram\" | \"null\" | undefined"
+              "\"string\" | \"number\" | \"boolean\" | \"object\" | \"_source\" | \"attachment\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"murmur3\" | \"unknown\" | \"conflict\" | \"nested\" | \"histogram\" | \"null\" | undefined"
             ],
             "path": "src/plugins/data/common/search/aggs/agg_type.ts",
             "deprecated": false
@@ -18397,13 +18405,21 @@
             "signature": [
               "((agg: TAggConfig) => ",
               {
-                "pluginId": "expressions",
+                "pluginId": "fieldFormats",
                 "scope": "common",
-                "docId": "kibExpressionsPluginApi",
+                "docId": "kibFieldFormatsPluginApi",
                 "section": "def-common.SerializedFieldFormat",
                 "text": "SerializedFieldFormat"
               },
-              "<Record<string, any>>) | undefined"
+              "<",
+              {
+                "pluginId": "fieldFormats",
+                "scope": "common",
+                "docId": "kibFieldFormatsPluginApi",
+                "section": "def-common.FieldFormatParams",
+                "text": "FieldFormatParams"
+              },
+              ">) | undefined"
             ],
             "path": "src/plugins/data/common/search/aggs/agg_type.ts",
             "deprecated": false,
@@ -22456,7 +22472,7 @@
             "section": "def-common.IAggType",
             "text": "IAggType"
           },
-          "; enabled?: boolean | undefined; id?: string | undefined; schema?: string | undefined; params?: {} | ",
+          "; id?: string | undefined; enabled?: boolean | undefined; schema?: string | undefined; params?: {} | ",
           {
             "pluginId": "@kbn/utility-types",
             "scope": "server",
@@ -22945,7 +22961,7 @@
             "section": "def-server.SerializableRecord",
             "text": "SerializableRecord"
           },
-          " | undefined; schema?: string | undefined; }, \"enabled\" | \"id\" | \"schema\" | \"params\"> & Pick<{ type: string | ",
+          " | undefined; schema?: string | undefined; }, \"id\" | \"enabled\" | \"schema\" | \"params\"> & Pick<{ type: string | ",
           {
             "pluginId": "data",
             "scope": "common",
@@ -22961,7 +22977,7 @@
             "section": "def-common.IAggType",
             "text": "IAggType"
           },
-          "; }, never>, \"type\" | \"enabled\" | \"id\" | \"schema\" | \"params\">[] | undefined) => ",
+          "; }, never>, \"type\" | \"id\" | \"enabled\" | \"schema\" | \"params\">[] | undefined) => ",
           {
             "pluginId": "data",
             "scope": "common",
@@ -23132,7 +23148,7 @@
             "section": "def-common.IAggType",
             "text": "IAggType"
           },
-          "; enabled?: boolean | undefined; id?: string | undefined; schema?: string | undefined; params?: {} | ",
+          "; id?: string | undefined; enabled?: boolean | undefined; schema?: string | undefined; params?: {} | ",
           {
             "pluginId": "@kbn/utility-types",
             "scope": "server",
@@ -25452,7 +25468,7 @@
             "section": "def-common.SearchSource",
             "text": "SearchSource"
           },
-          "; history: Record<string, any>[]; setPreferredSearchStrategyId: (searchStrategyId: string) => void; setField: <K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, value: ",
+          "; history: Record<string, any>[]; setPreferredSearchStrategyId: (searchStrategyId: string) => void; setField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, value: ",
           {
             "pluginId": "data",
             "scope": "common",
@@ -25468,7 +25484,7 @@
             "section": "def-common.SearchSource",
             "text": "SearchSource"
           },
-          "; removeField: <K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
+          "; removeField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
           {
             "pluginId": "data",
             "scope": "common",
@@ -25500,7 +25516,7 @@
             "section": "def-common.SearchSourceFields",
             "text": "SearchSourceFields"
           },
-          "; getField: <K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, recurse?: boolean) => ",
+          "; getField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, recurse?: boolean) => ",
           {
             "pluginId": "data",
             "scope": "common",
@@ -25508,7 +25524,7 @@
             "section": "def-common.SearchSourceFields",
             "text": "SearchSourceFields"
           },
-          "[K]; getOwnField: <K extends \"type\" | \"from\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
+          "[K]; getOwnField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
           {
             "pluginId": "data",
             "scope": "common",
diff --git a/api_docs/data_search.mdx b/api_docs/data_search.mdx
index c7256296f1634a..d4d521164f6ce3 100644
--- a/api_docs/data_search.mdx
+++ b/api_docs/data_search.mdx
@@ -18,7 +18,7 @@ Contact [App Services](https://github.com/orgs/elastic/teams/kibana-app-services
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 3192 | 43 | 2807 | 48 |
+| 3193 | 43 | 2807 | 48 |
 
 ## Client
 
diff --git a/api_docs/data_ui.mdx b/api_docs/data_ui.mdx
index 39a1948d15c2c0..81fec9e59c0dab 100644
--- a/api_docs/data_ui.mdx
+++ b/api_docs/data_ui.mdx
@@ -18,7 +18,7 @@ Contact [App Services](https://github.com/orgs/elastic/teams/kibana-app-services
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 3192 | 43 | 2807 | 48 |
+| 3193 | 43 | 2807 | 48 |
 
 ## Client
 
diff --git a/api_docs/data_views.json b/api_docs/data_views.json
index c77aa02425e22f..1d6f430c302c25 100644
--- a/api_docs/data_views.json
+++ b/api_docs/data_views.json
@@ -1357,13 +1357,21 @@
             "signature": [
               "(fieldName: string, format: ",
               {
-                "pluginId": "expressions",
+                "pluginId": "fieldFormats",
                 "scope": "common",
-                "docId": "kibExpressionsPluginApi",
+                "docId": "kibFieldFormatsPluginApi",
                 "section": "def-common.SerializedFieldFormat",
                 "text": "SerializedFieldFormat"
               },
-              "<Record<string, any>>) => void"
+              "<",
+              {
+                "pluginId": "fieldFormats",
+                "scope": "common",
+                "docId": "kibFieldFormatsPluginApi",
+                "section": "def-common.FieldFormatParams",
+                "text": "FieldFormatParams"
+              },
+              ">) => void"
             ],
             "path": "src/plugins/data_views/common/data_views/data_view.ts",
             "deprecated": false,
@@ -1391,13 +1399,21 @@
                 "description": [],
                 "signature": [
                   {
-                    "pluginId": "expressions",
+                    "pluginId": "fieldFormats",
                     "scope": "common",
-                    "docId": "kibExpressionsPluginApi",
+                    "docId": "kibFieldFormatsPluginApi",
                     "section": "def-common.SerializedFieldFormat",
                     "text": "SerializedFieldFormat"
                   },
-                  "<Record<string, any>>"
+                  "<",
+                  {
+                    "pluginId": "fieldFormats",
+                    "scope": "common",
+                    "docId": "kibFieldFormatsPluginApi",
+                    "section": "def-common.FieldFormatParams",
+                    "text": "FieldFormatParams"
+                  },
+                  ">"
                 ],
                 "path": "src/plugins/data_views/common/data_views/data_view.ts",
                 "deprecated": false,
@@ -1647,7 +1663,7 @@
             "section": "def-common.DataViewsService",
             "text": "DataViewsService"
           },
-          ", \"get\" | \"delete\" | \"create\" | \"find\" | \"ensureDefaultDataView\" | \"getIds\" | \"getTitles\" | \"getIdsWithTitle\" | \"clearCache\" | \"getCache\" | \"getDefault\" | \"getDefaultId\" | \"setDefault\" | \"hasUserDataView\" | \"getFieldsForWildcard\" | \"getFieldsForIndexPattern\" | \"refreshFields\" | \"fieldArrayToMap\" | \"savedObjectToSpec\" | \"createAndSave\" | \"createSavedObject\" | \"updateSavedObject\">, ",
+          ", \"create\" | \"delete\" | \"find\" | \"get\" | \"ensureDefaultDataView\" | \"getIds\" | \"getTitles\" | \"getIdsWithTitle\" | \"clearCache\" | \"getCache\" | \"getDefault\" | \"getDefaultId\" | \"setDefault\" | \"hasUserDataView\" | \"getFieldsForWildcard\" | \"getFieldsForIndexPattern\" | \"refreshFields\" | \"fieldArrayToMap\" | \"savedObjectToSpec\" | \"createAndSave\" | \"createSavedObject\" | \"updateSavedObject\" | \"getDefaultDataView\">, ",
           "DataViewsPublicSetupDependencies",
           ", ",
           "DataViewsPublicStartDependencies",
@@ -1682,7 +1698,7 @@
                 "section": "def-common.DataViewsService",
                 "text": "DataViewsService"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"find\" | \"ensureDefaultDataView\" | \"getIds\" | \"getTitles\" | \"getIdsWithTitle\" | \"clearCache\" | \"getCache\" | \"getDefault\" | \"getDefaultId\" | \"setDefault\" | \"hasUserDataView\" | \"getFieldsForWildcard\" | \"getFieldsForIndexPattern\" | \"refreshFields\" | \"fieldArrayToMap\" | \"savedObjectToSpec\" | \"createAndSave\" | \"createSavedObject\" | \"updateSavedObject\">>, { expressions }: ",
+              ", \"create\" | \"delete\" | \"find\" | \"get\" | \"ensureDefaultDataView\" | \"getIds\" | \"getTitles\" | \"getIdsWithTitle\" | \"clearCache\" | \"getCache\" | \"getDefault\" | \"getDefaultId\" | \"setDefault\" | \"hasUserDataView\" | \"getFieldsForWildcard\" | \"getFieldsForIndexPattern\" | \"refreshFields\" | \"fieldArrayToMap\" | \"savedObjectToSpec\" | \"createAndSave\" | \"createSavedObject\" | \"updateSavedObject\" | \"getDefaultDataView\">>, { expressions }: ",
               "DataViewsPublicSetupDependencies",
               ") => ",
               {
@@ -1721,7 +1737,7 @@
                     "section": "def-common.DataViewsService",
                     "text": "DataViewsService"
                   },
-                  ", \"get\" | \"delete\" | \"create\" | \"find\" | \"ensureDefaultDataView\" | \"getIds\" | \"getTitles\" | \"getIdsWithTitle\" | \"clearCache\" | \"getCache\" | \"getDefault\" | \"getDefaultId\" | \"setDefault\" | \"hasUserDataView\" | \"getFieldsForWildcard\" | \"getFieldsForIndexPattern\" | \"refreshFields\" | \"fieldArrayToMap\" | \"savedObjectToSpec\" | \"createAndSave\" | \"createSavedObject\" | \"updateSavedObject\">>"
+                  ", \"create\" | \"delete\" | \"find\" | \"get\" | \"ensureDefaultDataView\" | \"getIds\" | \"getTitles\" | \"getIdsWithTitle\" | \"clearCache\" | \"getCache\" | \"getDefault\" | \"getDefaultId\" | \"setDefault\" | \"hasUserDataView\" | \"getFieldsForWildcard\" | \"getFieldsForIndexPattern\" | \"refreshFields\" | \"fieldArrayToMap\" | \"savedObjectToSpec\" | \"createAndSave\" | \"createSavedObject\" | \"updateSavedObject\" | \"getDefaultDataView\">>"
                 ],
                 "path": "src/plugins/data_views/public/plugin.ts",
                 "deprecated": false,
@@ -1770,7 +1786,7 @@
                 "section": "def-common.DataViewsService",
                 "text": "DataViewsService"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"find\" | \"ensureDefaultDataView\" | \"getIds\" | \"getTitles\" | \"getIdsWithTitle\" | \"clearCache\" | \"getCache\" | \"getDefault\" | \"getDefaultId\" | \"setDefault\" | \"hasUserDataView\" | \"getFieldsForWildcard\" | \"getFieldsForIndexPattern\" | \"refreshFields\" | \"fieldArrayToMap\" | \"savedObjectToSpec\" | \"createAndSave\" | \"createSavedObject\" | \"updateSavedObject\">"
+              ", \"create\" | \"delete\" | \"find\" | \"get\" | \"ensureDefaultDataView\" | \"getIds\" | \"getTitles\" | \"getIdsWithTitle\" | \"clearCache\" | \"getCache\" | \"getDefault\" | \"getDefaultId\" | \"setDefault\" | \"hasUserDataView\" | \"getFieldsForWildcard\" | \"getFieldsForIndexPattern\" | \"refreshFields\" | \"fieldArrayToMap\" | \"savedObjectToSpec\" | \"createAndSave\" | \"createSavedObject\" | \"updateSavedObject\" | \"getDefaultDataView\">"
             ],
             "path": "src/plugins/data_views/public/plugin.ts",
             "deprecated": false,
@@ -1844,14 +1860,34 @@
             "parentPluginId": "dataViews",
             "id": "def-public.DataViewsService.ensureDefaultDataView",
             "type": "Function",
-            "tags": [],
+            "tags": [
+              "deprecated"
+            ],
             "label": "ensureDefaultDataView",
             "description": [],
             "signature": [
               "() => Promise<unknown> | undefined"
             ],
             "path": "src/plugins/data_views/common/data_views/data_views.ts",
-            "deprecated": false,
+            "deprecated": true,
+            "references": [
+              {
+                "plugin": "discover",
+                "path": "src/plugins/discover/public/application/apps/main/discover_main_route.tsx"
+              },
+              {
+                "plugin": "dashboard",
+                "path": "src/plugins/dashboard/public/application/lib/load_saved_dashboard_state.ts"
+              },
+              {
+                "plugin": "lens",
+                "path": "x-pack/plugins/lens/public/plugin.ts"
+              },
+              {
+                "plugin": "visualize",
+                "path": "src/plugins/visualize/public/plugin.ts"
+              }
+            ],
             "returnComment": [],
             "children": []
           },
@@ -2925,6 +2961,33 @@
               }
             ],
             "returnComment": []
+          },
+          {
+            "parentPluginId": "dataViews",
+            "id": "def-public.DataViewsService.getDefaultDataView",
+            "type": "Function",
+            "tags": [],
+            "label": "getDefaultDataView",
+            "description": [
+              "\nReturns the default data view as an object. If no default is found, or it is missing\nanother data view is selected as default and returned."
+            ],
+            "signature": [
+              "() => Promise<",
+              {
+                "pluginId": "dataViews",
+                "scope": "common",
+                "docId": "kibDataViewsPluginApi",
+                "section": "def-common.DataView",
+                "text": "DataView"
+              },
+              " | undefined>"
+            ],
+            "path": "src/plugins/data_views/common/data_views/data_views.ts",
+            "deprecated": false,
+            "children": [],
+            "returnComment": [
+              "default data view"
+            ]
           }
         ],
         "initialIsOpen": false
@@ -3446,18 +3509,6 @@
             "plugin": "observability",
             "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_app_index_pattern.tsx"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
           {
             "plugin": "maps",
             "path": "x-pack/plugins/maps/public/embeddable/types.ts"
@@ -3630,30 +3681,6 @@
             "plugin": "dataVisualizer",
             "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/embeddables/types.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/embeddables/types.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx"
-          },
           {
             "plugin": "apm",
             "path": "x-pack/plugins/apm/public/components/app/RumDashboard/LocalUIFilters/SelectedFilters.tsx"
@@ -3782,14 +3809,6 @@
             "plugin": "transform",
             "path": "x-pack/plugins/transform/common/types/index_pattern.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
           {
             "plugin": "lens",
             "path": "x-pack/plugins/lens/server/routes/existing_fields.test.ts"
@@ -3822,14 +3841,6 @@
             "plugin": "dataVisualizer",
             "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/saved_search_utils.test.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
           {
             "plugin": "lens",
             "path": "x-pack/plugins/lens/target/types/server/routes/existing_fields.d.ts"
@@ -4190,6 +4201,22 @@
             "plugin": "data",
             "path": "src/plugins/data/common/search/expressions/esaggs/request_handler.test.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.predecessors.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.predecessors.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.successors.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.successors.test.ts"
+          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/utils/get_switch_index_pattern_app_state.test.ts"
@@ -4330,6 +4357,18 @@
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/main/components/doc_table/components/table_header/table_header.d.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_fetch.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_fetch.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_fetch.test.ts"
+          },
           {
             "plugin": "data",
             "path": "src/plugins/data/public/index.ts"
@@ -4536,11 +4575,11 @@
           },
           {
             "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_state.ts"
+            "path": "src/plugins/discover/public/application/apps/context/services/anchor.ts"
           },
           {
             "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_state.ts"
+            "path": "src/plugins/discover/public/application/apps/context/services/anchor.ts"
           },
           {
             "plugin": "discover",
@@ -4548,7 +4587,11 @@
           },
           {
             "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/anchor.ts"
+            "path": "src/plugins/discover/public/application/apps/context/services/context.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.ts"
           },
           {
             "plugin": "discover",
@@ -4974,250 +5017,6 @@
             "plugin": "dataVisualizer",
             "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/full_time_range_selector/full_time_range_selector.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/field_format_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/field_format_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/scatterplot_matrix/use_scatterplot_field_options.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/scatterplot_matrix/use_scatterplot_field_options.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/scatterplot_matrix/scatterplot_matrix.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/scatterplot_matrix/scatterplot_matrix.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/single_metric_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/single_metric_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/multi_metric_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/multi_metric_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/population_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/population_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/advanced_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/advanced_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/categorization_examples_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/categorization_examples_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/categorization_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/categorization_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/rare_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/rare_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator_factory.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator_factory.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/expandable_section/expandable_section_results.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/expandable_section/expandable_section_results.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/outlier_exploration/use_outlier_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/outlier_exploration/use_outlier_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/use_exploration_results.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/use_exploration_results.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/exploration_results_table.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/exploration_results_table.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
           {
             "plugin": "apm",
             "path": "x-pack/plugins/apm/public/components/shared/kuery_bar/index.tsx"
@@ -5518,22 +5317,6 @@
             "plugin": "maps",
             "path": "x-pack/plugins/maps/target/types/public/components/geo_index_pattern_select.d.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities._service.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities._service.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/remove_nested_field_children.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/remove_nested_field_children.test.ts"
-          },
           {
             "plugin": "maps",
             "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/util/get_docvalue_source_fields.test.ts"
@@ -5547,16 +5330,8 @@
             "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/util/get_docvalue_source_fields.test.ts"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_pattern.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_pattern.ts"
-          },
-          {
-            "plugin": "maps",
-            "path": "x-pack/plugins/maps/target/types/public/classes/fields/agg/count_agg_field.d.ts"
+            "plugin": "maps",
+            "path": "x-pack/plugins/maps/target/types/public/classes/fields/agg/count_agg_field.d.ts"
           },
           {
             "plugin": "maps",
@@ -5618,14 +5393,6 @@
             "plugin": "maps",
             "path": "x-pack/plugins/maps/target/types/public/connected_components/edit_layer_panel/filter_editor/filter_editor.d.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/components/full_time_range_selector/full_time_range_selector.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/components/full_time_range_selector/full_time_range_selector.d.ts"
-          },
           {
             "plugin": "dataVisualizer",
             "path": "x-pack/plugins/data_visualizer/target/types/public/application/index_data_visualizer/components/full_time_range_selector/full_time_range_selector.d.ts"
@@ -6146,6 +5913,14 @@
             "plugin": "visDefaultEditor",
             "path": "src/plugins/vis_default_editor/target/types/public/components/agg_select.d.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/anchor.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/anchor.test.ts"
+          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/utils/get_sharing_data.test.ts"
@@ -6194,6 +5969,14 @@
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
+          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/main/utils/nested_fields.d.ts"
@@ -8020,7 +7803,7 @@
                     "section": "def-public.SavedObjectsClient",
                     "text": "SavedObjectsClient"
                   },
-                  ", \"delete\" | \"create\" | \"find\" | \"resolve\" | \"update\">"
+                  ", \"create\" | \"delete\" | \"find\" | \"resolve\" | \"update\">"
                 ],
                 "path": "src/plugins/data_views/public/saved_objects_client_wrapper.ts",
                 "deprecated": false,
@@ -8405,7 +8188,7 @@
             "signature": [
               "<T = any>() => Promise<Record<string, Pick<",
               "UiSettingsParams",
-              "<unknown>, \"type\" | \"options\" | \"description\" | \"name\" | \"order\" | \"value\" | \"category\" | \"optionLabels\" | \"requiresPageReload\" | \"readonly\" | \"sensitive\" | \"deprecation\" | \"metric\"> & ",
+              "<unknown>, \"type\" | \"description\" | \"name\" | \"options\" | \"order\" | \"value\" | \"category\" | \"optionLabels\" | \"requiresPageReload\" | \"readonly\" | \"sensitive\" | \"deprecation\" | \"metric\"> & ",
               "UserProvidedValues",
               "<T>>>"
             ],
@@ -9219,23 +9002,23 @@
         "\nData plugin public Start contract"
       ],
       "signature": [
-        "{ get: (id: string) => Promise<",
+        "{ create: (spec: ",
         {
           "pluginId": "dataViews",
           "scope": "common",
           "docId": "kibDataViewsPluginApi",
-          "section": "def-common.DataView",
-          "text": "DataView"
+          "section": "def-common.DataViewSpec",
+          "text": "DataViewSpec"
         },
-        ">; delete: (indexPatternId: string) => Promise<{}>; create: (spec: ",
+        ", skipFetchFields?: boolean) => Promise<",
         {
           "pluginId": "dataViews",
           "scope": "common",
           "docId": "kibDataViewsPluginApi",
-          "section": "def-common.DataViewSpec",
-          "text": "DataViewSpec"
+          "section": "def-common.DataView",
+          "text": "DataView"
         },
-        ", skipFetchFields?: boolean) => Promise<",
+        ">; delete: (indexPatternId: string) => Promise<{}>; find: (search: string, size?: number) => Promise<",
         {
           "pluginId": "dataViews",
           "scope": "common",
@@ -9243,7 +9026,7 @@
           "section": "def-common.DataView",
           "text": "DataView"
         },
-        ">; find: (search: string, size?: number) => Promise<",
+        "[]>; get: (id: string) => Promise<",
         {
           "pluginId": "dataViews",
           "scope": "common",
@@ -9251,7 +9034,7 @@
           "section": "def-common.DataView",
           "text": "DataView"
         },
-        "[]>; ensureDefaultDataView: ",
+        ">; ensureDefaultDataView: ",
         "EnsureDefaultDataView",
         "; getIds: (refresh?: boolean) => Promise<string[]>; getTitles: (refresh?: boolean) => Promise<string[]>; getIdsWithTitle: (refresh?: boolean) => Promise<",
         {
@@ -9401,7 +9184,15 @@
           "section": "def-common.DataView",
           "text": "DataView"
         },
-        ", saveAttempts?: number, ignoreErrors?: boolean) => Promise<void | Error>; }"
+        ", saveAttempts?: number, ignoreErrors?: boolean) => Promise<void | Error>; getDefaultDataView: () => Promise<",
+        {
+          "pluginId": "dataViews",
+          "scope": "common",
+          "docId": "kibDataViewsPluginApi",
+          "section": "def-common.DataView",
+          "text": "DataView"
+        },
+        " | undefined>; }"
       ],
       "path": "src/plugins/data_views/public/types.ts",
       "deprecated": false,
@@ -9618,7 +9409,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, elasticsearchClient: ",
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, elasticsearchClient: ",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -9642,7 +9433,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, elasticsearchClient: ",
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, elasticsearchClient: ",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -10052,7 +9843,7 @@
             "section": "def-server.SavedObjectsClient",
             "text": "SavedObjectsClient"
           },
-          ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, elasticsearchClient: ",
+          ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, elasticsearchClient: ",
           {
             "pluginId": "core",
             "scope": "server",
@@ -10162,7 +9953,7 @@
             "section": "def-server.SavedObjectsClient",
             "text": "SavedObjectsClient"
           },
-          ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, index: string) => Promise<",
+          ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, index: string) => Promise<",
           "SavedObject",
           "<",
           {
@@ -10193,7 +9984,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
             ],
             "path": "src/plugins/data_views/server/utils.ts",
             "deprecated": false,
@@ -10608,7 +10399,7 @@
               "section": "def-server.SavedObjectsClient",
               "text": "SavedObjectsClient"
             },
-            ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, elasticsearchClient: ",
+            ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, elasticsearchClient: ",
             {
               "pluginId": "core",
               "scope": "server",
@@ -10638,25 +10429,7 @@
               "label": "savedObjectsClient",
               "description": [],
               "signature": [
-                "{ get: <T = unknown>(type: string, id: string, options?: ",
-                {
-                  "pluginId": "core",
-                  "scope": "server",
-                  "docId": "kibCoreSavedObjectsPluginApi",
-                  "section": "def-server.SavedObjectsBaseOptions",
-                  "text": "SavedObjectsBaseOptions"
-                },
-                ") => Promise<",
-                "SavedObject",
-                "<T>>; delete: (type: string, id: string, options?: ",
-                {
-                  "pluginId": "core",
-                  "scope": "server",
-                  "docId": "kibCoreSavedObjectsPluginApi",
-                  "section": "def-server.SavedObjectsDeleteOptions",
-                  "text": "SavedObjectsDeleteOptions"
-                },
-                ") => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: ",
+                "{ create: <T = unknown>(type: string, attributes: T, options?: ",
                 {
                   "pluginId": "core",
                   "scope": "server",
@@ -10714,7 +10487,15 @@
                   "section": "def-server.SavedObjectsCheckConflictsResponse",
                   "text": "SavedObjectsCheckConflictsResponse"
                 },
-                ">; find: <T = unknown, A = unknown>(options: ",
+                ">; delete: (type: string, id: string, options?: ",
+                {
+                  "pluginId": "core",
+                  "scope": "server",
+                  "docId": "kibCoreSavedObjectsPluginApi",
+                  "section": "def-server.SavedObjectsDeleteOptions",
+                  "text": "SavedObjectsDeleteOptions"
+                },
+                ") => Promise<{}>; find: <T = unknown, A = unknown>(options: ",
                 {
                   "pluginId": "core",
                   "scope": "server",
@@ -10778,6 +10559,16 @@
                   "section": "def-server.SavedObjectsBulkResolveResponse",
                   "text": "SavedObjectsBulkResolveResponse"
                 },
+                "<T>>; get: <T = unknown>(type: string, id: string, options?: ",
+                {
+                  "pluginId": "core",
+                  "scope": "server",
+                  "docId": "kibCoreSavedObjectsPluginApi",
+                  "section": "def-server.SavedObjectsBaseOptions",
+                  "text": "SavedObjectsBaseOptions"
+                },
+                ") => Promise<",
+                "SavedObject",
                 "<T>>; resolve: <T = unknown>(type: string, id: string, options?: ",
                 {
                   "pluginId": "core",
@@ -10977,7 +10768,7 @@
               "signature": [
                 "Pick<",
                 "KibanaClient",
-                ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
+                ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
                 "TransportRequestParams",
                 ", options?: ",
                 "TransportRequestOptions",
@@ -11010,7 +10801,7 @@
               "section": "def-server.SavedObjectsClient",
               "text": "SavedObjectsClient"
             },
-            ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, elasticsearchClient: ",
+            ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, elasticsearchClient: ",
             {
               "pluginId": "core",
               "scope": "server",
@@ -11094,25 +10885,7 @@
               "label": "savedObjectsClient",
               "description": [],
               "signature": [
-                "{ get: <T = unknown>(type: string, id: string, options?: ",
-                {
-                  "pluginId": "core",
-                  "scope": "server",
-                  "docId": "kibCoreSavedObjectsPluginApi",
-                  "section": "def-server.SavedObjectsBaseOptions",
-                  "text": "SavedObjectsBaseOptions"
-                },
-                ") => Promise<",
-                "SavedObject",
-                "<T>>; delete: (type: string, id: string, options?: ",
-                {
-                  "pluginId": "core",
-                  "scope": "server",
-                  "docId": "kibCoreSavedObjectsPluginApi",
-                  "section": "def-server.SavedObjectsDeleteOptions",
-                  "text": "SavedObjectsDeleteOptions"
-                },
-                ") => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: ",
+                "{ create: <T = unknown>(type: string, attributes: T, options?: ",
                 {
                   "pluginId": "core",
                   "scope": "server",
@@ -11170,7 +10943,15 @@
                   "section": "def-server.SavedObjectsCheckConflictsResponse",
                   "text": "SavedObjectsCheckConflictsResponse"
                 },
-                ">; find: <T = unknown, A = unknown>(options: ",
+                ">; delete: (type: string, id: string, options?: ",
+                {
+                  "pluginId": "core",
+                  "scope": "server",
+                  "docId": "kibCoreSavedObjectsPluginApi",
+                  "section": "def-server.SavedObjectsDeleteOptions",
+                  "text": "SavedObjectsDeleteOptions"
+                },
+                ") => Promise<{}>; find: <T = unknown, A = unknown>(options: ",
                 {
                   "pluginId": "core",
                   "scope": "server",
@@ -11234,6 +11015,16 @@
                   "section": "def-server.SavedObjectsBulkResolveResponse",
                   "text": "SavedObjectsBulkResolveResponse"
                 },
+                "<T>>; get: <T = unknown>(type: string, id: string, options?: ",
+                {
+                  "pluginId": "core",
+                  "scope": "server",
+                  "docId": "kibCoreSavedObjectsPluginApi",
+                  "section": "def-server.SavedObjectsBaseOptions",
+                  "text": "SavedObjectsBaseOptions"
+                },
+                ") => Promise<",
+                "SavedObject",
                 "<T>>; resolve: <T = unknown>(type: string, id: string, options?: ",
                 {
                   "pluginId": "core",
@@ -11433,7 +11224,7 @@
               "signature": [
                 "Pick<",
                 "KibanaClient",
-                ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
+                ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
                 "TransportRequestParams",
                 ", options?: ",
                 "TransportRequestOptions",
@@ -12823,13 +12614,21 @@
             "signature": [
               "(fieldName: string, format: ",
               {
-                "pluginId": "expressions",
+                "pluginId": "fieldFormats",
                 "scope": "common",
-                "docId": "kibExpressionsPluginApi",
+                "docId": "kibFieldFormatsPluginApi",
                 "section": "def-common.SerializedFieldFormat",
                 "text": "SerializedFieldFormat"
               },
-              "<Record<string, any>>) => void"
+              "<",
+              {
+                "pluginId": "fieldFormats",
+                "scope": "common",
+                "docId": "kibFieldFormatsPluginApi",
+                "section": "def-common.FieldFormatParams",
+                "text": "FieldFormatParams"
+              },
+              ">) => void"
             ],
             "path": "src/plugins/data_views/common/data_views/data_view.ts",
             "deprecated": false,
@@ -12857,13 +12656,21 @@
                 "description": [],
                 "signature": [
                   {
-                    "pluginId": "expressions",
+                    "pluginId": "fieldFormats",
                     "scope": "common",
-                    "docId": "kibExpressionsPluginApi",
+                    "docId": "kibFieldFormatsPluginApi",
                     "section": "def-common.SerializedFieldFormat",
                     "text": "SerializedFieldFormat"
                   },
-                  "<Record<string, any>>"
+                  "<",
+                  {
+                    "pluginId": "fieldFormats",
+                    "scope": "common",
+                    "docId": "kibFieldFormatsPluginApi",
+                    "section": "def-common.FieldFormatParams",
+                    "text": "FieldFormatParams"
+                  },
+                  ">"
                 ],
                 "path": "src/plugins/data_views/common/data_views/data_view.ts",
                 "deprecated": false,
@@ -13595,14 +13402,34 @@
             "parentPluginId": "dataViews",
             "id": "def-common.DataViewsService.ensureDefaultDataView",
             "type": "Function",
-            "tags": [],
+            "tags": [
+              "deprecated"
+            ],
             "label": "ensureDefaultDataView",
             "description": [],
             "signature": [
               "() => Promise<unknown> | undefined"
             ],
             "path": "src/plugins/data_views/common/data_views/data_views.ts",
-            "deprecated": false,
+            "deprecated": true,
+            "references": [
+              {
+                "plugin": "discover",
+                "path": "src/plugins/discover/public/application/apps/main/discover_main_route.tsx"
+              },
+              {
+                "plugin": "dashboard",
+                "path": "src/plugins/dashboard/public/application/lib/load_saved_dashboard_state.ts"
+              },
+              {
+                "plugin": "lens",
+                "path": "x-pack/plugins/lens/public/plugin.ts"
+              },
+              {
+                "plugin": "visualize",
+                "path": "src/plugins/visualize/public/plugin.ts"
+              }
+            ],
             "returnComment": [],
             "children": []
           },
@@ -14676,6 +14503,33 @@
               }
             ],
             "returnComment": []
+          },
+          {
+            "parentPluginId": "dataViews",
+            "id": "def-common.DataViewsService.getDefaultDataView",
+            "type": "Function",
+            "tags": [],
+            "label": "getDefaultDataView",
+            "description": [
+              "\nReturns the default data view as an object. If no default is found, or it is missing\nanother data view is selected as default and returned."
+            ],
+            "signature": [
+              "() => Promise<",
+              {
+                "pluginId": "dataViews",
+                "scope": "common",
+                "docId": "kibDataViewsPluginApi",
+                "section": "def-common.DataView",
+                "text": "DataView"
+              },
+              " | undefined>"
+            ],
+            "path": "src/plugins/data_views/common/data_views/data_views.ts",
+            "deprecated": false,
+            "children": [],
+            "returnComment": [
+              "default data view"
+            ]
           }
         ],
         "initialIsOpen": false
@@ -15250,18 +15104,6 @@
             "plugin": "observability",
             "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_app_index_pattern.tsx"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
           {
             "plugin": "maps",
             "path": "x-pack/plugins/maps/public/embeddable/types.ts"
@@ -15434,30 +15276,6 @@
             "plugin": "dataVisualizer",
             "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/embeddables/types.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/embeddables/types.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx"
-          },
           {
             "plugin": "apm",
             "path": "x-pack/plugins/apm/public/components/app/RumDashboard/LocalUIFilters/SelectedFilters.tsx"
@@ -15586,14 +15404,6 @@
             "plugin": "transform",
             "path": "x-pack/plugins/transform/common/types/index_pattern.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
           {
             "plugin": "lens",
             "path": "x-pack/plugins/lens/server/routes/existing_fields.test.ts"
@@ -15626,14 +15436,6 @@
             "plugin": "dataVisualizer",
             "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/saved_search_utils.test.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
           {
             "plugin": "lens",
             "path": "x-pack/plugins/lens/target/types/server/routes/existing_fields.d.ts"
@@ -15994,6 +15796,22 @@
             "plugin": "data",
             "path": "src/plugins/data/common/search/expressions/esaggs/request_handler.test.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.predecessors.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.predecessors.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.successors.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.successors.test.ts"
+          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/utils/get_switch_index_pattern_app_state.test.ts"
@@ -16134,6 +15952,18 @@
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/main/components/doc_table/components/table_header/table_header.d.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_fetch.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_fetch.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_fetch.test.ts"
+          },
           {
             "plugin": "data",
             "path": "src/plugins/data/public/index.ts"
@@ -16340,11 +16170,11 @@
           },
           {
             "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_state.ts"
+            "path": "src/plugins/discover/public/application/apps/context/services/anchor.ts"
           },
           {
             "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/utils/use_context_app_state.ts"
+            "path": "src/plugins/discover/public/application/apps/context/services/anchor.ts"
           },
           {
             "plugin": "discover",
@@ -16352,7 +16182,11 @@
           },
           {
             "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/anchor.ts"
+            "path": "src/plugins/discover/public/application/apps/context/services/context.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/context.ts"
           },
           {
             "plugin": "discover",
@@ -16779,316 +16613,72 @@
             "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/full_time_range_selector/full_time_range_selector.tsx"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
+            "plugin": "apm",
+            "path": "x-pack/plugins/apm/public/components/shared/kuery_bar/index.tsx"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
+            "plugin": "apm",
+            "path": "x-pack/plugins/apm/public/components/shared/kuery_bar/index.tsx"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
+            "plugin": "apm",
+            "path": "x-pack/plugins/apm/public/components/shared/kuery_bar/index.tsx"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/field_format_service.ts"
+            "plugin": "graph",
+            "path": "x-pack/plugins/graph/public/types/app_state.ts"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/field_format_service.ts"
+            "plugin": "graph",
+            "path": "x-pack/plugins/graph/public/types/app_state.ts"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
+            "plugin": "graph",
+            "path": "x-pack/plugins/graph/public/services/persistence/deserialize.ts"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
+            "plugin": "graph",
+            "path": "x-pack/plugins/graph/public/services/persistence/deserialize.ts"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
+            "plugin": "graph",
+            "path": "x-pack/plugins/graph/public/services/persistence/deserialize.ts"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
+            "plugin": "graph",
+            "path": "x-pack/plugins/graph/public/services/persistence/deserialize.ts"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts"
+            "plugin": "graph",
+            "path": "x-pack/plugins/graph/public/state_management/datasource.sagas.ts"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts"
+            "plugin": "graph",
+            "path": "x-pack/plugins/graph/public/state_management/datasource.sagas.ts"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts"
+            "plugin": "graph",
+            "path": "x-pack/plugins/graph/public/components/search_bar.tsx"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts"
+            "plugin": "graph",
+            "path": "x-pack/plugins/graph/public/components/search_bar.tsx"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts"
+            "plugin": "graph",
+            "path": "x-pack/plugins/graph/public/components/search_bar.tsx"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts"
+            "plugin": "graph",
+            "path": "x-pack/plugins/graph/public/components/search_bar.tsx"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/scatterplot_matrix/use_scatterplot_field_options.ts"
+            "plugin": "graph",
+            "path": "x-pack/plugins/graph/public/components/inspect_panel.tsx"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/scatterplot_matrix/use_scatterplot_field_options.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/scatterplot_matrix/scatterplot_matrix.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/scatterplot_matrix/scatterplot_matrix.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/single_metric_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/single_metric_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/multi_metric_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/multi_metric_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/population_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/population_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/advanced_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/advanced_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/categorization_examples_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/categorization_examples_loader.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/categorization_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/categorization_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/rare_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/rare_job_creator.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator_factory.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator_factory.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/full_time_range_selector/full_time_range_selector.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/expandable_section/expandable_section_results.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/expandable_section/expandable_section_results.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/outlier_exploration/use_outlier_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/outlier_exploration/use_outlier_data.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/use_exploration_results.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/use_exploration_results.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/exploration_results_table.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/exploration_results_table.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts"
-          },
-          {
-            "plugin": "apm",
-            "path": "x-pack/plugins/apm/public/components/shared/kuery_bar/index.tsx"
-          },
-          {
-            "plugin": "apm",
-            "path": "x-pack/plugins/apm/public/components/shared/kuery_bar/index.tsx"
-          },
-          {
-            "plugin": "apm",
-            "path": "x-pack/plugins/apm/public/components/shared/kuery_bar/index.tsx"
-          },
-          {
-            "plugin": "graph",
-            "path": "x-pack/plugins/graph/public/types/app_state.ts"
-          },
-          {
-            "plugin": "graph",
-            "path": "x-pack/plugins/graph/public/types/app_state.ts"
-          },
-          {
-            "plugin": "graph",
-            "path": "x-pack/plugins/graph/public/services/persistence/deserialize.ts"
-          },
-          {
-            "plugin": "graph",
-            "path": "x-pack/plugins/graph/public/services/persistence/deserialize.ts"
-          },
-          {
-            "plugin": "graph",
-            "path": "x-pack/plugins/graph/public/services/persistence/deserialize.ts"
-          },
-          {
-            "plugin": "graph",
-            "path": "x-pack/plugins/graph/public/services/persistence/deserialize.ts"
-          },
-          {
-            "plugin": "graph",
-            "path": "x-pack/plugins/graph/public/state_management/datasource.sagas.ts"
-          },
-          {
-            "plugin": "graph",
-            "path": "x-pack/plugins/graph/public/state_management/datasource.sagas.ts"
-          },
-          {
-            "plugin": "graph",
-            "path": "x-pack/plugins/graph/public/components/search_bar.tsx"
-          },
-          {
-            "plugin": "graph",
-            "path": "x-pack/plugins/graph/public/components/search_bar.tsx"
-          },
-          {
-            "plugin": "graph",
-            "path": "x-pack/plugins/graph/public/components/search_bar.tsx"
-          },
-          {
-            "plugin": "graph",
-            "path": "x-pack/plugins/graph/public/components/search_bar.tsx"
-          },
-          {
-            "plugin": "graph",
-            "path": "x-pack/plugins/graph/public/components/inspect_panel.tsx"
-          },
-          {
-            "plugin": "graph",
-            "path": "x-pack/plugins/graph/public/components/inspect_panel.tsx"
+            "plugin": "graph",
+            "path": "x-pack/plugins/graph/public/components/inspect_panel.tsx"
           },
           {
             "plugin": "graph",
@@ -17322,22 +16912,6 @@
             "plugin": "maps",
             "path": "x-pack/plugins/maps/target/types/public/components/geo_index_pattern_select.d.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities._service.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities._service.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/remove_nested_field_children.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/remove_nested_field_children.test.ts"
-          },
           {
             "plugin": "maps",
             "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/util/get_docvalue_source_fields.test.ts"
@@ -17350,14 +16924,6 @@
             "plugin": "maps",
             "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/util/get_docvalue_source_fields.test.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_pattern.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_pattern.ts"
-          },
           {
             "plugin": "maps",
             "path": "x-pack/plugins/maps/target/types/public/classes/fields/agg/count_agg_field.d.ts"
@@ -17422,14 +16988,6 @@
             "plugin": "maps",
             "path": "x-pack/plugins/maps/target/types/public/connected_components/edit_layer_panel/filter_editor/filter_editor.d.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/components/full_time_range_selector/full_time_range_selector.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/components/full_time_range_selector/full_time_range_selector.d.ts"
-          },
           {
             "plugin": "dataVisualizer",
             "path": "x-pack/plugins/data_visualizer/target/types/public/application/index_data_visualizer/components/full_time_range_selector/full_time_range_selector.d.ts"
@@ -17950,6 +17508,14 @@
             "plugin": "visDefaultEditor",
             "path": "src/plugins/vis_default_editor/target/types/public/components/agg_select.d.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/anchor.test.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/public/application/apps/context/services/anchor.test.ts"
+          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/utils/get_sharing_data.test.ts"
@@ -17998,6 +17564,14 @@
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
           },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
+          },
+          {
+            "plugin": "discover",
+            "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
+          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/main/utils/nested_fields.d.ts"
@@ -19953,7 +19527,7 @@
             "section": "def-common.IndexPatternLoadExpressionFunctionDefinition",
             "text": "IndexPatternLoadExpressionFunctionDefinition"
           },
-          ", \"type\" | \"telemetry\" | \"inject\" | \"extract\" | \"migrations\" | \"name\" | \"disabled\" | \"help\" | \"inputTypes\" | \"args\" | \"aliases\" | \"context\">"
+          ", \"telemetry\" | \"inject\" | \"extract\" | \"migrations\" | \"type\" | \"name\" | \"disabled\" | \"help\" | \"inputTypes\" | \"args\" | \"aliases\" | \"context\">"
         ],
         "path": "src/plugins/data_views/common/expressions/load_index_pattern.ts",
         "deprecated": false,
@@ -20480,13 +20054,21 @@
             "signature": [
               "Record<string, ",
               {
-                "pluginId": "expressions",
+                "pluginId": "fieldFormats",
                 "scope": "common",
-                "docId": "kibExpressionsPluginApi",
+                "docId": "kibFieldFormatsPluginApi",
                 "section": "def-common.SerializedFieldFormat",
                 "text": "SerializedFieldFormat"
               },
-              "<Record<string, any>>> | undefined"
+              "<",
+              {
+                "pluginId": "fieldFormats",
+                "scope": "common",
+                "docId": "kibFieldFormatsPluginApi",
+                "section": "def-common.FieldFormatParams",
+                "text": "FieldFormatParams"
+              },
+              ">> | undefined"
             ],
             "path": "src/plugins/data_views/common/types.ts",
             "deprecated": false
@@ -20679,13 +20261,21 @@
             "description": [],
             "signature": [
               {
-                "pluginId": "expressions",
+                "pluginId": "fieldFormats",
                 "scope": "common",
-                "docId": "kibExpressionsPluginApi",
+                "docId": "kibFieldFormatsPluginApi",
                 "section": "def-common.SerializedFieldFormat",
                 "text": "SerializedFieldFormat"
               },
-              "<Record<string, any>> | undefined"
+              "<",
+              {
+                "pluginId": "fieldFormats",
+                "scope": "common",
+                "docId": "kibFieldFormatsPluginApi",
+                "section": "def-common.FieldFormatParams",
+                "text": "FieldFormatParams"
+              },
+              "> | undefined"
             ],
             "path": "src/plugins/data_views/common/types.ts",
             "deprecated": false
@@ -20983,13 +20573,21 @@
             "description": [],
             "signature": [
               {
-                "pluginId": "expressions",
+                "pluginId": "fieldFormats",
                 "scope": "common",
-                "docId": "kibExpressionsPluginApi",
+                "docId": "kibFieldFormatsPluginApi",
                 "section": "def-common.SerializedFieldFormat",
                 "text": "SerializedFieldFormat"
               },
-              "<Record<string, any>> | undefined"
+              "<",
+              {
+                "pluginId": "fieldFormats",
+                "scope": "common",
+                "docId": "kibFieldFormatsPluginApi",
+                "section": "def-common.FieldFormatParams",
+                "text": "FieldFormatParams"
+              },
+              "> | undefined"
             ],
             "path": "src/plugins/data_views/common/types.ts",
             "deprecated": false
@@ -21444,14 +21042,6 @@
             "plugin": "fleet",
             "path": "x-pack/plugins/fleet/public/applications/fleet/components/search_bar.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_grid/common.ts"
-          },
           {
             "plugin": "infra",
             "path": "x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/custom_metric_form.tsx"
@@ -21624,34 +21214,6 @@
             "plugin": "stackAlerts",
             "path": "x-pack/plugins/stack_alerts/public/alert_types/geo_containment/query_builder/util_components/single_field_select.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/field_types_utils.test.ts"
-          },
           {
             "plugin": "infra",
             "path": "x-pack/plugins/infra/target/types/public/alerting/common/group_by_expression/group_by_expression.d.ts"
@@ -22447,172 +22009,36 @@
             "path": "x-pack/plugins/timelines/public/container/source/index.tsx"
           },
           {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/with_kuery_autocompletion.tsx"
+            "plugin": "monitoring",
+            "path": "x-pack/plugins/monitoring/public/alerts/components/param_details_form/use_derived_index_pattern.tsx"
           },
           {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/with_kuery_autocompletion.tsx"
+            "plugin": "monitoring",
+            "path": "x-pack/plugins/monitoring/public/alerts/components/param_details_form/use_derived_index_pattern.tsx"
           },
           {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/kuery_bar.tsx"
+            "plugin": "monitoring",
+            "path": "x-pack/plugins/monitoring/public/components/kuery_bar/with_kuery_autocompletion.tsx"
           },
           {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/kuery_bar.tsx"
+            "plugin": "monitoring",
+            "path": "x-pack/plugins/monitoring/public/components/kuery_bar/with_kuery_autocompletion.tsx"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
+            "plugin": "monitoring",
+            "path": "x-pack/plugins/monitoring/public/components/kuery_bar/index.tsx"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
+            "plugin": "monitoring",
+            "path": "x-pack/plugins/monitoring/public/components/kuery_bar/index.tsx"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service_analytics.ts"
+            "plugin": "monitoring",
+            "path": "x-pack/plugins/monitoring/public/lib/kuery.ts"
           },
           {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service_analytics.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_recognizer/data_recognizer.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/data_recognizer/data_recognizer.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/inventory_view/components/toolbars/toolbar.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/inventory_view/components/toolbars/toolbar.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/utils/kuery.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/utils/kuery.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_data.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_data.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/alerting/metric_threshold/hooks/use_metrics_explorer_chart_data.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/alerting/metric_threshold/hooks/use_metrics_explorer_chart_data.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/alerting/metric_threshold/components/expression_chart.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/alerting/metric_threshold/components/expression_chart.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/logs/log_filter/log_filter_state.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/logs/log_filter/log_filter_state.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/with_source/with_source.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/with_source/with_source.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/toolbar.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/toolbar.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metric_explorer_state.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metric_explorer_state.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/index.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/metrics_explorer/index.tsx"
-          },
-          {
-            "plugin": "monitoring",
-            "path": "x-pack/plugins/monitoring/public/alerts/components/param_details_form/use_derived_index_pattern.tsx"
-          },
-          {
-            "plugin": "monitoring",
-            "path": "x-pack/plugins/monitoring/public/alerts/components/param_details_form/use_derived_index_pattern.tsx"
-          },
-          {
-            "plugin": "monitoring",
-            "path": "x-pack/plugins/monitoring/public/components/kuery_bar/with_kuery_autocompletion.tsx"
-          },
-          {
-            "plugin": "monitoring",
-            "path": "x-pack/plugins/monitoring/public/components/kuery_bar/with_kuery_autocompletion.tsx"
-          },
-          {
-            "plugin": "monitoring",
-            "path": "x-pack/plugins/monitoring/public/components/kuery_bar/index.tsx"
-          },
-          {
-            "plugin": "monitoring",
-            "path": "x-pack/plugins/monitoring/public/components/kuery_bar/index.tsx"
-          },
-          {
-            "plugin": "monitoring",
-            "path": "x-pack/plugins/monitoring/public/lib/kuery.ts"
-          },
-          {
-            "plugin": "monitoring",
-            "path": "x-pack/plugins/monitoring/public/lib/kuery.ts"
+            "plugin": "monitoring",
+            "path": "x-pack/plugins/monitoring/public/lib/kuery.ts"
           },
           {
             "plugin": "securitySolution",
@@ -22826,30 +22252,6 @@
             "plugin": "timelines",
             "path": "x-pack/plugins/timelines/public/mock/index_pattern.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/containers/with_kuery_autocompletion.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/containers/with_kuery_autocompletion.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/containers/with_source/with_source.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/containers/with_source/with_source.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/index_pattern_context.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/index_pattern_context.ts"
-          },
           {
             "plugin": "monitoring",
             "path": "x-pack/plugins/monitoring/target/types/public/components/kuery_bar/with_kuery_autocompletion.d.ts"
@@ -22894,30 +22296,6 @@
             "plugin": "securitySolution",
             "path": "x-pack/plugins/security_solution/target/types/public/network/components/network_top_countries_table/columns.d.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/alerting/metric_threshold/components/expression_chart.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/alerting/metric_threshold/components/expression_chart.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/alerting/metric_threshold/hooks/use_metrics_explorer_chart_data.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/alerting/metric_threshold/hooks/use_metrics_explorer_chart_data.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/pages/metrics/metrics_explorer/index.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/pages/metrics/metrics_explorer/index.d.ts"
-          },
           {
             "plugin": "monitoring",
             "path": "x-pack/plugins/monitoring/target/types/public/alerts/components/param_details_form/use_derived_index_pattern.d.ts"
@@ -22966,34 +22344,6 @@
             "plugin": "securitySolution",
             "path": "x-pack/plugins/security_solution/target/types/public/ueba/pages/details/types.d.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/pages/metrics/metrics_explorer/hooks/use_metric_explorer_state.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/pages/metrics/metrics_explorer/hooks/use_metric_explorer_state.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_data.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_data.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/jobs/new_job/common/index_pattern_context.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/jobs/new_job/common/index_pattern_context.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/jobs/new_job/common/index_pattern_context.d.ts"
-          },
           {
             "plugin": "indexPatternManagement",
             "path": "src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/components/table/table.tsx"
@@ -23026,70 +22376,6 @@
             "plugin": "indexPatternManagement",
             "path": "src/plugins/index_pattern_management/target/types/public/components/edit_index_pattern/index_header/index_header.d.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_query_bar/exploration_query_bar.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_query_bar/exploration_query_bar.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/clone_action_name.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/clone_action_name.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/use_delete_action.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/use_delete_action.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/utils.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/utils.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/editor.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/components/custom_url_editor/editor.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_utils.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_utils.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/tabs/custom_urls.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/tabs/custom_urls.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/index.tsx"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/pages/metrics/index.tsx"
-          },
           {
             "plugin": "securitySolution",
             "path": "x-pack/plugins/security_solution/common/search_strategy/index_fields/index.ts"
@@ -23198,14 +22484,6 @@
             "plugin": "transform",
             "path": "x-pack/plugins/transform/server/routes/api/transforms.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
           {
             "plugin": "securitySolution",
             "path": "x-pack/plugins/security_solution/public/common/mock/index_pattern.ts"
@@ -23214,34 +22492,6 @@
             "plugin": "securitySolution",
             "path": "x-pack/plugins/security_solution/public/common/mock/index_pattern.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/explorer/components/explorer_query_bar/explorer_query_bar.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/explorer/components/explorer_query_bar/explorer_query_bar.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/explorer/components/explorer_query_bar/explorer_query_bar.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.test.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.test.ts"
-          },
           {
             "plugin": "data",
             "path": "src/plugins/data/common/query/timefilter/get_time.test.ts"
@@ -23399,9 +22649,9 @@
             "signature": [
               "Record<string, ",
               {
-                "pluginId": "expressions",
+                "pluginId": "fieldFormats",
                 "scope": "common",
-                "docId": "kibExpressionsPluginApi",
+                "docId": "kibFieldFormatsPluginApi",
                 "section": "def-common.SerializedFieldFormat",
                 "text": "SerializedFieldFormat"
               },
@@ -23997,7 +23247,7 @@
             "label": "type",
             "description": [],
             "signature": [
-              "\"boolean\" | \"date\" | \"keyword\" | \"geo_point\" | \"ip\" | \"long\" | \"double\""
+              "\"boolean\" | \"keyword\" | \"date\" | \"geo_point\" | \"ip\" | \"long\" | \"double\""
             ],
             "path": "src/plugins/data_views/common/types.ts",
             "deprecated": false
@@ -24846,23 +24096,23 @@
         "label": "DataViewsContract",
         "description": [],
         "signature": [
-          "{ get: (id: string) => Promise<",
+          "{ create: (spec: ",
           {
             "pluginId": "dataViews",
             "scope": "common",
             "docId": "kibDataViewsPluginApi",
-            "section": "def-common.DataView",
-            "text": "DataView"
+            "section": "def-common.DataViewSpec",
+            "text": "DataViewSpec"
           },
-          ">; delete: (indexPatternId: string) => Promise<{}>; create: (spec: ",
+          ", skipFetchFields?: boolean) => Promise<",
           {
             "pluginId": "dataViews",
             "scope": "common",
             "docId": "kibDataViewsPluginApi",
-            "section": "def-common.DataViewSpec",
-            "text": "DataViewSpec"
+            "section": "def-common.DataView",
+            "text": "DataView"
           },
-          ", skipFetchFields?: boolean) => Promise<",
+          ">; delete: (indexPatternId: string) => Promise<{}>; find: (search: string, size?: number) => Promise<",
           {
             "pluginId": "dataViews",
             "scope": "common",
@@ -24870,7 +24120,7 @@
             "section": "def-common.DataView",
             "text": "DataView"
           },
-          ">; find: (search: string, size?: number) => Promise<",
+          "[]>; get: (id: string) => Promise<",
           {
             "pluginId": "dataViews",
             "scope": "common",
@@ -24878,7 +24128,7 @@
             "section": "def-common.DataView",
             "text": "DataView"
           },
-          "[]>; ensureDefaultDataView: ",
+          ">; ensureDefaultDataView: ",
           "EnsureDefaultDataView",
           "; getIds: (refresh?: boolean) => Promise<string[]>; getTitles: (refresh?: boolean) => Promise<string[]>; getIdsWithTitle: (refresh?: boolean) => Promise<",
           {
@@ -25028,7 +24278,15 @@
             "section": "def-common.DataView",
             "text": "DataView"
           },
-          ", saveAttempts?: number, ignoreErrors?: boolean) => Promise<void | Error>; }"
+          ", saveAttempts?: number, ignoreErrors?: boolean) => Promise<void | Error>; getDefaultDataView: () => Promise<",
+          {
+            "pluginId": "dataViews",
+            "scope": "common",
+            "docId": "kibDataViewsPluginApi",
+            "section": "def-common.DataView",
+            "text": "DataView"
+          },
+          " | undefined>; }"
         ],
         "path": "src/plugins/data_views/common/data_views/data_views.ts",
         "deprecated": false,
@@ -25044,13 +24302,21 @@
         "signature": [
           "{ [x: string]: ",
           {
-            "pluginId": "expressions",
+            "pluginId": "fieldFormats",
             "scope": "common",
-            "docId": "kibExpressionsPluginApi",
+            "docId": "kibFieldFormatsPluginApi",
             "section": "def-common.SerializedFieldFormat",
             "text": "SerializedFieldFormat"
           },
-          "<Record<string, any>>; }"
+          "<",
+          {
+            "pluginId": "fieldFormats",
+            "scope": "common",
+            "docId": "kibFieldFormatsPluginApi",
+            "section": "def-common.FieldFormatParams",
+            "text": "FieldFormatParams"
+          },
+          ">; }"
         ],
         "path": "src/plugins/data_views/common/types.ts",
         "deprecated": false,
@@ -25213,14 +24479,6 @@
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/components/sidebar/discover_index_pattern.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
           {
             "plugin": "transform",
             "path": "x-pack/plugins/transform/public/app/hooks/use_search_items/common.ts"
@@ -25253,34 +24511,6 @@
             "plugin": "data",
             "path": "src/plugins/data/server/index.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts"
-          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/components/sidebar/discover_sidebar_responsive.tsx"
@@ -25316,22 +24546,6 @@
           {
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/discover_main_route.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/common/types/kibana.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/common/types/kibana.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/common/types/kibana.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/common/types/kibana.d.ts"
           }
         ],
         "initialIsOpen": false
@@ -25485,23 +24699,23 @@
         "label": "IndexPatternsContract",
         "description": [],
         "signature": [
-          "{ get: (id: string) => Promise<",
+          "{ create: (spec: ",
           {
             "pluginId": "dataViews",
             "scope": "common",
             "docId": "kibDataViewsPluginApi",
-            "section": "def-common.DataView",
-            "text": "DataView"
+            "section": "def-common.DataViewSpec",
+            "text": "DataViewSpec"
           },
-          ">; delete: (indexPatternId: string) => Promise<{}>; create: (spec: ",
+          ", skipFetchFields?: boolean) => Promise<",
           {
             "pluginId": "dataViews",
             "scope": "common",
             "docId": "kibDataViewsPluginApi",
-            "section": "def-common.DataViewSpec",
-            "text": "DataViewSpec"
+            "section": "def-common.DataView",
+            "text": "DataView"
           },
-          ", skipFetchFields?: boolean) => Promise<",
+          ">; delete: (indexPatternId: string) => Promise<{}>; find: (search: string, size?: number) => Promise<",
           {
             "pluginId": "dataViews",
             "scope": "common",
@@ -25509,7 +24723,7 @@
             "section": "def-common.DataView",
             "text": "DataView"
           },
-          ">; find: (search: string, size?: number) => Promise<",
+          "[]>; get: (id: string) => Promise<",
           {
             "pluginId": "dataViews",
             "scope": "common",
@@ -25517,7 +24731,7 @@
             "section": "def-common.DataView",
             "text": "DataView"
           },
-          "[]>; ensureDefaultDataView: ",
+          ">; ensureDefaultDataView: ",
           "EnsureDefaultDataView",
           "; getIds: (refresh?: boolean) => Promise<string[]>; getTitles: (refresh?: boolean) => Promise<string[]>; getIdsWithTitle: (refresh?: boolean) => Promise<",
           {
@@ -25667,7 +24881,15 @@
             "section": "def-common.DataView",
             "text": "DataView"
           },
-          ", saveAttempts?: number, ignoreErrors?: boolean) => Promise<void | Error>; }"
+          ", saveAttempts?: number, ignoreErrors?: boolean) => Promise<void | Error>; getDefaultDataView: () => Promise<",
+          {
+            "pluginId": "dataViews",
+            "scope": "common",
+            "docId": "kibDataViewsPluginApi",
+            "section": "def-common.DataView",
+            "text": "DataView"
+          },
+          " | undefined>; }"
         ],
         "path": "src/plugins/data_views/common/data_views/data_views.ts",
         "deprecated": true,
@@ -25732,50 +24954,6 @@
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/main/utils/resolve_index_pattern.ts"
           },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/logs/log_source/log_source.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/public/containers/logs/log_source/log_source.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
-          {
-            "plugin": "infra",
-            "path": "x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts"
-          },
           {
             "plugin": "observability",
             "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/rtl_helpers.tsx"
@@ -25948,22 +25126,6 @@
             "plugin": "discover",
             "path": "src/plugins/discover/public/application/apps/doc/components/doc.tsx"
           },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/anchor.ts"
-          },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/anchor.ts"
-          },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/context.ts"
-          },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/context.ts"
-          },
           {
             "plugin": "visualizations",
             "path": "src/plugins/visualizations/public/saved_visualizations/_saved_vis.ts"
@@ -26036,66 +25198,6 @@
             "plugin": "maps",
             "path": "x-pack/plugins/maps/public/lazy_load_bundle/index.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/dependency_cache.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/dependency_cache.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/routing/resolvers.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/routing/resolvers.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/routing/router.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/routing/router.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts"
-          },
           {
             "plugin": "graph",
             "path": "x-pack/plugins/graph/public/application.ts"
@@ -26160,30 +25262,6 @@
             "plugin": "maps",
             "path": "x-pack/plugins/maps/target/types/public/lazy_load_bundle/index.d.ts"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_patterns.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/contexts/ml/__mocks__/index_patterns.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/routing/router.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/routing/router.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/util/dependency_cache.d.ts"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/target/types/public/application/util/dependency_cache.d.ts"
-          },
           {
             "plugin": "security",
             "path": "x-pack/plugins/security/target/types/public/management/roles/edit_role/edit_role_page.d.ts"
@@ -26352,14 +25430,6 @@
             "plugin": "indexPatternManagement",
             "path": "src/plugins/index_pattern_management/target/types/public/components/utils.d.ts"
           },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/_stubs.ts"
-          },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/context/services/_stubs.ts"
-          },
           {
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/doc/components/doc.d.ts"
@@ -26367,14 +25437,6 @@
           {
             "plugin": "discover",
             "path": "src/plugins/discover/target/types/public/application/apps/doc/components/doc.d.ts"
-          },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
-          },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/target/types/public/application/apps/context/services/context.d.ts"
           }
         ],
         "initialIsOpen": false
@@ -26586,7 +25648,7 @@
         "label": "RuntimeType",
         "description": [],
         "signature": [
-          "\"boolean\" | \"date\" | \"keyword\" | \"geo_point\" | \"ip\" | \"long\" | \"double\""
+          "\"boolean\" | \"keyword\" | \"date\" | \"geo_point\" | \"ip\" | \"long\" | \"double\""
         ],
         "path": "src/plugins/data_views/common/types.ts",
         "deprecated": false,
diff --git a/api_docs/data_views.mdx b/api_docs/data_views.mdx
index e907c075b9a8fe..77f14d3d39a259 100644
--- a/api_docs/data_views.mdx
+++ b/api_docs/data_views.mdx
@@ -18,7 +18,7 @@ Contact [App Services](https://github.com/orgs/elastic/teams/kibana-app-services
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 681 | 6 | 541 | 5 |
+| 683 | 6 | 541 | 5 |
 
 ## Client
 
diff --git a/api_docs/data_visualizer.json b/api_docs/data_visualizer.json
index 6e46a32aabda79..4a0e41ac2318c6 100644
--- a/api_docs/data_visualizer.json
+++ b/api_docs/data_visualizer.json
@@ -574,7 +574,7 @@
             "label": "type",
             "description": [],
             "signature": [
-              "\"number\" | \"boolean\" | \"date\" | \"keyword\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"unknown\" | \"histogram\" | \"text\""
+              "\"number\" | \"boolean\" | \"keyword\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"unknown\" | \"histogram\" | \"text\""
             ],
             "path": "x-pack/plugins/data_visualizer/common/types/field_request_config.ts",
             "deprecated": false
@@ -1004,7 +1004,7 @@
         "label": "JobFieldType",
         "description": [],
         "signature": [
-          "\"number\" | \"boolean\" | \"date\" | \"keyword\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"unknown\" | \"histogram\" | \"text\""
+          "\"number\" | \"boolean\" | \"keyword\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"unknown\" | \"histogram\" | \"text\""
         ],
         "path": "x-pack/plugins/data_visualizer/common/types/job_field_type.ts",
         "deprecated": false,
diff --git a/api_docs/deprecations_by_api.mdx b/api_docs/deprecations_by_api.mdx
index a083c82e69d055..341a6b6b6bb335 100644
--- a/api_docs/deprecations_by_api.mdx
+++ b/api_docs/deprecations_by_api.mdx
@@ -14,27 +14,27 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 | Deprecated API | Referencing plugin(s) | Remove By |
 | ---------------|-----------|-----------|
 | <DocLink id="kibDashboardPluginApi" section="def-public.DashboardStart.dashboardUrlGenerator" text="dashboardUrlGenerator"/> | securitySolution | - |
-| <DocLink id="kibDataPluginApi" section="def-public.IndexPattern" text="IndexPattern"/> | dataViews, visTypeTimeseries, reporting, discover, observability, infra, maps, dataVisualizer, ml, apm, lens, osquery, securitySolution, transform, savedObjects, indexPatternFieldEditor, visualizations, dashboard, graph, stackAlerts, uptime, indexPatternEditor, indexPatternManagement, inputControlVis, savedObjectsManagement, visualize, visDefaultEditor, visTypeVega, data | - |
+| <DocLink id="kibDataPluginApi" section="def-public.IndexPattern" text="IndexPattern"/> | dataViews, visTypeTimeseries, reporting, discover, observability, maps, dataVisualizer, apm, lens, osquery, securitySolution, transform, savedObjects, indexPatternFieldEditor, visualizations, dashboard, graph, stackAlerts, uptime, indexPatternEditor, indexPatternManagement, inputControlVis, savedObjectsManagement, visualize, visDefaultEditor, visTypeVega, data | - |
 | <DocLink id="kibDataPluginApi" section="def-public.IndexPatternField" text="IndexPatternField"/> | dataViews, discover, maps, dataVisualizer, lens, indexPatternFieldEditor, securitySolution, indexPatternEditor, indexPatternManagement, inputControlVis, visDefaultEditor, visTypeTimeseries, data | - |
-| <DocLink id="kibDataPluginApi" section="def-public.IIndexPattern" text="IIndexPattern"/> | dataViews, timelines, infra, ml, monitoring, securitySolution, indexPatternManagement, stackAlerts, transform | - |
+| <DocLink id="kibDataPluginApi" section="def-public.IIndexPattern" text="IIndexPattern"/> | dataViews, timelines, monitoring, securitySolution, indexPatternManagement, stackAlerts, transform | - |
 | <DocLink id="kibDataPluginApi" section="def-public.DataPublicPluginStart.indexPatterns" text="indexPatterns"/> | home, savedObjects, security, fleet, indexPatternFieldEditor, discover, visualizations, dashboard, lens, observability, maps, fileUpload, dataVisualizer, ml, infra, apm, graph, monitoring, osquery, securitySolution, stackAlerts, transform, upgradeAssistant, uptime, indexPatternEditor, indexPatternManagement, inputControlVis, kibanaOverview, savedObjectsManagement, visualize, visTypeTimelion, visTypeTimeseries, visTypeVega | - |
-| <DocLink id="kibDataPluginApi" section="def-common.IIndexPattern" text="IIndexPattern"/> | dataViews, timelines, infra, ml, monitoring, securitySolution, indexPatternManagement, stackAlerts, transform, data | - |
+| <DocLink id="kibDataPluginApi" section="def-common.IIndexPattern" text="IIndexPattern"/> | dataViews, timelines, monitoring, securitySolution, indexPatternManagement, stackAlerts, transform, data | - |
 | <DocLink id="kibDataPluginApi" section="def-common.IndexPatternField" text="IndexPatternField"/> | dataViews, discover, maps, dataVisualizer, lens, indexPatternFieldEditor, securitySolution, indexPatternEditor, indexPatternManagement, inputControlVis, visDefaultEditor, visTypeTimeseries, data | - |
-| <DocLink id="kibDataPluginApi" section="def-common.IndexPattern" text="IndexPattern"/> | dataViews, visTypeTimeseries, reporting, discover, observability, infra, maps, dataVisualizer, ml, apm, lens, osquery, securitySolution, transform, savedObjects, indexPatternFieldEditor, visualizations, dashboard, graph, stackAlerts, uptime, indexPatternEditor, indexPatternManagement, inputControlVis, savedObjectsManagement, visualize, visDefaultEditor, visTypeVega, data | - |
+| <DocLink id="kibDataPluginApi" section="def-common.IndexPattern" text="IndexPattern"/> | dataViews, visTypeTimeseries, reporting, discover, observability, maps, dataVisualizer, apm, lens, osquery, securitySolution, transform, savedObjects, indexPatternFieldEditor, visualizations, dashboard, graph, stackAlerts, uptime, indexPatternEditor, indexPatternManagement, inputControlVis, savedObjectsManagement, visualize, visDefaultEditor, visTypeVega, data | - |
 | <DocLink id="kibDataPluginApi" section="def-server.IndexPatternField" text="IndexPatternField"/> | dataViews, discover, maps, dataVisualizer, lens, indexPatternFieldEditor, securitySolution, indexPatternEditor, indexPatternManagement, inputControlVis, visDefaultEditor, visTypeTimeseries | - |
-| <DocLink id="kibDataPluginApi" section="def-server.IndexPattern" text="IndexPattern"/> | dataViews, visTypeTimeseries, reporting, discover, observability, infra, maps, dataVisualizer, ml, apm, lens, osquery, securitySolution, transform, savedObjects, indexPatternFieldEditor, visualizations, dashboard, graph, stackAlerts, uptime, indexPatternEditor, indexPatternManagement, inputControlVis, savedObjectsManagement, visualize, visDefaultEditor, visTypeVega | - |
+| <DocLink id="kibDataPluginApi" section="def-server.IndexPattern" text="IndexPattern"/> | dataViews, visTypeTimeseries, reporting, discover, observability, maps, dataVisualizer, apm, lens, osquery, securitySolution, transform, savedObjects, indexPatternFieldEditor, visualizations, dashboard, graph, stackAlerts, uptime, indexPatternEditor, indexPatternManagement, inputControlVis, savedObjectsManagement, visualize, visDefaultEditor, visTypeVega | - |
 | <DocLink id="kibLicensingPluginApi" section="def-public.PublicLicense.mode" text="mode"/> | apm, security, securitySolution | - |
 | <DocLink id="kibLicensingPluginApi" section="def-server.PublicLicense.mode" text="mode"/> | apm, security, securitySolution | - |
 | <DocLink id="kibSecurityPluginApi" section="def-server.SecurityPluginSetup.authc" text="authc"/> | reporting, encryptedSavedObjects, actions, ml, dataEnhanced, logstash, securitySolution | - |
 | <DocLink id="kibCorePluginApi" section="def-public.AppMountParameters.onAppLeave" text="onAppLeave"/> | dashboard, lens, maps, ml, securitySolution, security, visualize | - |
 | <DocLink id="kibCorePluginApi" section="def-public.AppLeaveHandler" text="AppLeaveHandler"/> | securitySolution | - |
 | <DocLink id="kibDataPluginApi" section="def-public.IndexPatternsService" text="IndexPatternsService"/> | dataViews, visTypeTimeseries, maps, lens, discover, data | - |
-| <DocLink id="kibDataPluginApi" section="def-public.IndexPatternsContract" text="IndexPatternsContract"/> | dataViews, discover, infra, observability, savedObjects, security, visualizations, dashboard, lens, maps, ml, graph, stackAlerts, transform, indexPatternManagement, inputControlVis, savedObjectsManagement, visTypeTimelion, data | - |
-| <DocLink id="kibDataPluginApi" section="def-public.IndexPatternAttributes" text="IndexPatternAttributes"/> | dataViews, discover, ml, transform, canvas | - |
+| <DocLink id="kibDataPluginApi" section="def-public.IndexPatternsContract" text="IndexPatternsContract"/> | dataViews, discover, observability, savedObjects, security, visualizations, dashboard, lens, maps, graph, stackAlerts, transform, indexPatternManagement, inputControlVis, savedObjectsManagement, visTypeTimelion, data | - |
+| <DocLink id="kibDataPluginApi" section="def-public.IndexPatternAttributes" text="IndexPatternAttributes"/> | dataViews, discover, transform, canvas | - |
 | <DocLink id="kibDataPluginApi" section="def-public.IndexPatternSpec" text="IndexPatternSpec"/> | dataViews, observability, indexPatternEditor, apm | - |
 | <DocLink id="kibDataPluginApi" section="def-public.IndexPatternType" text="IndexPatternType"/> | dataViews | - |
 | <DocLink id="kibDataPluginApi" section="def-public.IndexPatternListItem" text="IndexPatternListItem"/> | dataViews, indexPatternManagement | - |
-| <DocLink id="kibDataPluginApi" section="def-common.IndexPatternAttributes" text="IndexPatternAttributes"/> | dataViews, discover, ml, transform, canvas, data | - |
+| <DocLink id="kibDataPluginApi" section="def-common.IndexPatternAttributes" text="IndexPatternAttributes"/> | dataViews, discover, transform, canvas, data | - |
 | <DocLink id="kibDataPluginApi" section="def-common.IIndexPatternsApiClient" text="IIndexPatternsApiClient"/> | dataViews, data | - |
 | <DocLink id="kibDataPluginApi" section="def-common.IndexPatternFieldMap" text="IndexPatternFieldMap"/> | dataViews, data | - |
 | <DocLink id="kibDataPluginApi" section="def-common.DataViewSpec.intervalName" text="intervalName"/> | dataViews | - |
@@ -42,38 +42,39 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 | <DocLink id="kibDataPluginApi" section="def-common.INDEX_PATTERN_SAVED_OBJECT_TYPE" text="INDEX_PATTERN_SAVED_OBJECT_TYPE"/> | dataViews, visualizations, dashboard, data | - |
 | <DocLink id="kibDataPluginApi" section="def-common.IndexPatternType" text="IndexPatternType"/> | dataViews, data | - |
 | <DocLink id="kibDataPluginApi" section="def-common.IndexPatternsService" text="IndexPatternsService"/> | dataViews, visTypeTimeseries, maps, lens, discover, data | - |
-| <DocLink id="kibDataPluginApi" section="def-common.IndexPatternsContract" text="IndexPatternsContract"/> | dataViews, discover, infra, observability, savedObjects, security, visualizations, dashboard, lens, maps, ml, graph, stackAlerts, transform, indexPatternManagement, inputControlVis, savedObjectsManagement, visTypeTimelion, data | - |
+| <DocLink id="kibDataPluginApi" section="def-common.IndexPatternsContract" text="IndexPatternsContract"/> | dataViews, discover, observability, savedObjects, security, visualizations, dashboard, lens, maps, graph, stackAlerts, transform, indexPatternManagement, inputControlVis, savedObjectsManagement, visTypeTimelion, data | - |
+| <DocLink id="kibDataPluginApi" section="def-common.DataViewsService.ensureDefaultDataView" text="ensureDefaultDataView"/> | dataViews, discover, dashboard, lens, visualize | - |
 | <DocLink id="kibDataPluginApi" section="def-common.IndexPatternListItem" text="IndexPatternListItem"/> | dataViews, indexPatternManagement, data | - |
-| <DocLink id="kibDataPluginApi" section="def-server.IndexPatternAttributes" text="IndexPatternAttributes"/> | dataViews, discover, ml, transform, canvas | - |
+| <DocLink id="kibDataPluginApi" section="def-server.IndexPatternAttributes" text="IndexPatternAttributes"/> | dataViews, discover, transform, canvas | - |
 | <DocLink id="kibDataPluginApi" section="def-server.IndexPatternsService" text="IndexPatternsService"/> | dataViews, visTypeTimeseries, maps, lens, discover | - |
 | <DocLink id="kibDataPluginApi" section="def-public.DataPublicPluginStart.fieldFormats" text="fieldFormats"/> | fleet, indexPatternFieldEditor, discover, dashboard, lens, ml, stackAlerts, indexPatternManagement, visTypePie, visTypeTable, visTypeTimeseries, visTypeXy, visTypeVislib | - |
 | <DocLink id="kibDataPluginApi" section="def-server.DataPluginStart.fieldFormats" text="fieldFormats"/> | reporting, visTypeTimeseries | - |
 | <DocLink id="kibDataViewsPluginApi" section="def-server.DataViewsServerPluginStart.indexPatternsServiceFactory" text="indexPatternsServiceFactory"/> | data, lens, visTypeTimeseries, infra, maps, visTypeTimelion | - |
 | <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectsStart.settings" text="settings"/> | dashboard, maps, graph, visualize | - |
 | <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.license$" text="license$"/> | spaces, security, reporting, actions, alerting, ml, fleet, remoteClusters, graph, indexLifecycleManagement, maps, painlessLab, rollup, searchprofiler, snapshotRestore, transform, upgradeAssistant | - |
+| <DocLink id="kibDataViewsPluginApi" section="def-public.DataViewsService.ensureDefaultDataView" text="ensureDefaultDataView"/> | discover, dashboard, lens, visualize | - |
 | <DocLink id="kibCorePluginApi" section="def-server.SavedObjectsMigrationLogger.warning" text="warning"/> | lens, dashboard | - |
 | <DocLink id="kibDataPluginApi" section="def-public.SearchSource.create" text="create"/> | discover | - |
 | <DocLink id="kibDataPluginApi" section="def-common.SearchSource.create" text="create"/> | discover | - |
 | <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectSaveModal" text="SavedObjectSaveModal"/> | embeddable, presentationUtil, discover, dashboard, graph | - |
 | <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectLoader" text="SavedObjectLoader"/> | discover, visualizations, dashboard | - |
-| <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObject" text="SavedObject"/> | discover, savedObjectsTaggingOss, visualizations, dashboard, visualize, visDefaultEditor | - |
+| <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObject" text="SavedObject"/> | savedObjectsTaggingOss, discover, visualizations, dashboard | - |
 | <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectsStart.SavedObjectClass" text="SavedObjectClass"/> | discover, visualizations, dashboard | - |
 | <DocLink id="kibUiActionsPluginApi" section="def-public.UiActionsService.executeTriggerActions" text="executeTriggerActions"/> | data, discover, embeddable | - |
 | <DocLink id="kibCorePluginApi" section="def-public.UiSettingsParams.metric" text="metric"/> | advancedSettings, discover | - |
 | <DocLink id="kibCorePluginApi" section="def-server.UiSettingsParams.metric" text="metric"/> | advancedSettings, discover | - |
-| <DocLink id="kibSharePluginApi" section="def-public.LocatorPublic.getUrl" text="getUrl"/> | ml, infra, reporting, ingestPipelines | - |
-| <DocLink id="kibSharePluginApi" section="def-common.LocatorPublic.getUrl" text="getUrl"/> | ml, infra, reporting, ingestPipelines | - |
 | <DocLink id="kibDiscoverPluginApi" section="def-public.DiscoverStart.urlGenerator" text="urlGenerator"/> | observability, osquery | - |
 | <DocLink id="kibFeaturesPluginApi" section="def-common.FeatureElasticsearchPrivileges.requiredRoles" text="requiredRoles"/> | security | - |
 | <DocLink id="kibFeaturesPluginApi" section="def-server.FeatureElasticsearchPrivileges.requiredRoles" text="requiredRoles"/> | security | - |
 | <DocLink id="kibLicensingPluginApi" section="def-public.LicensingPluginSetup.license$" text="license$"/> | security, licenseManagement, ml, fleet, apm, reporting, crossClusterReplication, logstash, painlessLab, searchprofiler, watcher | - |
 | <DocLink id="kibCorePluginApi" section="def-public.AppMountParameters.appBasePath" text="appBasePath"/> | management, fleet, security, kibanaOverview | - |
-| <DocLink id="kibSecurityPluginApi" section="def-server.SecurityPluginSetup.authz" text="authz"/> | actions, ml, enterpriseSearch, savedObjectsTagging | - |
-| <DocLink id="kibCorePluginApi" section="def-public.IHttpFetchError.req" text="req"/> | ml | - |
+| <DocLink id="kibDiscoverPluginApi" section="def-public.__LEGACY" text="__LEGACY"/> | visualizations | - |
 | <DocLink id="kibCorePluginApi" section="def-public.SavedObjectsImportSuccess.createNewCopy" text="createNewCopy"/> | spaces, savedObjectsManagement | - |
 | <DocLink id="kibCorePluginApi" section="def-server.SavedObjectsImportSuccess.createNewCopy" text="createNewCopy"/> | spaces, savedObjectsManagement | - |
 | <DocLink id="kibDataPluginApi" section="def-public.SearchSourceFields.fieldsFromSource" text="fieldsFromSource"/> | reporting | - |
 | <DocLink id="kibDataPluginApi" section="def-common.SearchSourceFields.fieldsFromSource" text="fieldsFromSource"/> | reporting | - |
+| <DocLink id="kibSharePluginApi" section="def-public.LocatorPublic.getUrl" text="getUrl"/> | ml, infra, reporting, ingestPipelines | - |
+| <DocLink id="kibSharePluginApi" section="def-common.LocatorPublic.getUrl" text="getUrl"/> | ml, infra, reporting, ingestPipelines | - |
 | <DocLink id="kibHomePluginApi" section="def-public.HomePublicPluginSetup.environment" text="environment"/> | cloud, apm | - |
 | <DocLink id="kibCorePluginApi" section="def-public.CoreSetup.injectedMetadata" text="injectedMetadata"/> | visTypeVega | - |
 | <DocLink id="kibCorePluginApi" section="def-public.CoreStart.injectedMetadata" text="injectedMetadata"/> | monitoring, visTypeVega | - |
@@ -89,6 +90,8 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 | <DocLink id="kibExpressionsPluginApi" section="def-common.ExpressionsServiceSetup.getFunctions" text="getFunctions"/> | canvas | - |
 | <DocLink id="kibExpressionsPluginApi" section="def-common.ExpressionsServiceSetup.getTypes" text="getTypes"/> | canvas | - |
 | <DocLink id="kibExpressionsPluginApi" section="def-server.ExpressionFunctionDefinition.context" text="context"/> | canvas, visTypeXy | - |
+| <DocLink id="kibSecurityPluginApi" section="def-server.SecurityPluginSetup.authz" text="authz"/> | actions, ml, enterpriseSearch, savedObjectsTagging | - |
+| <DocLink id="kibCorePluginApi" section="def-public.IHttpFetchError.req" text="req"/> | ml | - |
 | <DocLink id="kibSecurityPluginApi" section="def-server.LegacyAuditLogger" text="LegacyAuditLogger"/> | encryptedSavedObjects, actions, alerting | - |
 | <DocLink id="kibTaskManagerPluginApi" section="def-server.TaskManagerSetupContract.index" text="index"/> | actions | - |
 | <DocLink id="kibCorePluginApi" section="def-server.ElasticsearchServiceSetup.legacy" text="legacy"/> | console | - |
@@ -100,14 +103,14 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 | <DocLink id="kibDataPluginApi" section="def-public.Filter" text="Filter"/> | discover, visualizations, dashboard, lens, observability, timelines, maps, infra, dashboardEnhanced, discoverEnhanced, securitySolution, urlDrilldown, inputControlVis, visualize, visTypeTimelion, visTypeVega, ml, visTypeTimeseries | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-common.Filter" text="Filter"/> | discover, visualizations, dashboard, lens, observability, timelines, maps, infra, dashboardEnhanced, discoverEnhanced, securitySolution, urlDrilldown, inputControlVis, visualize, visTypeTimelion, visTypeVega, ml, visTypeTimeseries | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-server.Filter" text="Filter"/> | discover, visualizations, dashboard, lens, observability, timelines, maps, infra, dashboardEnhanced, discoverEnhanced, securitySolution, urlDrilldown, inputControlVis, visualize, visTypeTimelion, visTypeVega, ml, visTypeTimeseries | 8.1 |
-| <DocLink id="kibDataPluginApi" section="def-public.IFieldType" text="IFieldType"/> | dataViews, fleet, ml, infra, monitoring, stackAlerts, indexPatternManagement | 8.1 |
-| <DocLink id="kibDataPluginApi" section="def-common.IFieldType" text="IFieldType"/> | dataViews, fleet, ml, infra, monitoring, stackAlerts, indexPatternManagement, data | 8.1 |
+| <DocLink id="kibDataPluginApi" section="def-public.IFieldType" text="IFieldType"/> | dataViews, fleet, infra, monitoring, stackAlerts, indexPatternManagement | 8.1 |
+| <DocLink id="kibDataPluginApi" section="def-common.IFieldType" text="IFieldType"/> | dataViews, fleet, infra, monitoring, stackAlerts, indexPatternManagement, data | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-common.DataView.intervalName" text="intervalName"/> | dataViews | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-common.DataView.addScriptedField" text="addScriptedField"/> | dataViews | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-common.DataView.removeScriptedField" text="removeScriptedField"/> | indexPatternManagement, dataViews | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-common.DataView.getNonScriptedFields" text="getNonScriptedFields"/> | visTypeTimeseries, graph, indexPatternManagement, dataViews | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-common.DataView.getScriptedFields" text="getScriptedFields"/> | dataViews, indexPatternManagement | 8.1 |
-| <DocLink id="kibDataPluginApi" section="def-server.IFieldType" text="IFieldType"/> | dataViews, fleet, ml, infra, monitoring, stackAlerts, indexPatternManagement | 8.1 |
+| <DocLink id="kibDataPluginApi" section="def-server.IFieldType" text="IFieldType"/> | dataViews, fleet, infra, monitoring, stackAlerts, indexPatternManagement | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-server.DataView.intervalName" text="intervalName"/> | dataViews | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-server.DataView.addScriptedField" text="addScriptedField"/> | dataViews | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-server.DataView.removeScriptedField" text="removeScriptedField"/> | indexPatternManagement, dataViews | 8.1 |
@@ -211,6 +214,8 @@ Safe to remove.
 | <DocLink id="kibDataViewsPluginApi" section="def-common.DataViewSpec.intervalName" text="intervalName"/> |
 | <DocLink id="kibDataViewsPluginApi" section="def-common.DataView.intervalName" text="intervalName"/> |
 | <DocLink id="kibDataViewsPluginApi" section="def-common.DataView.addScriptedField" text="addScriptedField"/> |
+| <DocLink id="kibDiscoverPluginApi" section="def-public.LegacySavedSearch" text="LegacySavedSearch"/> |
+| <DocLink id="kibDiscoverPluginApi" section="def-public.SavedSearchLoader" text="SavedSearchLoader"/> |
 | <DocLink id="kibExpressionsPluginApi" section="def-public.ExpressionExecutor" text="ExpressionExecutor"/> |
 | <DocLink id="kibExpressionsPluginApi" section="def-public.Executor.functions" text="functions"/> |
 | <DocLink id="kibExpressionsPluginApi" section="def-public.Executor.types" text="types"/> |
diff --git a/api_docs/deprecations_by_plugin.mdx b/api_docs/deprecations_by_plugin.mdx
index b33ab317ca885d..7ef3a75269963d 100644
--- a/api_docs/deprecations_by_plugin.mdx
+++ b/api_docs/deprecations_by_plugin.mdx
@@ -131,10 +131,12 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 | <DocLink id="kibDataPluginApi" section="def-public.Filter" text="Filter"/> | [filter_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/filter_utils.ts#:~:text=Filter), [filter_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/filter_utils.ts#:~:text=Filter), [filter_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/filter_utils.ts#:~:text=Filter), [filter_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/filter_utils.ts#:~:text=Filter), [filter_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/filter_utils.ts#:~:text=Filter), [saved_dashboard.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/saved_dashboards/saved_dashboard.ts#:~:text=Filter), [saved_dashboard.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/saved_dashboards/saved_dashboard.ts#:~:text=Filter), [dashboard_state_slice.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/state/dashboard_state_slice.ts#:~:text=Filter), [dashboard_state_slice.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/state/dashboard_state_slice.ts#:~:text=Filter), [dashboard_state_slice.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/state/dashboard_state_slice.ts#:~:text=Filter)+ 25 more | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-common.INDEX_PATTERN_SAVED_OBJECT_TYPE" text="INDEX_PATTERN_SAVED_OBJECT_TYPE"/> | [replace_index_pattern_reference.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/server/saved_objects/replace_index_pattern_reference.ts#:~:text=INDEX_PATTERN_SAVED_OBJECT_TYPE), [replace_index_pattern_reference.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/server/saved_objects/replace_index_pattern_reference.ts#:~:text=INDEX_PATTERN_SAVED_OBJECT_TYPE), [dashboard_migrations.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/server/saved_objects/dashboard_migrations.ts#:~:text=INDEX_PATTERN_SAVED_OBJECT_TYPE), [dashboard_migrations.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/server/saved_objects/dashboard_migrations.ts#:~:text=INDEX_PATTERN_SAVED_OBJECT_TYPE), [dashboard_migrations.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/server/saved_objects/dashboard_migrations.ts#:~:text=INDEX_PATTERN_SAVED_OBJECT_TYPE), [replace_index_pattern_reference.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/server/saved_objects/replace_index_pattern_reference.ts#:~:text=INDEX_PATTERN_SAVED_OBJECT_TYPE), [replace_index_pattern_reference.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/server/saved_objects/replace_index_pattern_reference.ts#:~:text=INDEX_PATTERN_SAVED_OBJECT_TYPE), [dashboard_migrations.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/server/saved_objects/dashboard_migrations.ts#:~:text=INDEX_PATTERN_SAVED_OBJECT_TYPE), [dashboard_migrations.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/server/saved_objects/dashboard_migrations.ts#:~:text=INDEX_PATTERN_SAVED_OBJECT_TYPE), [dashboard_migrations.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/server/saved_objects/dashboard_migrations.ts#:~:text=INDEX_PATTERN_SAVED_OBJECT_TYPE) | - |
 | <DocLink id="kibDataPluginApi" section="def-common.IndexPatternsContract" text="IndexPatternsContract"/> | [sync_dashboard_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/sync_dashboard_index_patterns.ts#:~:text=IndexPatternsContract), [sync_dashboard_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/sync_dashboard_index_patterns.ts#:~:text=IndexPatternsContract), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/types.ts#:~:text=IndexPatternsContract), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/types.ts#:~:text=IndexPatternsContract), [make_default_services.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/test_helpers/make_default_services.ts#:~:text=IndexPatternsContract), [make_default_services.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/test_helpers/make_default_services.ts#:~:text=IndexPatternsContract), [sync_dashboard_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/sync_dashboard_index_patterns.ts#:~:text=IndexPatternsContract), [sync_dashboard_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/sync_dashboard_index_patterns.ts#:~:text=IndexPatternsContract), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/types.ts#:~:text=IndexPatternsContract), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/types.ts#:~:text=IndexPatternsContract)+ 2 more | - |
+| <DocLink id="kibDataPluginApi" section="def-common.DataViewsService.ensureDefaultDataView" text="ensureDefaultDataView"/> | [load_saved_dashboard_state.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/load_saved_dashboard_state.ts#:~:text=ensureDefaultDataView), [load_saved_dashboard_state.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/load_saved_dashboard_state.ts#:~:text=ensureDefaultDataView) | - |
 | <DocLink id="kibDataPluginApi" section="def-common.IndexPattern" text="IndexPattern"/> | [sync_dashboard_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/sync_dashboard_index_patterns.ts#:~:text=IndexPattern), [sync_dashboard_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/sync_dashboard_index_patterns.ts#:~:text=IndexPattern), [sync_dashboard_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/sync_dashboard_index_patterns.ts#:~:text=IndexPattern), [sync_dashboard_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/sync_dashboard_index_patterns.ts#:~:text=IndexPattern), [sync_dashboard_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/sync_dashboard_index_patterns.ts#:~:text=IndexPattern), [sync_dashboard_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/sync_dashboard_index_patterns.ts#:~:text=IndexPattern), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/types.ts#:~:text=IndexPattern), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/types.ts#:~:text=IndexPattern), [sync_dashboard_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/sync_dashboard_index_patterns.ts#:~:text=IndexPattern), [sync_dashboard_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/sync_dashboard_index_patterns.ts#:~:text=IndexPattern)+ 6 more | - |
 | <DocLink id="kibDataPluginApi" section="def-common.Filter" text="Filter"/> | [filter_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/filter_utils.ts#:~:text=Filter), [filter_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/filter_utils.ts#:~:text=Filter), [filter_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/filter_utils.ts#:~:text=Filter), [filter_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/filter_utils.ts#:~:text=Filter), [filter_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/filter_utils.ts#:~:text=Filter), [saved_dashboard.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/saved_dashboards/saved_dashboard.ts#:~:text=Filter), [saved_dashboard.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/saved_dashboards/saved_dashboard.ts#:~:text=Filter), [dashboard_state_slice.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/state/dashboard_state_slice.ts#:~:text=Filter), [dashboard_state_slice.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/state/dashboard_state_slice.ts#:~:text=Filter), [dashboard_state_slice.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/state/dashboard_state_slice.ts#:~:text=Filter)+ 25 more | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-server.IndexPattern" text="IndexPattern"/> | [sync_dashboard_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/sync_dashboard_index_patterns.ts#:~:text=IndexPattern), [sync_dashboard_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/sync_dashboard_index_patterns.ts#:~:text=IndexPattern), [sync_dashboard_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/sync_dashboard_index_patterns.ts#:~:text=IndexPattern), [sync_dashboard_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/sync_dashboard_index_patterns.ts#:~:text=IndexPattern), [sync_dashboard_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/sync_dashboard_index_patterns.ts#:~:text=IndexPattern), [sync_dashboard_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/sync_dashboard_index_patterns.ts#:~:text=IndexPattern), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/types.ts#:~:text=IndexPattern), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/types.ts#:~:text=IndexPattern) | - |
 | <DocLink id="kibDataPluginApi" section="def-server.Filter" text="Filter"/> | [filter_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/filter_utils.ts#:~:text=Filter), [filter_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/filter_utils.ts#:~:text=Filter), [filter_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/filter_utils.ts#:~:text=Filter), [filter_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/filter_utils.ts#:~:text=Filter), [filter_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/filter_utils.ts#:~:text=Filter), [saved_dashboard.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/saved_dashboards/saved_dashboard.ts#:~:text=Filter), [saved_dashboard.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/saved_dashboards/saved_dashboard.ts#:~:text=Filter), [dashboard_state_slice.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/state/dashboard_state_slice.ts#:~:text=Filter), [dashboard_state_slice.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/state/dashboard_state_slice.ts#:~:text=Filter), [dashboard_state_slice.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/state/dashboard_state_slice.ts#:~:text=Filter)+ 25 more | 8.1 |
+| <DocLink id="kibDataViewsPluginApi" section="def-public.DataViewsService.ensureDefaultDataView" text="ensureDefaultDataView"/> | [load_saved_dashboard_state.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/load_saved_dashboard_state.ts#:~:text=ensureDefaultDataView) | - |
 | <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectSaveModal" text="SavedObjectSaveModal"/> | [saved_objects.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/services/saved_objects.ts#:~:text=SavedObjectSaveModal), [save_modal.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/top_nav/save_modal.tsx#:~:text=SavedObjectSaveModal), [save_modal.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/top_nav/save_modal.tsx#:~:text=SavedObjectSaveModal) | - |
 | <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectLoader" text="SavedObjectLoader"/> | [saved_objects.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/services/saved_objects.ts#:~:text=SavedObjectLoader), [saved_dashboards.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/saved_dashboards/saved_dashboards.ts#:~:text=SavedObjectLoader), [saved_dashboards.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/saved_dashboards/saved_dashboards.ts#:~:text=SavedObjectLoader), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/types.ts#:~:text=SavedObjectLoader), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/types.ts#:~:text=SavedObjectLoader), [plugin.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/plugin.tsx#:~:text=SavedObjectLoader), [plugin.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/plugin.tsx#:~:text=SavedObjectLoader), [make_default_services.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/test_helpers/make_default_services.ts#:~:text=SavedObjectLoader), [make_default_services.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/test_helpers/make_default_services.ts#:~:text=SavedObjectLoader), [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/url_generator.ts#:~:text=SavedObjectLoader)+ 3 more | - |
 | <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObject" text="SavedObject"/> | [saved_objects.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/services/saved_objects.ts#:~:text=SavedObject), [saved_dashboard.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/saved_dashboards/saved_dashboard.ts#:~:text=SavedObject), [saved_dashboard.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/saved_dashboards/saved_dashboard.ts#:~:text=SavedObject), [dashboard_tagging.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/dashboard_tagging.ts#:~:text=SavedObject), [dashboard_tagging.ts](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/lib/dashboard_tagging.ts#:~:text=SavedObject), [clone_panel_action.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/actions/clone_panel_action.tsx#:~:text=SavedObject), [clone_panel_action.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/actions/clone_panel_action.tsx#:~:text=SavedObject), [clone_panel_action.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/dashboard/public/application/actions/clone_panel_action.tsx#:~:text=SavedObject) | - |
@@ -222,6 +224,7 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 | <DocLink id="kibDataPluginApi" section="def-common.IndexPatternType" text="IndexPatternType"/> | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/index.ts#:~:text=IndexPatternType) | - |
 | <DocLink id="kibDataPluginApi" section="def-common.IndexPatternsService" text="IndexPatternsService"/> | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/index.ts#:~:text=IndexPatternsService), [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/public/index.ts#:~:text=IndexPatternsService) | - |
 | <DocLink id="kibDataPluginApi" section="def-common.IndexPatternsContract" text="IndexPatternsContract"/> | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/index.ts#:~:text=IndexPatternsContract), [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/public/index.ts#:~:text=IndexPatternsContract) | - |
+| <DocLink id="kibDataPluginApi" section="def-common.DataViewsService.ensureDefaultDataView" text="ensureDefaultDataView"/> | [data_views.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/data_views/data_views.ts#:~:text=ensureDefaultDataView) | - |
 | <DocLink id="kibDataPluginApi" section="def-common.IndexPattern" text="IndexPattern"/> | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/index.ts#:~:text=IndexPattern), [data_view_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/data_view_field.test.ts#:~:text=IndexPattern), [data_view_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/data_view_field.test.ts#:~:text=IndexPattern), [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/public/index.ts#:~:text=IndexPattern), [data_view.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/data_views/data_view.test.ts#:~:text=IndexPattern), [data_view.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/data_views/data_view.test.ts#:~:text=IndexPattern), [data_view.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/data_views/data_view.test.ts#:~:text=IndexPattern), [data_view.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/data_views/data_view.test.ts#:~:text=IndexPattern) | - |
 | <DocLink id="kibDataPluginApi" section="def-common.IndexPatternListItem" text="IndexPatternListItem"/> | [data_views.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/data_views/data_views.ts#:~:text=IndexPatternListItem), [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/index.ts#:~:text=IndexPatternListItem) | - |
 | <DocLink id="kibDataPluginApi" section="def-common.DataView.intervalName" text="intervalName"/> | [data_view.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/data_views/data_view.ts#:~:text=intervalName), [data_view.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/data_views/data_view.ts#:~:text=intervalName), [data_view.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/data_views/data_view.ts#:~:text=intervalName), [update_index_pattern.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/server/routes/update_index_pattern.ts#:~:text=intervalName), [update_index_pattern.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/server/routes/update_index_pattern.ts#:~:text=intervalName) | 8.1 |
@@ -261,8 +264,8 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
 | <DocLink id="kibDataPluginApi" section="def-public.IndexPatternsService" text="IndexPatternsService"/> | [index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/__mocks__/index_patterns.ts#:~:text=IndexPatternsService), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/__mocks__/index_patterns.ts#:~:text=IndexPatternsService), [popularize_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/popularize_field.test.ts#:~:text=IndexPatternsService), [popularize_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/popularize_field.test.ts#:~:text=IndexPatternsService), [popularize_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/popularize_field.test.ts#:~:text=IndexPatternsService), [popularize_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/popularize_field.test.ts#:~:text=IndexPatternsService), [popularize_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/popularize_field.test.ts#:~:text=IndexPatternsService), [popularize_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/popularize_field.test.ts#:~:text=IndexPatternsService), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/__mocks__/index_patterns.ts#:~:text=IndexPatternsService), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/__mocks__/index_patterns.ts#:~:text=IndexPatternsService)+ 6 more | - |
-| <DocLink id="kibDataPluginApi" section="def-public.IndexPatternsContract" text="IndexPatternsContract"/> | [use_data_grid_columns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/use_data_grid_columns.ts#:~:text=IndexPatternsContract), [use_data_grid_columns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/use_data_grid_columns.ts#:~:text=IndexPatternsContract), [use_index_pattern.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/use_index_pattern.tsx#:~:text=IndexPatternsContract), [use_index_pattern.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/use_index_pattern.tsx#:~:text=IndexPatternsContract), [resolve_index_pattern.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/utils/resolve_index_pattern.ts#:~:text=IndexPatternsContract), [resolve_index_pattern.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/utils/resolve_index_pattern.ts#:~:text=IndexPatternsContract), [use_data_grid_columns.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/helpers/use_data_grid_columns.d.ts#:~:text=IndexPatternsContract), [use_data_grid_columns.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/helpers/use_data_grid_columns.d.ts#:~:text=IndexPatternsContract), [resolve_index_pattern.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/apps/main/utils/resolve_index_pattern.d.ts#:~:text=IndexPatternsContract), [resolve_index_pattern.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/apps/main/utils/resolve_index_pattern.d.ts#:~:text=IndexPatternsContract)+ 50 more | - |
-| <DocLink id="kibDataPluginApi" section="def-public.IndexPattern" text="IndexPattern"/> | [helpers.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_header/helpers.tsx#:~:text=IndexPattern), [helpers.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_header/helpers.tsx#:~:text=IndexPattern), [discover_grid_flyout.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_flyout.tsx#:~:text=IndexPattern), [discover_grid_flyout.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_flyout.tsx#:~:text=IndexPattern), [discover_grid_context.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_context.tsx#:~:text=IndexPattern), [discover_grid_context.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_context.tsx#:~:text=IndexPattern), [get_render_cell_value.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.tsx#:~:text=IndexPattern), [get_render_cell_value.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.tsx#:~:text=IndexPattern), [discover_grid_columns.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_columns.tsx#:~:text=IndexPattern), [discover_grid_columns.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_columns.tsx#:~:text=IndexPattern)+ 354 more | - |
+| <DocLink id="kibDataPluginApi" section="def-public.IndexPatternsContract" text="IndexPatternsContract"/> | [use_data_grid_columns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/use_data_grid_columns.ts#:~:text=IndexPatternsContract), [use_data_grid_columns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/use_data_grid_columns.ts#:~:text=IndexPatternsContract), [use_index_pattern.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/use_index_pattern.tsx#:~:text=IndexPatternsContract), [use_index_pattern.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/use_index_pattern.tsx#:~:text=IndexPatternsContract), [resolve_index_pattern.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/utils/resolve_index_pattern.ts#:~:text=IndexPatternsContract), [resolve_index_pattern.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/utils/resolve_index_pattern.ts#:~:text=IndexPatternsContract), [use_data_grid_columns.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/helpers/use_data_grid_columns.d.ts#:~:text=IndexPatternsContract), [use_data_grid_columns.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/helpers/use_data_grid_columns.d.ts#:~:text=IndexPatternsContract), [resolve_index_pattern.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/apps/main/utils/resolve_index_pattern.d.ts#:~:text=IndexPatternsContract), [resolve_index_pattern.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/apps/main/utils/resolve_index_pattern.d.ts#:~:text=IndexPatternsContract)+ 34 more | - |
+| <DocLink id="kibDataPluginApi" section="def-public.IndexPattern" text="IndexPattern"/> | [helpers.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_header/helpers.tsx#:~:text=IndexPattern), [helpers.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_header/helpers.tsx#:~:text=IndexPattern), [discover_grid_flyout.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_flyout.tsx#:~:text=IndexPattern), [discover_grid_flyout.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_flyout.tsx#:~:text=IndexPattern), [discover_grid_context.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_context.tsx#:~:text=IndexPattern), [discover_grid_context.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_context.tsx#:~:text=IndexPattern), [get_render_cell_value.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.tsx#:~:text=IndexPattern), [get_render_cell_value.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.tsx#:~:text=IndexPattern), [discover_grid_columns.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_columns.tsx#:~:text=IndexPattern), [discover_grid_columns.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_columns.tsx#:~:text=IndexPattern)+ 378 more | - |
 | <DocLink id="kibDataPluginApi" section="def-public.IndexPatternField" text="IndexPatternField"/> | [discover_grid_cell_actions.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_cell_actions.tsx#:~:text=IndexPatternField), [discover_grid_cell_actions.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_cell_actions.tsx#:~:text=IndexPatternField), [doc_table_wrapper.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/doc_table/doc_table_wrapper.tsx#:~:text=IndexPatternField), [doc_table_wrapper.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/doc_table/doc_table_wrapper.tsx#:~:text=IndexPatternField), [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/saved_search_embeddable.tsx#:~:text=IndexPatternField), [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/saved_search_embeddable.tsx#:~:text=IndexPatternField), [context_app.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/context/context_app.tsx#:~:text=IndexPatternField), [context_app.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/context/context_app.tsx#:~:text=IndexPatternField), [discover_field_visualize.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/sidebar/discover_field_visualize.tsx#:~:text=IndexPatternField), [discover_field_visualize.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/sidebar/discover_field_visualize.tsx#:~:text=IndexPatternField)+ 192 more | - |
 | <DocLink id="kibDataPluginApi" section="def-public.IndexPatternAttributes" text="IndexPatternAttributes"/> | [discover_index_pattern.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/sidebar/discover_index_pattern.tsx#:~:text=IndexPatternAttributes), [discover_index_pattern.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/sidebar/discover_index_pattern.tsx#:~:text=IndexPatternAttributes), [discover_index_pattern.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/apps/main/components/sidebar/discover_index_pattern.d.ts#:~:text=IndexPatternAttributes), [discover_index_pattern.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/apps/main/components/sidebar/discover_index_pattern.d.ts#:~:text=IndexPatternAttributes), [discover_sidebar_responsive.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/sidebar/discover_sidebar_responsive.tsx#:~:text=IndexPatternAttributes), [discover_sidebar_responsive.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/sidebar/discover_sidebar_responsive.tsx#:~:text=IndexPatternAttributes), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/layout/types.ts#:~:text=IndexPatternAttributes), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/layout/types.ts#:~:text=IndexPatternAttributes), [discover_main_app.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/discover_main_app.tsx#:~:text=IndexPatternAttributes), [discover_main_app.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/discover_main_app.tsx#:~:text=IndexPatternAttributes)+ 3 more | - |
 | <DocLink id="kibDataPluginApi" section="def-public.SearchSource.create" text="create"/> | [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/saved_search_embeddable.tsx#:~:text=create), [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/saved_search_embeddable.tsx#:~:text=create) | - |
@@ -270,24 +273,26 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 | <DocLink id="kibDataPluginApi" section="def-public.DataPublicPluginStart.indexPatterns" text="indexPatterns"/> | [build_services.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/build_services.ts#:~:text=indexPatterns), [source_viewer.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/source_viewer/source_viewer.tsx#:~:text=indexPatterns), [discover_main_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/discover_main_route.tsx#:~:text=indexPatterns), [discover_main_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/discover_main_route.tsx#:~:text=indexPatterns), [discover_main_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/discover_main_route.tsx#:~:text=indexPatterns), [plugin.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/plugin.tsx#:~:text=indexPatterns) | - |
 | <DocLink id="kibDataPluginApi" section="def-public.DataPublicPluginStart.fieldFormats" text="fieldFormats"/> | [histogram.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/chart/histogram.tsx#:~:text=fieldFormats) | - |
 | <DocLink id="kibDataPluginApi" section="def-public.esFilters" text="esFilters"/> | [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/url_generator.ts#:~:text=esFilters), [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/url_generator.ts#:~:text=esFilters), [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/url_generator.ts#:~:text=esFilters), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/locator.ts#:~:text=esFilters), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/locator.ts#:~:text=esFilters), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/locator.ts#:~:text=esFilters), [get_context_url.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/get_context_url.tsx#:~:text=esFilters), [get_context_url.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/get_context_url.tsx#:~:text=esFilters), [discover_state.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/services/discover_state.ts#:~:text=esFilters), [discover_state.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/services/discover_state.ts#:~:text=esFilters)+ 17 more | 8.1 |
-| <DocLink id="kibDataPluginApi" section="def-public.Filter" text="Filter"/> | [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/url_generator.ts#:~:text=Filter), [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/url_generator.ts#:~:text=Filter), [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/url_generator.ts#:~:text=Filter), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/locator.ts#:~:text=Filter), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/locator.ts#:~:text=Filter), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/locator.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/types.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/types.ts#:~:text=Filter), [discover_state.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/services/discover_state.ts#:~:text=Filter), [discover_state.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/services/discover_state.ts#:~:text=Filter)+ 21 more | 8.1 |
+| <DocLink id="kibDataPluginApi" section="def-public.Filter" text="Filter"/> | [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/url_generator.ts#:~:text=Filter), [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/url_generator.ts#:~:text=Filter), [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/url_generator.ts#:~:text=Filter), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/locator.ts#:~:text=Filter), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/locator.ts#:~:text=Filter), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/locator.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/types.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/types.ts#:~:text=Filter), [discover_state.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/services/discover_state.ts#:~:text=Filter), [discover_state.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/services/discover_state.ts#:~:text=Filter)+ 22 more | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-common.IndexPatternAttributes" text="IndexPatternAttributes"/> | [discover_index_pattern.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/sidebar/discover_index_pattern.tsx#:~:text=IndexPatternAttributes), [discover_index_pattern.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/sidebar/discover_index_pattern.tsx#:~:text=IndexPatternAttributes), [discover_index_pattern.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/apps/main/components/sidebar/discover_index_pattern.d.ts#:~:text=IndexPatternAttributes), [discover_index_pattern.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/apps/main/components/sidebar/discover_index_pattern.d.ts#:~:text=IndexPatternAttributes), [discover_sidebar_responsive.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/sidebar/discover_sidebar_responsive.tsx#:~:text=IndexPatternAttributes), [discover_sidebar_responsive.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/sidebar/discover_sidebar_responsive.tsx#:~:text=IndexPatternAttributes), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/layout/types.ts#:~:text=IndexPatternAttributes), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/layout/types.ts#:~:text=IndexPatternAttributes), [discover_main_app.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/discover_main_app.tsx#:~:text=IndexPatternAttributes), [discover_main_app.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/discover_main_app.tsx#:~:text=IndexPatternAttributes)+ 16 more | - |
 | <DocLink id="kibDataPluginApi" section="def-common.IndexPatternField" text="IndexPatternField"/> | [discover_grid_cell_actions.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_cell_actions.tsx#:~:text=IndexPatternField), [discover_grid_cell_actions.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_cell_actions.tsx#:~:text=IndexPatternField), [doc_table_wrapper.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/doc_table/doc_table_wrapper.tsx#:~:text=IndexPatternField), [doc_table_wrapper.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/doc_table/doc_table_wrapper.tsx#:~:text=IndexPatternField), [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/saved_search_embeddable.tsx#:~:text=IndexPatternField), [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/saved_search_embeddable.tsx#:~:text=IndexPatternField), [context_app.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/context/context_app.tsx#:~:text=IndexPatternField), [context_app.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/context/context_app.tsx#:~:text=IndexPatternField), [discover_field_visualize.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/sidebar/discover_field_visualize.tsx#:~:text=IndexPatternField), [discover_field_visualize.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/sidebar/discover_field_visualize.tsx#:~:text=IndexPatternField)+ 192 more | - |
 | <DocLink id="kibDataPluginApi" section="def-common.IndexPatternsService" text="IndexPatternsService"/> | [index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/__mocks__/index_patterns.ts#:~:text=IndexPatternsService), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/__mocks__/index_patterns.ts#:~:text=IndexPatternsService), [popularize_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/popularize_field.test.ts#:~:text=IndexPatternsService), [popularize_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/popularize_field.test.ts#:~:text=IndexPatternsService), [popularize_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/popularize_field.test.ts#:~:text=IndexPatternsService), [popularize_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/popularize_field.test.ts#:~:text=IndexPatternsService), [popularize_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/popularize_field.test.ts#:~:text=IndexPatternsService), [popularize_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/popularize_field.test.ts#:~:text=IndexPatternsService), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/__mocks__/index_patterns.ts#:~:text=IndexPatternsService), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/__mocks__/index_patterns.ts#:~:text=IndexPatternsService)+ 6 more | - |
-| <DocLink id="kibDataPluginApi" section="def-common.IndexPatternsContract" text="IndexPatternsContract"/> | [use_data_grid_columns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/use_data_grid_columns.ts#:~:text=IndexPatternsContract), [use_data_grid_columns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/use_data_grid_columns.ts#:~:text=IndexPatternsContract), [use_index_pattern.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/use_index_pattern.tsx#:~:text=IndexPatternsContract), [use_index_pattern.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/use_index_pattern.tsx#:~:text=IndexPatternsContract), [resolve_index_pattern.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/utils/resolve_index_pattern.ts#:~:text=IndexPatternsContract), [resolve_index_pattern.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/utils/resolve_index_pattern.ts#:~:text=IndexPatternsContract), [use_data_grid_columns.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/helpers/use_data_grid_columns.d.ts#:~:text=IndexPatternsContract), [use_data_grid_columns.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/helpers/use_data_grid_columns.d.ts#:~:text=IndexPatternsContract), [resolve_index_pattern.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/apps/main/utils/resolve_index_pattern.d.ts#:~:text=IndexPatternsContract), [resolve_index_pattern.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/apps/main/utils/resolve_index_pattern.d.ts#:~:text=IndexPatternsContract)+ 50 more | - |
-| <DocLink id="kibDataPluginApi" section="def-common.IndexPattern" text="IndexPattern"/> | [helpers.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_header/helpers.tsx#:~:text=IndexPattern), [helpers.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_header/helpers.tsx#:~:text=IndexPattern), [discover_grid_flyout.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_flyout.tsx#:~:text=IndexPattern), [discover_grid_flyout.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_flyout.tsx#:~:text=IndexPattern), [discover_grid_context.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_context.tsx#:~:text=IndexPattern), [discover_grid_context.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_context.tsx#:~:text=IndexPattern), [get_render_cell_value.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.tsx#:~:text=IndexPattern), [get_render_cell_value.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.tsx#:~:text=IndexPattern), [discover_grid_columns.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_columns.tsx#:~:text=IndexPattern), [discover_grid_columns.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_columns.tsx#:~:text=IndexPattern)+ 354 more | - |
-| <DocLink id="kibDataPluginApi" section="def-common.Filter" text="Filter"/> | [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/url_generator.ts#:~:text=Filter), [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/url_generator.ts#:~:text=Filter), [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/url_generator.ts#:~:text=Filter), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/locator.ts#:~:text=Filter), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/locator.ts#:~:text=Filter), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/locator.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/types.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/types.ts#:~:text=Filter), [discover_state.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/services/discover_state.ts#:~:text=Filter), [discover_state.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/services/discover_state.ts#:~:text=Filter)+ 21 more | 8.1 |
+| <DocLink id="kibDataPluginApi" section="def-common.IndexPatternsContract" text="IndexPatternsContract"/> | [use_data_grid_columns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/use_data_grid_columns.ts#:~:text=IndexPatternsContract), [use_data_grid_columns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/use_data_grid_columns.ts#:~:text=IndexPatternsContract), [use_index_pattern.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/use_index_pattern.tsx#:~:text=IndexPatternsContract), [use_index_pattern.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/use_index_pattern.tsx#:~:text=IndexPatternsContract), [resolve_index_pattern.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/utils/resolve_index_pattern.ts#:~:text=IndexPatternsContract), [resolve_index_pattern.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/utils/resolve_index_pattern.ts#:~:text=IndexPatternsContract), [use_data_grid_columns.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/helpers/use_data_grid_columns.d.ts#:~:text=IndexPatternsContract), [use_data_grid_columns.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/helpers/use_data_grid_columns.d.ts#:~:text=IndexPatternsContract), [resolve_index_pattern.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/apps/main/utils/resolve_index_pattern.d.ts#:~:text=IndexPatternsContract), [resolve_index_pattern.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/apps/main/utils/resolve_index_pattern.d.ts#:~:text=IndexPatternsContract)+ 34 more | - |
+| <DocLink id="kibDataPluginApi" section="def-common.DataViewsService.ensureDefaultDataView" text="ensureDefaultDataView"/> | [discover_main_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/discover_main_route.tsx#:~:text=ensureDefaultDataView), [discover_main_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/discover_main_route.tsx#:~:text=ensureDefaultDataView) | - |
+| <DocLink id="kibDataPluginApi" section="def-common.IndexPattern" text="IndexPattern"/> | [helpers.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_header/helpers.tsx#:~:text=IndexPattern), [helpers.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_header/helpers.tsx#:~:text=IndexPattern), [discover_grid_flyout.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_flyout.tsx#:~:text=IndexPattern), [discover_grid_flyout.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_flyout.tsx#:~:text=IndexPattern), [discover_grid_context.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_context.tsx#:~:text=IndexPattern), [discover_grid_context.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_context.tsx#:~:text=IndexPattern), [get_render_cell_value.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.tsx#:~:text=IndexPattern), [get_render_cell_value.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.tsx#:~:text=IndexPattern), [discover_grid_columns.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_columns.tsx#:~:text=IndexPattern), [discover_grid_columns.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_columns.tsx#:~:text=IndexPattern)+ 378 more | - |
+| <DocLink id="kibDataPluginApi" section="def-common.Filter" text="Filter"/> | [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/url_generator.ts#:~:text=Filter), [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/url_generator.ts#:~:text=Filter), [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/url_generator.ts#:~:text=Filter), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/locator.ts#:~:text=Filter), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/locator.ts#:~:text=Filter), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/locator.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/types.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/types.ts#:~:text=Filter), [discover_state.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/services/discover_state.ts#:~:text=Filter), [discover_state.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/services/discover_state.ts#:~:text=Filter)+ 22 more | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-common.SearchSource.create" text="create"/> | [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/saved_search_embeddable.tsx#:~:text=create), [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/saved_search_embeddable.tsx#:~:text=create) | - |
 | <DocLink id="kibDataPluginApi" section="def-common.SearchSource.fetch" text="fetch"/> | [anchor.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/context/services/anchor.ts#:~:text=fetch), [fetch_hits_in_interval.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/context/services/utils/fetch_hits_in_interval.ts#:~:text=fetch) | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-server.IndexPatternField" text="IndexPatternField"/> | [discover_grid_cell_actions.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_cell_actions.tsx#:~:text=IndexPatternField), [discover_grid_cell_actions.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_cell_actions.tsx#:~:text=IndexPatternField), [doc_table_wrapper.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/doc_table/doc_table_wrapper.tsx#:~:text=IndexPatternField), [doc_table_wrapper.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/doc_table/doc_table_wrapper.tsx#:~:text=IndexPatternField), [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/saved_search_embeddable.tsx#:~:text=IndexPatternField), [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/saved_search_embeddable.tsx#:~:text=IndexPatternField), [context_app.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/context/context_app.tsx#:~:text=IndexPatternField), [context_app.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/context/context_app.tsx#:~:text=IndexPatternField), [discover_field_visualize.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/sidebar/discover_field_visualize.tsx#:~:text=IndexPatternField), [discover_field_visualize.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/sidebar/discover_field_visualize.tsx#:~:text=IndexPatternField)+ 91 more | - |
 | <DocLink id="kibDataPluginApi" section="def-server.IndexPatternAttributes" text="IndexPatternAttributes"/> | [discover_index_pattern.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/sidebar/discover_index_pattern.tsx#:~:text=IndexPatternAttributes), [discover_index_pattern.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/sidebar/discover_index_pattern.tsx#:~:text=IndexPatternAttributes), [discover_index_pattern.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/apps/main/components/sidebar/discover_index_pattern.d.ts#:~:text=IndexPatternAttributes), [discover_index_pattern.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/apps/main/components/sidebar/discover_index_pattern.d.ts#:~:text=IndexPatternAttributes), [discover_sidebar_responsive.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/sidebar/discover_sidebar_responsive.tsx#:~:text=IndexPatternAttributes), [discover_sidebar_responsive.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/sidebar/discover_sidebar_responsive.tsx#:~:text=IndexPatternAttributes), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/layout/types.ts#:~:text=IndexPatternAttributes), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/layout/types.ts#:~:text=IndexPatternAttributes), [discover_main_app.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/discover_main_app.tsx#:~:text=IndexPatternAttributes), [discover_main_app.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/discover_main_app.tsx#:~:text=IndexPatternAttributes)+ 3 more | - |
-| <DocLink id="kibDataPluginApi" section="def-server.IndexPattern" text="IndexPattern"/> | [helpers.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_header/helpers.tsx#:~:text=IndexPattern), [helpers.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_header/helpers.tsx#:~:text=IndexPattern), [discover_grid_flyout.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_flyout.tsx#:~:text=IndexPattern), [discover_grid_flyout.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_flyout.tsx#:~:text=IndexPattern), [discover_grid_context.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_context.tsx#:~:text=IndexPattern), [discover_grid_context.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_context.tsx#:~:text=IndexPattern), [get_render_cell_value.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.tsx#:~:text=IndexPattern), [get_render_cell_value.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.tsx#:~:text=IndexPattern), [discover_grid_columns.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_columns.tsx#:~:text=IndexPattern), [discover_grid_columns.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_columns.tsx#:~:text=IndexPattern)+ 172 more | - |
+| <DocLink id="kibDataPluginApi" section="def-server.IndexPattern" text="IndexPattern"/> | [helpers.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_header/helpers.tsx#:~:text=IndexPattern), [helpers.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_header/helpers.tsx#:~:text=IndexPattern), [discover_grid_flyout.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_flyout.tsx#:~:text=IndexPattern), [discover_grid_flyout.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_flyout.tsx#:~:text=IndexPattern), [discover_grid_context.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_context.tsx#:~:text=IndexPattern), [discover_grid_context.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_context.tsx#:~:text=IndexPattern), [get_render_cell_value.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.tsx#:~:text=IndexPattern), [get_render_cell_value.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.tsx#:~:text=IndexPattern), [discover_grid_columns.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_columns.tsx#:~:text=IndexPattern), [discover_grid_columns.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/components/discover_grid/discover_grid_columns.tsx#:~:text=IndexPattern)+ 184 more | - |
 | <DocLink id="kibDataPluginApi" section="def-server.IndexPatternsService" text="IndexPatternsService"/> | [index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/__mocks__/index_patterns.ts#:~:text=IndexPatternsService), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/__mocks__/index_patterns.ts#:~:text=IndexPatternsService), [popularize_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/popularize_field.test.ts#:~:text=IndexPatternsService), [popularize_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/popularize_field.test.ts#:~:text=IndexPatternsService), [popularize_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/popularize_field.test.ts#:~:text=IndexPatternsService), [popularize_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/popularize_field.test.ts#:~:text=IndexPatternsService), [popularize_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/popularize_field.test.ts#:~:text=IndexPatternsService), [popularize_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/helpers/popularize_field.test.ts#:~:text=IndexPatternsService), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/__mocks__/index_patterns.ts#:~:text=IndexPatternsService), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/__mocks__/index_patterns.ts#:~:text=IndexPatternsService)+ 6 more | - |
-| <DocLink id="kibDataPluginApi" section="def-server.Filter" text="Filter"/> | [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/url_generator.ts#:~:text=Filter), [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/url_generator.ts#:~:text=Filter), [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/url_generator.ts#:~:text=Filter), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/locator.ts#:~:text=Filter), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/locator.ts#:~:text=Filter), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/locator.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/types.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/types.ts#:~:text=Filter), [discover_state.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/services/discover_state.ts#:~:text=Filter), [discover_state.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/services/discover_state.ts#:~:text=Filter)+ 21 more | 8.1 |
+| <DocLink id="kibDataPluginApi" section="def-server.Filter" text="Filter"/> | [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/url_generator.ts#:~:text=Filter), [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/url_generator.ts#:~:text=Filter), [url_generator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/url_generator.ts#:~:text=Filter), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/locator.ts#:~:text=Filter), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/locator.ts#:~:text=Filter), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/locator.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/types.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/types.ts#:~:text=Filter), [discover_state.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/services/discover_state.ts#:~:text=Filter), [discover_state.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/services/discover_state.ts#:~:text=Filter)+ 22 more | 8.1 |
+| <DocLink id="kibDataViewsPluginApi" section="def-public.DataViewsService.ensureDefaultDataView" text="ensureDefaultDataView"/> | [discover_main_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/discover_main_route.tsx#:~:text=ensureDefaultDataView) | - |
 | <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectSaveModal" text="SavedObjectSaveModal"/> | [on_save_search.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/top_nav/on_save_search.tsx#:~:text=SavedObjectSaveModal), [on_save_search.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/components/top_nav/on_save_search.tsx#:~:text=SavedObjectSaveModal) | - |
-| <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectLoader" text="SavedObjectLoader"/> | [saved_searches.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/saved_searches/saved_searches.ts#:~:text=SavedObjectLoader), [saved_searches.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/saved_searches/saved_searches.ts#:~:text=SavedObjectLoader), [plugin.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/plugin.tsx#:~:text=SavedObjectLoader), [plugin.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/plugin.tsx#:~:text=SavedObjectLoader) | - |
-| <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObject" text="SavedObject"/> | [discover_main_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/discover_main_route.tsx#:~:text=SavedObject), [_saved_search.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/saved_searches/_saved_search.ts#:~:text=SavedObject), [_saved_search.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/saved_searches/_saved_search.ts#:~:text=SavedObject), [discover_main_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/discover_main_route.tsx#:~:text=SavedObject), [discover_main_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/apps/main/discover_main_route.tsx#:~:text=SavedObject) | - |
-| <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectsStart.SavedObjectClass" text="SavedObjectClass"/> | [_saved_search.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/saved_searches/_saved_search.ts#:~:text=SavedObjectClass) | - |
+| <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectLoader" text="SavedObjectLoader"/> | [saved_searches.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/saved_searches/legacy/saved_searches.ts#:~:text=SavedObjectLoader), [saved_searches.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/saved_searches/legacy/saved_searches.ts#:~:text=SavedObjectLoader), [plugin.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/plugin.tsx#:~:text=SavedObjectLoader), [plugin.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/plugin.tsx#:~:text=SavedObjectLoader) | - |
+| <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObject" text="SavedObject"/> | [_saved_search.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/saved_searches/legacy/_saved_search.ts#:~:text=SavedObject), [_saved_search.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/saved_searches/legacy/_saved_search.ts#:~:text=SavedObject) | - |
+| <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectsStart.SavedObjectClass" text="SavedObjectClass"/> | [_saved_search.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/saved_searches/legacy/_saved_search.ts#:~:text=SavedObjectClass) | - |
 | <DocLink id="kibUiActionsPluginApi" section="def-public.UiActionsService.executeTriggerActions" text="executeTriggerActions"/> | [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/saved_search_embeddable.tsx#:~:text=executeTriggerActions), [search_embeddable_factory.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/embeddable/search_embeddable_factory.ts#:~:text=executeTriggerActions), [plugin.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/plugin.tsx#:~:text=executeTriggerActions), [search_embeddable_factory.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/target/types/public/application/embeddable/search_embeddable_factory.d.ts#:~:text=executeTriggerActions) | - |
 | <DocLink id="kibCorePluginApi" section="def-public.UiSettingsParams.metric" text="metric"/> | [ui_settings.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/server/ui_settings.ts#:~:text=metric), [ui_settings.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/server/ui_settings.ts#:~:text=metric) | - |
 | <DocLink id="kibCorePluginApi" section="def-server.UiSettingsParams.metric" text="metric"/> | [ui_settings.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/server/ui_settings.ts#:~:text=metric), [ui_settings.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/server/ui_settings.ts#:~:text=metric) | - |
@@ -467,21 +472,14 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibDataPluginApi" section="def-public.IndexPatternsContract" text="IndexPatternsContract"/> | [resolved_log_source_configuration.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts#:~:text=IndexPatternsContract), [resolved_log_source_configuration.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts#:~:text=IndexPatternsContract), [resolved_log_source_configuration.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts#:~:text=IndexPatternsContract), [resolved_log_source_configuration.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts#:~:text=IndexPatternsContract), [log_source.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/containers/logs/log_source/log_source.ts#:~:text=IndexPatternsContract), [log_source.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/containers/logs/log_source/log_source.ts#:~:text=IndexPatternsContract), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts#:~:text=IndexPatternsContract), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts#:~:text=IndexPatternsContract), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts#:~:text=IndexPatternsContract), [index_patterns.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts#:~:text=IndexPatternsContract)+ 12 more | - |
-| <DocLink id="kibDataPluginApi" section="def-public.IndexPattern" text="IndexPattern"/> | [resolved_log_source_configuration.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts#:~:text=IndexPattern), [resolved_log_source_configuration.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts#:~:text=IndexPattern), [resolved_log_source_configuration.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts#:~:text=IndexPattern), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts#:~:text=IndexPattern), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts#:~:text=IndexPattern), [index_patterns.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts#:~:text=IndexPattern), [index_patterns.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts#:~:text=IndexPattern), [validation_errors.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts#:~:text=IndexPattern), [validation_errors.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts#:~:text=IndexPattern), [validation_errors.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts#:~:text=IndexPattern)+ 14 more | - |
-| <DocLink id="kibDataPluginApi" section="def-public.IIndexPattern" text="IIndexPattern"/> | [with_kuery_autocompletion.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/containers/with_kuery_autocompletion.tsx#:~:text=IIndexPattern), [with_kuery_autocompletion.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/containers/with_kuery_autocompletion.tsx#:~:text=IIndexPattern), [kuery_bar.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/kuery_bar.tsx#:~:text=IIndexPattern), [kuery_bar.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/kuery_bar.tsx#:~:text=IIndexPattern), [toolbar.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/toolbars/toolbar.tsx#:~:text=IIndexPattern), [toolbar.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/toolbars/toolbar.tsx#:~:text=IIndexPattern), [kuery.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/utils/kuery.ts#:~:text=IIndexPattern), [kuery.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/utils/kuery.ts#:~:text=IIndexPattern), [use_metrics_explorer_data.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_data.ts#:~:text=IIndexPattern), [use_metrics_explorer_data.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_data.ts#:~:text=IIndexPattern)+ 34 more | - |
 | <DocLink id="kibDataPluginApi" section="def-public.IFieldType" text="IFieldType"/> | [custom_metric_form.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/custom_metric_form.tsx#:~:text=IFieldType), [custom_metric_form.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/custom_metric_form.tsx#:~:text=IFieldType), [index.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/index.tsx#:~:text=IFieldType), [index.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/index.tsx#:~:text=IFieldType), [custom_field_panel.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/custom_field_panel.tsx#:~:text=IFieldType), [custom_field_panel.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/custom_field_panel.tsx#:~:text=IFieldType), [waffle_group_by_controls.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/waffle_group_by_controls.tsx#:~:text=IFieldType), [waffle_group_by_controls.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/waffle_group_by_controls.tsx#:~:text=IFieldType), [metric.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/alerting/inventory/components/metric.tsx#:~:text=IFieldType), [metric.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/alerting/inventory/components/metric.tsx#:~:text=IFieldType)+ 46 more | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-public.DataPublicPluginStart.indexPatterns" text="indexPatterns"/> | [editor.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/alerting/log_threshold/components/expression_editor/editor.tsx#:~:text=indexPatterns), [log_stream.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/components/log_stream/log_stream.tsx#:~:text=indexPatterns), [log_stream.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/components/log_stream/log_stream.tsx#:~:text=indexPatterns), [logs_overview_fetchers.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/utils/logs_overview_fetchers.ts#:~:text=indexPatterns), [redirect_to_node_logs.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/link_to/redirect_to_node_logs.tsx#:~:text=indexPatterns), [use_kibana_index_patterns.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/hooks/use_kibana_index_patterns.ts#:~:text=indexPatterns), [page_providers.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/logs/page_providers.tsx#:~:text=indexPatterns), [logs_overview_fetches.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/utils/logs_overview_fetches.test.ts#:~:text=indexPatterns) | - |
 | <DocLink id="kibDataPluginApi" section="def-public.esKuery" text="esKuery"/> | [kuery_bar.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/kuery_bar.tsx#:~:text=esKuery), [kuery_bar.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/kuery_bar.tsx#:~:text=esKuery), [kuery.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/utils/kuery.ts#:~:text=esKuery), [kuery.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/utils/kuery.ts#:~:text=esKuery), [kuery.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/utils/kuery.ts#:~:text=esKuery), [use_waffle_filters.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_waffle_filters.ts#:~:text=esKuery), [use_waffle_filters.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_waffle_filters.ts#:~:text=esKuery) | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-public.esQuery" text="esQuery"/> | [index.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/containers/logs/log_stream/index.ts#:~:text=esQuery), [index.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/containers/logs/log_stream/index.ts#:~:text=esQuery), [log_filter_state.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/containers/logs/log_filter/log_filter_state.ts#:~:text=esQuery), [log_filter_state.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/containers/logs/log_filter/log_filter_state.ts#:~:text=esQuery), [log_filter_state.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/containers/logs/log_filter/log_filter_state.ts#:~:text=esQuery) | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-public.Filter" text="Filter"/> | [log_stream_embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/components/log_stream/log_stream_embeddable.tsx#:~:text=Filter), [log_stream_embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/components/log_stream/log_stream_embeddable.tsx#:~:text=Filter), [use_dataset_filtering.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/logs/log_entry_rate/use_dataset_filtering.ts#:~:text=Filter), [use_dataset_filtering.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/logs/log_entry_rate/use_dataset_filtering.ts#:~:text=Filter), [use_dataset_filtering.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/logs/log_entry_rate/use_dataset_filtering.ts#:~:text=Filter) | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-common.IFieldType" text="IFieldType"/> | [custom_metric_form.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/custom_metric_form.tsx#:~:text=IFieldType), [custom_metric_form.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/custom_metric_form.tsx#:~:text=IFieldType), [index.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/index.tsx#:~:text=IFieldType), [index.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/index.tsx#:~:text=IFieldType), [custom_field_panel.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/custom_field_panel.tsx#:~:text=IFieldType), [custom_field_panel.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/custom_field_panel.tsx#:~:text=IFieldType), [waffle_group_by_controls.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/waffle_group_by_controls.tsx#:~:text=IFieldType), [waffle_group_by_controls.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/waffle_group_by_controls.tsx#:~:text=IFieldType), [metric.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/alerting/inventory/components/metric.tsx#:~:text=IFieldType), [metric.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/alerting/inventory/components/metric.tsx#:~:text=IFieldType)+ 102 more | 8.1 |
-| <DocLink id="kibDataPluginApi" section="def-common.IIndexPattern" text="IIndexPattern"/> | [with_kuery_autocompletion.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/containers/with_kuery_autocompletion.tsx#:~:text=IIndexPattern), [with_kuery_autocompletion.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/containers/with_kuery_autocompletion.tsx#:~:text=IIndexPattern), [kuery_bar.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/kuery_bar.tsx#:~:text=IIndexPattern), [kuery_bar.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/kuery_bar.tsx#:~:text=IIndexPattern), [toolbar.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/toolbars/toolbar.tsx#:~:text=IIndexPattern), [toolbar.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/toolbars/toolbar.tsx#:~:text=IIndexPattern), [kuery.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/utils/kuery.ts#:~:text=IIndexPattern), [kuery.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/utils/kuery.ts#:~:text=IIndexPattern), [use_metrics_explorer_data.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_data.ts#:~:text=IIndexPattern), [use_metrics_explorer_data.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_data.ts#:~:text=IIndexPattern)+ 78 more | - |
-| <DocLink id="kibDataPluginApi" section="def-common.IndexPatternsContract" text="IndexPatternsContract"/> | [resolved_log_source_configuration.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts#:~:text=IndexPatternsContract), [resolved_log_source_configuration.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts#:~:text=IndexPatternsContract), [resolved_log_source_configuration.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts#:~:text=IndexPatternsContract), [resolved_log_source_configuration.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts#:~:text=IndexPatternsContract), [log_source.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/containers/logs/log_source/log_source.ts#:~:text=IndexPatternsContract), [log_source.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/containers/logs/log_source/log_source.ts#:~:text=IndexPatternsContract), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts#:~:text=IndexPatternsContract), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts#:~:text=IndexPatternsContract), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts#:~:text=IndexPatternsContract), [index_patterns.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts#:~:text=IndexPatternsContract)+ 12 more | - |
-| <DocLink id="kibDataPluginApi" section="def-common.IndexPattern" text="IndexPattern"/> | [resolved_log_source_configuration.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts#:~:text=IndexPattern), [resolved_log_source_configuration.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts#:~:text=IndexPattern), [resolved_log_source_configuration.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts#:~:text=IndexPattern), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts#:~:text=IndexPattern), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts#:~:text=IndexPattern), [index_patterns.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts#:~:text=IndexPattern), [index_patterns.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts#:~:text=IndexPattern), [validation_errors.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts#:~:text=IndexPattern), [validation_errors.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts#:~:text=IndexPattern), [validation_errors.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts#:~:text=IndexPattern)+ 14 more | - |
 | <DocLink id="kibDataPluginApi" section="def-common.Filter" text="Filter"/> | [log_stream_embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/components/log_stream/log_stream_embeddable.tsx#:~:text=Filter), [log_stream_embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/components/log_stream/log_stream_embeddable.tsx#:~:text=Filter), [use_dataset_filtering.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/logs/log_entry_rate/use_dataset_filtering.ts#:~:text=Filter), [use_dataset_filtering.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/logs/log_entry_rate/use_dataset_filtering.ts#:~:text=Filter), [use_dataset_filtering.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/logs/log_entry_rate/use_dataset_filtering.ts#:~:text=Filter) | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-server.IFieldType" text="IFieldType"/> | [custom_metric_form.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/custom_metric_form.tsx#:~:text=IFieldType), [custom_metric_form.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/custom_metric_form.tsx#:~:text=IFieldType), [index.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/index.tsx#:~:text=IFieldType), [index.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/metric_control/index.tsx#:~:text=IFieldType), [custom_field_panel.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/custom_field_panel.tsx#:~:text=IFieldType), [custom_field_panel.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/custom_field_panel.tsx#:~:text=IFieldType), [waffle_group_by_controls.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/waffle_group_by_controls.tsx#:~:text=IFieldType), [waffle_group_by_controls.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/waffle_group_by_controls.tsx#:~:text=IFieldType), [metric.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/alerting/inventory/components/metric.tsx#:~:text=IFieldType), [metric.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/alerting/inventory/components/metric.tsx#:~:text=IFieldType)+ 46 more | 8.1 |
-| <DocLink id="kibDataPluginApi" section="def-server.IndexPattern" text="IndexPattern"/> | [resolved_log_source_configuration.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts#:~:text=IndexPattern), [resolved_log_source_configuration.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts#:~:text=IndexPattern), [resolved_log_source_configuration.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts#:~:text=IndexPattern), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts#:~:text=IndexPattern), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts#:~:text=IndexPattern), [index_patterns.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts#:~:text=IndexPattern), [index_patterns.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/target/types/common/dependency_mocks/index_patterns.d.ts#:~:text=IndexPattern), [validation_errors.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts#:~:text=IndexPattern), [validation_errors.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts#:~:text=IndexPattern), [validation_errors.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts#:~:text=IndexPattern)+ 2 more | - |
 | <DocLink id="kibDataPluginApi" section="def-server.Filter" text="Filter"/> | [log_stream_embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/components/log_stream/log_stream_embeddable.tsx#:~:text=Filter), [log_stream_embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/components/log_stream/log_stream_embeddable.tsx#:~:text=Filter), [use_dataset_filtering.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/logs/log_entry_rate/use_dataset_filtering.ts#:~:text=Filter), [use_dataset_filtering.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/logs/log_entry_rate/use_dataset_filtering.ts#:~:text=Filter), [use_dataset_filtering.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/logs/log_entry_rate/use_dataset_filtering.ts#:~:text=Filter) | 8.1 |
 | <DocLink id="kibDataViewsPluginApi" section="def-server.DataViewsServerPluginStart.indexPatternsServiceFactory" text="indexPatternsServiceFactory"/> | [kibana_framework_adapter.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/server/lib/adapters/framework/kibana_framework_adapter.ts#:~:text=indexPatternsServiceFactory), [log_entries_search_strategy.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/server/services/log_entries/log_entries_search_strategy.ts#:~:text=indexPatternsServiceFactory), [log_entry_search_strategy.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/server/services/log_entries/log_entry_search_strategy.ts#:~:text=indexPatternsServiceFactory) | - |
 | <DocLink id="kibSharePluginApi" section="def-public.LocatorPublic.getUrl" text="getUrl"/> | [module_list_card.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/components/logging/log_analysis_setup/setup_flyout/module_list_card.tsx#:~:text=getUrl) | - |
@@ -555,12 +553,14 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 | <DocLink id="kibDataPluginApi" section="def-common.IndexPatternField" text="IndexPatternField"/> | [field_stats.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/field_stats.ts#:~:text=IndexPatternField), [field_stats.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/field_stats.ts#:~:text=IndexPatternField), [field_stats.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/field_stats.ts#:~:text=IndexPatternField), [field_stats.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/field_stats.ts#:~:text=IndexPatternField), [field_stats.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/field_stats.ts#:~:text=IndexPatternField), [field_stats.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/target/types/server/routes/field_stats.d.ts#:~:text=IndexPatternField), [field_stats.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/target/types/server/routes/field_stats.d.ts#:~:text=IndexPatternField), [field_stats.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/target/types/server/routes/field_stats.d.ts#:~:text=IndexPatternField), [field_stats.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/target/types/server/routes/field_stats.d.ts#:~:text=IndexPatternField), [field_stats.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/field_stats.ts#:~:text=IndexPatternField)+ 8 more | - |
 | <DocLink id="kibDataPluginApi" section="def-common.IndexPatternsService" text="IndexPatternsService"/> | [existing_fields.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/existing_fields.ts#:~:text=IndexPatternsService), [existing_fields.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/existing_fields.ts#:~:text=IndexPatternsService), [existing_fields.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/existing_fields.ts#:~:text=IndexPatternsService), [existing_fields.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/existing_fields.ts#:~:text=IndexPatternsService) | - |
 | <DocLink id="kibDataPluginApi" section="def-common.IndexPatternsContract" text="IndexPatternsContract"/> | [embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/embeddable/embeddable.tsx#:~:text=IndexPatternsContract), [embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/embeddable/embeddable.tsx#:~:text=IndexPatternsContract), [utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/utils.ts#:~:text=IndexPatternsContract), [utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/utils.ts#:~:text=IndexPatternsContract), [loader.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts#:~:text=IndexPatternsContract), [loader.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts#:~:text=IndexPatternsContract), [embeddable_factory.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/embeddable/embeddable_factory.ts#:~:text=IndexPatternsContract), [embeddable_factory.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/embeddable/embeddable_factory.ts#:~:text=IndexPatternsContract), [loader.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts#:~:text=IndexPatternsContract), [loader.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts#:~:text=IndexPatternsContract)+ 20 more | - |
+| <DocLink id="kibDataPluginApi" section="def-common.DataViewsService.ensureDefaultDataView" text="ensureDefaultDataView"/> | [plugin.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/plugin.ts#:~:text=ensureDefaultDataView), [plugin.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/plugin.ts#:~:text=ensureDefaultDataView) | - |
 | <DocLink id="kibDataPluginApi" section="def-common.IndexPattern" text="IndexPattern"/> | [existing_fields.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/existing_fields.ts#:~:text=IndexPattern), [existing_fields.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/existing_fields.ts#:~:text=IndexPattern), [existing_fields.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/existing_fields.test.ts#:~:text=IndexPattern), [existing_fields.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/existing_fields.test.ts#:~:text=IndexPattern), [existing_fields.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/existing_fields.test.ts#:~:text=IndexPattern), [existing_fields.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/existing_fields.test.ts#:~:text=IndexPattern), [existing_fields.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/target/types/server/routes/existing_fields.d.ts#:~:text=IndexPattern), [existing_fields.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/target/types/server/routes/existing_fields.d.ts#:~:text=IndexPattern), [loader.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts#:~:text=IndexPattern), [embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/embeddable/embeddable.tsx#:~:text=IndexPattern)+ 36 more | - |
 | <DocLink id="kibDataPluginApi" section="def-common.Filter" text="Filter"/> | [types.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/types.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/types.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/types.ts#:~:text=Filter), [embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/embeddable/embeddable.tsx#:~:text=Filter), [embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/embeddable/embeddable.tsx#:~:text=Filter), [embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/embeddable/embeddable.tsx#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/state_management/types.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/state_management/types.ts#:~:text=Filter), [field_item.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/indexpattern_datasource/field_item.tsx#:~:text=Filter), [field_item.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/indexpattern_datasource/field_item.tsx#:~:text=Filter)+ 16 more | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-server.IndexPatternField" text="IndexPatternField"/> | [field_stats.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/field_stats.ts#:~:text=IndexPatternField), [field_stats.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/field_stats.ts#:~:text=IndexPatternField), [field_stats.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/field_stats.ts#:~:text=IndexPatternField), [field_stats.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/field_stats.ts#:~:text=IndexPatternField), [field_stats.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/field_stats.ts#:~:text=IndexPatternField), [field_stats.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/target/types/server/routes/field_stats.d.ts#:~:text=IndexPatternField), [field_stats.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/target/types/server/routes/field_stats.d.ts#:~:text=IndexPatternField), [field_stats.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/target/types/server/routes/field_stats.d.ts#:~:text=IndexPatternField), [field_stats.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/target/types/server/routes/field_stats.d.ts#:~:text=IndexPatternField) | - |
 | <DocLink id="kibDataPluginApi" section="def-server.IndexPattern" text="IndexPattern"/> | [existing_fields.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/existing_fields.ts#:~:text=IndexPattern), [existing_fields.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/existing_fields.ts#:~:text=IndexPattern), [existing_fields.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/existing_fields.test.ts#:~:text=IndexPattern), [existing_fields.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/existing_fields.test.ts#:~:text=IndexPattern), [existing_fields.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/existing_fields.test.ts#:~:text=IndexPattern), [existing_fields.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/existing_fields.test.ts#:~:text=IndexPattern), [existing_fields.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/target/types/server/routes/existing_fields.d.ts#:~:text=IndexPattern), [existing_fields.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/target/types/server/routes/existing_fields.d.ts#:~:text=IndexPattern), [loader.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts#:~:text=IndexPattern), [embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/embeddable/embeddable.tsx#:~:text=IndexPattern)+ 13 more | - |
 | <DocLink id="kibDataPluginApi" section="def-server.IndexPatternsService" text="IndexPatternsService"/> | [existing_fields.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/existing_fields.ts#:~:text=IndexPatternsService), [existing_fields.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/existing_fields.ts#:~:text=IndexPatternsService), [existing_fields.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/existing_fields.ts#:~:text=IndexPatternsService), [existing_fields.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/existing_fields.ts#:~:text=IndexPatternsService) | - |
 | <DocLink id="kibDataPluginApi" section="def-server.Filter" text="Filter"/> | [types.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/types.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/types.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/types.ts#:~:text=Filter), [embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/embeddable/embeddable.tsx#:~:text=Filter), [embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/embeddable/embeddable.tsx#:~:text=Filter), [embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/embeddable/embeddable.tsx#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/state_management/types.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/state_management/types.ts#:~:text=Filter), [field_item.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/indexpattern_datasource/field_item.tsx#:~:text=Filter), [field_item.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/indexpattern_datasource/field_item.tsx#:~:text=Filter)+ 16 more | 8.1 |
+| <DocLink id="kibDataViewsPluginApi" section="def-public.DataViewsService.ensureDefaultDataView" text="ensureDefaultDataView"/> | [plugin.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/plugin.ts#:~:text=ensureDefaultDataView) | - |
 | <DocLink id="kibDataViewsPluginApi" section="def-server.DataViewsServerPluginStart.indexPatternsServiceFactory" text="indexPatternsServiceFactory"/> | [existing_fields.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/existing_fields.ts#:~:text=indexPatternsServiceFactory), [field_stats.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/routes/field_stats.ts#:~:text=indexPatternsServiceFactory) | - |
 | <DocLink id="kibCorePluginApi" section="def-public.AppMountParameters.onAppLeave" text="onAppLeave"/> | [types.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/app_plugin/types.ts#:~:text=onAppLeave), [types.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/app_plugin/types.ts#:~:text=onAppLeave), [mounter.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/public/app_plugin/mounter.tsx#:~:text=onAppLeave) | - |
 | <DocLink id="kibCorePluginApi" section="def-server.SavedObjectsMigrationLogger.warning" text="warning"/> | [saved_object_migrations.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/migrations/saved_object_migrations.ts#:~:text=warning), [saved_object_migrations.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lens/server/migrations/saved_object_migrations.ts#:~:text=warning) | - |
@@ -625,23 +625,10 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibDataPluginApi" section="def-public.IndexPatternsContract" text="IndexPatternsContract"/> | [dependency_cache.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/dependency_cache.ts#:~:text=IndexPatternsContract), [dependency_cache.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/dependency_cache.ts#:~:text=IndexPatternsContract), [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IndexPatternsContract), [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IndexPatternsContract), [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IndexPatternsContract), [resolvers.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/routing/resolvers.ts#:~:text=IndexPatternsContract), [resolvers.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/routing/resolvers.ts#:~:text=IndexPatternsContract), [preconfigured_job_redirect.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts#:~:text=IndexPatternsContract), [preconfigured_job_redirect.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts#:~:text=IndexPatternsContract), [load_new_job_capabilities.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts#:~:text=IndexPatternsContract)+ 32 more | - |
-| <DocLink id="kibDataPluginApi" section="def-public.IndexPattern" text="IndexPattern"/> | [chart_loader.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts#:~:text=IndexPattern), [chart_loader.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts#:~:text=IndexPattern), [types.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/embeddables/types.ts#:~:text=IndexPattern), [types.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/embeddables/types.ts#:~:text=IndexPattern), [anomaly_charts_embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx#:~:text=IndexPattern), [anomaly_charts_embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx#:~:text=IndexPattern), [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IndexPattern), [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IndexPattern), [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IndexPattern), [field_format_service.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/services/field_format_service.ts#:~:text=IndexPattern)+ 130 more | - |
-| <DocLink id="kibDataPluginApi" section="def-public.IIndexPattern" text="IIndexPattern"/> | [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IIndexPattern), [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IIndexPattern), [new_job_capabilities_service_analytics.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service_analytics.ts#:~:text=IIndexPattern), [new_job_capabilities_service_analytics.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service_analytics.ts#:~:text=IIndexPattern), [data_recognizer.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/components/data_recognizer/data_recognizer.d.ts#:~:text=IIndexPattern), [data_recognizer.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/components/data_recognizer/data_recognizer.d.ts#:~:text=IIndexPattern), [new_job_capabilities_service.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service.ts#:~:text=IIndexPattern), [new_job_capabilities_service.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service.ts#:~:text=IIndexPattern), [load_new_job_capabilities.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts#:~:text=IIndexPattern), [load_new_job_capabilities.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts#:~:text=IIndexPattern)+ 24 more | - |
-| <DocLink id="kibDataPluginApi" section="def-public.IFieldType" text="IFieldType"/> | [common.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/components/data_grid/common.ts#:~:text=IFieldType), [common.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/components/data_grid/common.ts#:~:text=IFieldType), [field_types_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/field_types_utils.ts#:~:text=IFieldType), [field_types_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/field_types_utils.ts#:~:text=IFieldType), [field_types_utils.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/field_types_utils.test.ts#:~:text=IFieldType), [field_types_utils.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/field_types_utils.test.ts#:~:text=IFieldType), [field_types_utils.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/field_types_utils.test.ts#:~:text=IFieldType), [field_types_utils.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/field_types_utils.test.ts#:~:text=IFieldType), [field_types_utils.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/field_types_utils.test.ts#:~:text=IFieldType) | 8.1 |
-| <DocLink id="kibDataPluginApi" section="def-public.IndexPatternAttributes" text="IndexPatternAttributes"/> | [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IndexPatternAttributes), [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IndexPatternAttributes), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts#:~:text=IndexPatternAttributes), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts#:~:text=IndexPatternAttributes), [rollup.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts#:~:text=IndexPatternAttributes), [rollup.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts#:~:text=IndexPatternAttributes), [rollup.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts#:~:text=IndexPatternAttributes), [data_recognizer.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts#:~:text=IndexPatternAttributes), [data_recognizer.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts#:~:text=IndexPatternAttributes), [kibana.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/common/types/kibana.ts#:~:text=IndexPatternAttributes)+ 3 more | - |
 | <DocLink id="kibDataPluginApi" section="def-public.DataPublicPluginStart.indexPatterns" text="indexPatterns"/> | [index_data_visualizer.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/datavisualizer/index_based/index_data_visualizer.tsx#:~:text=indexPatterns), [file_datavisualizer.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/datavisualizer/file_based/file_datavisualizer.tsx#:~:text=indexPatterns), [app.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/app.tsx#:~:text=indexPatterns), [app.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/app.tsx#:~:text=indexPatterns), [import_jobs_flyout.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/components/import_export_jobs/import_jobs_flyout/import_jobs_flyout.tsx#:~:text=indexPatterns), [anomaly_charts_embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx#:~:text=indexPatterns) | - |
 | <DocLink id="kibDataPluginApi" section="def-public.DataPublicPluginStart.fieldFormats" text="fieldFormats"/> | [dependency_cache.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/dependency_cache.ts#:~:text=fieldFormats), [app.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/app.tsx#:~:text=fieldFormats), [dependency_cache.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/target/types/public/application/util/dependency_cache.d.ts#:~:text=fieldFormats) | - |
 | <DocLink id="kibDataPluginApi" section="def-public.Filter" text="Filter"/> | [apply_influencer_filters_action.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/ui_actions/apply_influencer_filters_action.tsx#:~:text=Filter), [apply_influencer_filters_action.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/ui_actions/apply_influencer_filters_action.tsx#:~:text=Filter), [apply_entity_filters_action.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/ui_actions/apply_entity_filters_action.tsx#:~:text=Filter), [apply_entity_filters_action.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/ui_actions/apply_entity_filters_action.tsx#:~:text=Filter) | 8.1 |
-| <DocLink id="kibDataPluginApi" section="def-common.IFieldType" text="IFieldType"/> | [common.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/components/data_grid/common.ts#:~:text=IFieldType), [common.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/components/data_grid/common.ts#:~:text=IFieldType), [field_types_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/field_types_utils.ts#:~:text=IFieldType), [field_types_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/field_types_utils.ts#:~:text=IFieldType), [field_types_utils.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/field_types_utils.test.ts#:~:text=IFieldType), [field_types_utils.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/field_types_utils.test.ts#:~:text=IFieldType), [field_types_utils.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/field_types_utils.test.ts#:~:text=IFieldType), [field_types_utils.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/field_types_utils.test.ts#:~:text=IFieldType), [field_types_utils.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/field_types_utils.test.ts#:~:text=IFieldType), [common.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/components/data_grid/common.ts#:~:text=IFieldType)+ 8 more | 8.1 |
-| <DocLink id="kibDataPluginApi" section="def-common.IIndexPattern" text="IIndexPattern"/> | [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IIndexPattern), [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IIndexPattern), [new_job_capabilities_service_analytics.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service_analytics.ts#:~:text=IIndexPattern), [new_job_capabilities_service_analytics.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service_analytics.ts#:~:text=IIndexPattern), [data_recognizer.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/components/data_recognizer/data_recognizer.d.ts#:~:text=IIndexPattern), [data_recognizer.d.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/components/data_recognizer/data_recognizer.d.ts#:~:text=IIndexPattern), [new_job_capabilities_service.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service.ts#:~:text=IIndexPattern), [new_job_capabilities_service.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/services/new_job_capabilities/new_job_capabilities_service.ts#:~:text=IIndexPattern), [load_new_job_capabilities.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts#:~:text=IIndexPattern), [load_new_job_capabilities.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts#:~:text=IIndexPattern)+ 58 more | - |
-| <DocLink id="kibDataPluginApi" section="def-common.IndexPatternAttributes" text="IndexPatternAttributes"/> | [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IndexPatternAttributes), [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IndexPatternAttributes), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts#:~:text=IndexPatternAttributes), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts#:~:text=IndexPatternAttributes), [rollup.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts#:~:text=IndexPatternAttributes), [rollup.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts#:~:text=IndexPatternAttributes), [rollup.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts#:~:text=IndexPatternAttributes), [data_recognizer.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts#:~:text=IndexPatternAttributes), [data_recognizer.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts#:~:text=IndexPatternAttributes), [kibana.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/common/types/kibana.ts#:~:text=IndexPatternAttributes)+ 16 more | - |
-| <DocLink id="kibDataPluginApi" section="def-common.IndexPatternsContract" text="IndexPatternsContract"/> | [dependency_cache.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/dependency_cache.ts#:~:text=IndexPatternsContract), [dependency_cache.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/dependency_cache.ts#:~:text=IndexPatternsContract), [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IndexPatternsContract), [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IndexPatternsContract), [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IndexPatternsContract), [resolvers.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/routing/resolvers.ts#:~:text=IndexPatternsContract), [resolvers.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/routing/resolvers.ts#:~:text=IndexPatternsContract), [preconfigured_job_redirect.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts#:~:text=IndexPatternsContract), [preconfigured_job_redirect.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts#:~:text=IndexPatternsContract), [load_new_job_capabilities.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/services/new_job_capabilities/load_new_job_capabilities.ts#:~:text=IndexPatternsContract)+ 32 more | - |
-| <DocLink id="kibDataPluginApi" section="def-common.IndexPattern" text="IndexPattern"/> | [chart_loader.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts#:~:text=IndexPattern), [chart_loader.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts#:~:text=IndexPattern), [types.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/embeddables/types.ts#:~:text=IndexPattern), [types.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/embeddables/types.ts#:~:text=IndexPattern), [anomaly_charts_embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx#:~:text=IndexPattern), [anomaly_charts_embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx#:~:text=IndexPattern), [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IndexPattern), [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IndexPattern), [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IndexPattern), [field_format_service.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/services/field_format_service.ts#:~:text=IndexPattern)+ 130 more | - |
 | <DocLink id="kibDataPluginApi" section="def-common.Filter" text="Filter"/> | [apply_influencer_filters_action.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/ui_actions/apply_influencer_filters_action.tsx#:~:text=Filter), [apply_influencer_filters_action.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/ui_actions/apply_influencer_filters_action.tsx#:~:text=Filter), [apply_entity_filters_action.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/ui_actions/apply_entity_filters_action.tsx#:~:text=Filter), [apply_entity_filters_action.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/ui_actions/apply_entity_filters_action.tsx#:~:text=Filter) | 8.1 |
-| <DocLink id="kibDataPluginApi" section="def-server.IFieldType" text="IFieldType"/> | [common.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/components/data_grid/common.ts#:~:text=IFieldType), [common.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/components/data_grid/common.ts#:~:text=IFieldType), [field_types_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/field_types_utils.ts#:~:text=IFieldType), [field_types_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/field_types_utils.ts#:~:text=IFieldType), [field_types_utils.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/field_types_utils.test.ts#:~:text=IFieldType), [field_types_utils.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/field_types_utils.test.ts#:~:text=IFieldType), [field_types_utils.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/field_types_utils.test.ts#:~:text=IFieldType), [field_types_utils.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/field_types_utils.test.ts#:~:text=IFieldType), [field_types_utils.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/field_types_utils.test.ts#:~:text=IFieldType) | 8.1 |
-| <DocLink id="kibDataPluginApi" section="def-server.IndexPatternAttributes" text="IndexPatternAttributes"/> | [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IndexPatternAttributes), [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IndexPatternAttributes), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts#:~:text=IndexPatternAttributes), [index_patterns.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts#:~:text=IndexPatternAttributes), [rollup.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts#:~:text=IndexPatternAttributes), [rollup.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts#:~:text=IndexPatternAttributes), [rollup.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts#:~:text=IndexPatternAttributes), [data_recognizer.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts#:~:text=IndexPatternAttributes), [data_recognizer.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts#:~:text=IndexPatternAttributes), [kibana.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/common/types/kibana.ts#:~:text=IndexPatternAttributes)+ 3 more | - |
-| <DocLink id="kibDataPluginApi" section="def-server.IndexPattern" text="IndexPattern"/> | [chart_loader.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts#:~:text=IndexPattern), [chart_loader.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts#:~:text=IndexPattern), [types.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/embeddables/types.ts#:~:text=IndexPattern), [types.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/embeddables/types.ts#:~:text=IndexPattern), [anomaly_charts_embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx#:~:text=IndexPattern), [anomaly_charts_embeddable.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx#:~:text=IndexPattern), [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IndexPattern), [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IndexPattern), [index_utils.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=IndexPattern), [field_format_service.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/services/field_format_service.ts#:~:text=IndexPattern)+ 60 more | - |
 | <DocLink id="kibDataPluginApi" section="def-server.Filter" text="Filter"/> | [apply_influencer_filters_action.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/ui_actions/apply_influencer_filters_action.tsx#:~:text=Filter), [apply_influencer_filters_action.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/ui_actions/apply_influencer_filters_action.tsx#:~:text=Filter), [apply_entity_filters_action.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/ui_actions/apply_entity_filters_action.tsx#:~:text=Filter), [apply_entity_filters_action.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/ui_actions/apply_entity_filters_action.tsx#:~:text=Filter) | 8.1 |
 | <DocLink id="kibSharePluginApi" section="def-public.LocatorPublic.getUrl" text="getUrl"/> | [use_create_url.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/contexts/kibana/use_create_url.ts#:~:text=getUrl), [use_create_url.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/contexts/kibana/use_create_url.ts#:~:text=getUrl), [main_tabs.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/components/navigation_menu/main_tabs.tsx#:~:text=getUrl), [anomaly_detection_panel.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/anomaly_detection_panel.tsx#:~:text=getUrl), [anomaly_detection_panel.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/anomaly_detection_panel.tsx#:~:text=getUrl), [use_view_action.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_view/use_view_action.tsx#:~:text=getUrl), [use_map_action.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_map/use_map_action.tsx#:~:text=getUrl), [analytics_panel.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/overview/components/analytics_panel/analytics_panel.tsx#:~:text=getUrl), [page.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx#:~:text=getUrl), [page.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/jobs/new_job/recognize/page.tsx#:~:text=getUrl)+ 14 more | - |
 | <DocLink id="kibSharePluginApi" section="def-common.LocatorPublic.getUrl" text="getUrl"/> | [use_create_url.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/contexts/kibana/use_create_url.ts#:~:text=getUrl), [use_create_url.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/contexts/kibana/use_create_url.ts#:~:text=getUrl), [main_tabs.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/components/navigation_menu/main_tabs.tsx#:~:text=getUrl), [anomaly_detection_panel.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/anomaly_detection_panel.tsx#:~:text=getUrl), [anomaly_detection_panel.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/anomaly_detection_panel.tsx#:~:text=getUrl), [use_view_action.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_view/use_view_action.tsx#:~:text=getUrl), [use_map_action.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_map/use_map_action.tsx#:~:text=getUrl), [analytics_panel.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/overview/components/analytics_panel/analytics_panel.tsx#:~:text=getUrl), [page.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx#:~:text=getUrl), [page.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/ml/public/application/jobs/new_job/recognize/page.tsx#:~:text=getUrl)+ 14 more | - |
@@ -979,7 +966,6 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 | <DocLink id="kibDataPluginApi" section="def-common.AggConfig.toJSON" text="toJSON"/> | [reducers.ts](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/sidebar/state/reducers.ts#:~:text=toJSON), [reducers.ts](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/sidebar/state/reducers.ts#:~:text=toJSON), [reducers.ts](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/sidebar/state/reducers.ts#:~:text=toJSON), [sidebar.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/sidebar/sidebar.tsx#:~:text=toJSON) | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-server.IndexPatternField" text="IndexPatternField"/> | [agg_type_field_filters.ts](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/agg_filters/agg_type_field_filters.ts#:~:text=IndexPatternField), [agg_type_field_filters.ts](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/agg_filters/agg_type_field_filters.ts#:~:text=IndexPatternField), [agg_type_field_filters.ts](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/agg_filters/agg_type_field_filters.ts#:~:text=IndexPatternField), [agg_param_props.ts](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/agg_param_props.ts#:~:text=IndexPatternField), [agg_param_props.ts](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/agg_param_props.ts#:~:text=IndexPatternField), [field.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/controls/field.tsx#:~:text=IndexPatternField), [field.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/controls/field.tsx#:~:text=IndexPatternField), [field.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/controls/field.tsx#:~:text=IndexPatternField), [field.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/controls/field.tsx#:~:text=IndexPatternField), [top_field.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/controls/top_field.tsx#:~:text=IndexPatternField)+ 14 more | - |
 | <DocLink id="kibDataPluginApi" section="def-server.IndexPattern" text="IndexPattern"/> | [agg_type_filters.ts](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/agg_filters/agg_type_filters.ts#:~:text=IndexPattern), [agg_type_filters.ts](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/agg_filters/agg_type_filters.ts#:~:text=IndexPattern), [agg_type_filters.ts](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/agg_filters/agg_type_filters.ts#:~:text=IndexPattern), [editor_config.ts](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/utils/editor_config.ts#:~:text=IndexPattern), [editor_config.ts](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/utils/editor_config.ts#:~:text=IndexPattern), [agg_params_helper.ts](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/agg_params_helper.ts#:~:text=IndexPattern), [agg_params_helper.ts](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/agg_params_helper.ts#:~:text=IndexPattern), [agg_select.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/agg_select.tsx#:~:text=IndexPattern), [agg_select.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/agg_select.tsx#:~:text=IndexPattern), [agg_params.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/agg_params.tsx#:~:text=IndexPattern)+ 7 more | - |
-| <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObject" text="SavedObject"/> | [sidebar_title.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/sidebar/sidebar_title.tsx#:~:text=SavedObject), [sidebar_title.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/sidebar/sidebar_title.tsx#:~:text=SavedObject), [sidebar_title.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/sidebar/sidebar_title.tsx#:~:text=SavedObject), [sidebar.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/sidebar/sidebar.tsx#:~:text=SavedObject), [sidebar.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/public/components/sidebar/sidebar.tsx#:~:text=SavedObject), [sidebar.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/target/types/public/components/sidebar/sidebar.d.ts#:~:text=SavedObject), [sidebar.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/target/types/public/components/sidebar/sidebar.d.ts#:~:text=SavedObject), [sidebar_title.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/target/types/public/components/sidebar/sidebar_title.d.ts#:~:text=SavedObject), [sidebar_title.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/target/types/public/components/sidebar/sidebar_title.d.ts#:~:text=SavedObject), [sidebar_title.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/vis_default_editor/target/types/public/components/sidebar/sidebar_title.d.ts#:~:text=SavedObject) | - |
 
 
 
@@ -1100,7 +1086,8 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 | <DocLink id="kibDataPluginApi" section="def-common.AggConfig.toJSON" text="toJSON"/> | [vis.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/vis.ts#:~:text=toJSON) | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-server.IndexPattern" text="IndexPattern"/> | [vis.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/vis.ts#:~:text=IndexPattern), [vis.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/vis.ts#:~:text=IndexPattern), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/vis_types/types.ts#:~:text=IndexPattern), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/vis_types/types.ts#:~:text=IndexPattern), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/vis_types/types.ts#:~:text=IndexPattern), [create_vis_embeddable_from_object.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/embeddable/create_vis_embeddable_from_object.ts#:~:text=IndexPattern), [create_vis_embeddable_from_object.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/embeddable/create_vis_embeddable_from_object.ts#:~:text=IndexPattern), [visualize_embeddable.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/embeddable/visualize_embeddable.ts#:~:text=IndexPattern), [visualize_embeddable.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/embeddable/visualize_embeddable.ts#:~:text=IndexPattern), [visualize_embeddable.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/embeddable/visualize_embeddable.ts#:~:text=IndexPattern) | - |
 | <DocLink id="kibDataPluginApi" section="def-server.Filter" text="Filter"/> | [visualize_embeddable.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/embeddable/visualize_embeddable.ts#:~:text=Filter), [visualize_embeddable.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/embeddable/visualize_embeddable.ts#:~:text=Filter), [visualize_embeddable.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/embeddable/visualize_embeddable.ts#:~:text=Filter) | 8.1 |
-| <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectLoader" text="SavedObjectLoader"/> | [find_list_items.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/saved_visualizations/find_list_items.ts#:~:text=SavedObjectLoader), [find_list_items.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/saved_visualizations/find_list_items.ts#:~:text=SavedObjectLoader), [saved_visualizations.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/saved_visualizations/saved_visualizations.ts#:~:text=SavedObjectLoader), [saved_visualizations.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/saved_visualizations/saved_visualizations.ts#:~:text=SavedObjectLoader), [saved_visualizations.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/saved_visualizations/saved_visualizations.ts#:~:text=SavedObjectLoader), [services.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/services.ts#:~:text=SavedObjectLoader), [services.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/services.ts#:~:text=SavedObjectLoader) | - |
+| <DocLink id="kibDiscoverPluginApi" section="def-public.__LEGACY" text="__LEGACY"/> | [_saved_vis.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/saved_visualizations/_saved_vis.ts#:~:text=__LEGACY), [_saved_vis.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/saved_visualizations/_saved_vis.ts#:~:text=__LEGACY) | - |
+| <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectLoader" text="SavedObjectLoader"/> | [find_list_items.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/saved_visualizations/find_list_items.ts#:~:text=SavedObjectLoader), [find_list_items.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/saved_visualizations/find_list_items.ts#:~:text=SavedObjectLoader), [saved_visualizations.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/saved_visualizations/saved_visualizations.ts#:~:text=SavedObjectLoader), [saved_visualizations.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/saved_visualizations/saved_visualizations.ts#:~:text=SavedObjectLoader), [saved_visualizations.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/saved_visualizations/saved_visualizations.ts#:~:text=SavedObjectLoader) | - |
 | <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObject" text="SavedObject"/> | [_saved_vis.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/saved_visualizations/_saved_vis.ts#:~:text=SavedObject), [_saved_vis.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/saved_visualizations/_saved_vis.ts#:~:text=SavedObject), [_saved_vis.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/saved_visualizations/_saved_vis.ts#:~:text=SavedObject), [_saved_vis.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/saved_visualizations/_saved_vis.ts#:~:text=SavedObject) | - |
 | <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectsStart.SavedObjectClass" text="SavedObjectClass"/> | [_saved_vis.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualizations/public/saved_visualizations/_saved_vis.ts#:~:text=SavedObjectClass) | - |
 
@@ -1114,12 +1101,13 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 | <DocLink id="kibDataPluginApi" section="def-public.DataPublicPluginStart.indexPatterns" text="indexPatterns"/> | [visualize_top_nav.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/components/visualize_top_nav.tsx#:~:text=indexPatterns), [visualize_top_nav.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/components/visualize_top_nav.tsx#:~:text=indexPatterns), [plugin.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/plugin.ts#:~:text=indexPatterns), [plugin.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/plugin.ts#:~:text=indexPatterns) | - |
 | <DocLink id="kibDataPluginApi" section="def-public.esFilters" text="esFilters"/> | [use_visualize_app_state.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/utils/use/use_visualize_app_state.tsx#:~:text=esFilters), [use_visualize_app_state.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/utils/use/use_visualize_app_state.tsx#:~:text=esFilters), [plugin.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/plugin.ts#:~:text=esFilters), [plugin.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/plugin.ts#:~:text=esFilters), [get_visualize_list_item_link.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/utils/get_visualize_list_item_link.test.ts#:~:text=esFilters), [get_visualize_list_item_link.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/utils/get_visualize_list_item_link.test.ts#:~:text=esFilters) | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-public.Filter" text="Filter"/> | [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/types.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/types.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/types.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/types.ts#:~:text=Filter), [utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/utils/utils.ts#:~:text=Filter), [utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/utils/utils.ts#:~:text=Filter), [use_linked_search_updates.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/utils/use/use_linked_search_updates.ts#:~:text=Filter), [use_linked_search_updates.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/utils/use/use_linked_search_updates.ts#:~:text=Filter), [types.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/target/types/public/application/types.d.ts#:~:text=Filter), [types.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/target/types/public/application/types.d.ts#:~:text=Filter)+ 6 more | 8.1 |
+| <DocLink id="kibDataPluginApi" section="def-common.DataViewsService.ensureDefaultDataView" text="ensureDefaultDataView"/> | [plugin.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/plugin.ts#:~:text=ensureDefaultDataView), [plugin.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/plugin.ts#:~:text=ensureDefaultDataView) | - |
 | <DocLink id="kibDataPluginApi" section="def-common.IndexPattern" text="IndexPattern"/> | [visualize_top_nav.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/components/visualize_top_nav.tsx#:~:text=IndexPattern), [visualize_top_nav.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/components/visualize_top_nav.tsx#:~:text=IndexPattern), [visualize_top_nav.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/components/visualize_top_nav.tsx#:~:text=IndexPattern), [visualize_top_nav.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/components/visualize_top_nav.tsx#:~:text=IndexPattern), [visualize_top_nav.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/components/visualize_top_nav.tsx#:~:text=IndexPattern), [visualize_top_nav.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/components/visualize_top_nav.tsx#:~:text=IndexPattern) | - |
 | <DocLink id="kibDataPluginApi" section="def-common.isFilterPinned" text="isFilterPinned"/> | [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/common/locator.ts#:~:text=isFilterPinned), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/common/locator.ts#:~:text=isFilterPinned), [locator.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/common/locator.ts#:~:text=isFilterPinned) | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-common.Filter" text="Filter"/> | [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/types.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/types.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/types.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/types.ts#:~:text=Filter), [utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/utils/utils.ts#:~:text=Filter), [utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/utils/utils.ts#:~:text=Filter), [use_linked_search_updates.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/utils/use/use_linked_search_updates.ts#:~:text=Filter), [use_linked_search_updates.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/utils/use/use_linked_search_updates.ts#:~:text=Filter), [types.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/target/types/public/application/types.d.ts#:~:text=Filter), [types.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/target/types/public/application/types.d.ts#:~:text=Filter)+ 6 more | 8.1 |
 | <DocLink id="kibDataPluginApi" section="def-server.IndexPattern" text="IndexPattern"/> | [visualize_top_nav.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/components/visualize_top_nav.tsx#:~:text=IndexPattern), [visualize_top_nav.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/components/visualize_top_nav.tsx#:~:text=IndexPattern), [visualize_top_nav.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/components/visualize_top_nav.tsx#:~:text=IndexPattern) | - |
 | <DocLink id="kibDataPluginApi" section="def-server.Filter" text="Filter"/> | [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/types.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/types.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/types.ts#:~:text=Filter), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/types.ts#:~:text=Filter), [utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/utils/utils.ts#:~:text=Filter), [utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/utils/utils.ts#:~:text=Filter), [use_linked_search_updates.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/utils/use/use_linked_search_updates.ts#:~:text=Filter), [use_linked_search_updates.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/utils/use/use_linked_search_updates.ts#:~:text=Filter), [types.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/target/types/public/application/types.d.ts#:~:text=Filter), [types.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/target/types/public/application/types.d.ts#:~:text=Filter)+ 6 more | 8.1 |
-| <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObject" text="SavedObject"/> | [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/types.ts#:~:text=SavedObject), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/types.ts#:~:text=SavedObject), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/types.ts#:~:text=SavedObject), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/types.ts#:~:text=SavedObject), [get_visualization_instance.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/utils/get_visualization_instance.ts#:~:text=SavedObject), [get_visualization_instance.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/utils/get_visualization_instance.ts#:~:text=SavedObject), [types.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/target/types/public/application/types.d.ts#:~:text=SavedObject), [types.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/target/types/public/application/types.d.ts#:~:text=SavedObject), [types.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/target/types/public/application/types.d.ts#:~:text=SavedObject), [types.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/target/types/public/application/types.d.ts#:~:text=SavedObject)+ 3 more | - |
+| <DocLink id="kibDataViewsPluginApi" section="def-public.DataViewsService.ensureDefaultDataView" text="ensureDefaultDataView"/> | [plugin.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/plugin.ts#:~:text=ensureDefaultDataView) | - |
 | <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectsStart.settings" text="settings"/> | [visualize_listing.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/components/visualize_listing.tsx#:~:text=settings), [visualize_listing.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/components/visualize_listing.tsx#:~:text=settings) | - |
 | <DocLink id="kibCorePluginApi" section="def-public.AppMountParameters.onAppLeave" text="onAppLeave"/> | [visualize_top_nav.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/components/visualize_top_nav.tsx#:~:text=onAppLeave), [visualize_editor_common.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/components/visualize_editor_common.tsx#:~:text=onAppLeave), [app.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/app.tsx#:~:text=onAppLeave), [index.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/public/application/index.tsx#:~:text=onAppLeave), [app.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/target/types/public/application/app.d.ts#:~:text=onAppLeave), [index.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/target/types/public/application/index.d.ts#:~:text=onAppLeave), [visualize_editor_common.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/target/types/public/application/components/visualize_editor_common.d.ts#:~:text=onAppLeave), [visualize_top_nav.d.ts](https://github.com/elastic/kibana/tree/master/src/plugins/visualize/target/types/public/application/components/visualize_top_nav.d.ts#:~:text=onAppLeave) | - |
 
diff --git a/api_docs/discover.json b/api_docs/discover.json
index bab87863a903b0..2e8dd6a450e7ad 100644
--- a/api_docs/discover.json
+++ b/api_docs/discover.json
@@ -5,35 +5,157 @@
     "functions": [
       {
         "parentPluginId": "discover",
-        "id": "def-public.createSavedSearchesLoader",
+        "id": "def-public.getSavedSearch",
         "type": "Function",
         "tags": [],
-        "label": "createSavedSearchesLoader",
+        "label": "getSavedSearch",
         "description": [],
         "signature": [
-          "({ savedObjectsClient, savedObjects }: Services) => ",
+          "(savedSearchId: string | undefined, dependencies: GetSavedSearchDependencies) => Promise<",
           {
-            "pluginId": "savedObjects",
+            "pluginId": "discover",
             "scope": "public",
-            "docId": "kibSavedObjectsPluginApi",
-            "section": "def-public.SavedObjectLoader",
-            "text": "SavedObjectLoader"
+            "docId": "kibDiscoverPluginApi",
+            "section": "def-public.SavedSearch",
+            "text": "SavedSearch"
+          },
+          ">"
+        ],
+        "path": "src/plugins/discover/public/saved_searches/get_saved_searches.ts",
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.getSavedSearch.$1",
+            "type": "string",
+            "tags": [],
+            "label": "savedSearchId",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "src/plugins/discover/public/saved_searches/get_saved_searches.ts",
+            "deprecated": false,
+            "isRequired": false
+          },
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.getSavedSearch.$2",
+            "type": "Object",
+            "tags": [],
+            "label": "dependencies",
+            "description": [],
+            "signature": [
+              "GetSavedSearchDependencies"
+            ],
+            "path": "src/plugins/discover/public/saved_searches/get_saved_searches.ts",
+            "deprecated": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "discover",
+        "id": "def-public.getSavedSearchFullPathUrl",
+        "type": "Function",
+        "tags": [],
+        "label": "getSavedSearchFullPathUrl",
+        "description": [],
+        "signature": [
+          "(id?: string | undefined) => string"
+        ],
+        "path": "src/plugins/discover/public/saved_searches/saved_searches_utils.ts",
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.getSavedSearchFullPathUrl.$1",
+            "type": "string",
+            "tags": [],
+            "label": "id",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "src/plugins/discover/public/saved_searches/saved_searches_utils.ts",
+            "deprecated": false,
+            "isRequired": false
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "discover",
+        "id": "def-public.getSavedSearchUrl",
+        "type": "Function",
+        "tags": [],
+        "label": "getSavedSearchUrl",
+        "description": [],
+        "signature": [
+          "(id?: string | undefined) => string"
+        ],
+        "path": "src/plugins/discover/public/saved_searches/saved_searches_utils.ts",
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.getSavedSearchUrl.$1",
+            "type": "string",
+            "tags": [],
+            "label": "id",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "src/plugins/discover/public/saved_searches/saved_searches_utils.ts",
+            "deprecated": false,
+            "isRequired": false
           }
         ],
-        "path": "src/plugins/discover/public/saved_searches/saved_searches.ts",
+        "returnComment": [],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "discover",
+        "id": "def-public.getSavedSearchUrlConflictMessage",
+        "type": "Function",
+        "tags": [],
+        "label": "getSavedSearchUrlConflictMessage",
+        "description": [],
+        "signature": [
+          "(savedSearch: ",
+          {
+            "pluginId": "discover",
+            "scope": "public",
+            "docId": "kibDiscoverPluginApi",
+            "section": "def-public.SavedSearch",
+            "text": "SavedSearch"
+          },
+          ") => Promise<string>"
+        ],
+        "path": "src/plugins/discover/public/saved_searches/saved_searches_utils.ts",
         "deprecated": false,
         "children": [
           {
             "parentPluginId": "discover",
-            "id": "def-public.createSavedSearchesLoader.$1",
+            "id": "def-public.getSavedSearchUrlConflictMessage.$1",
             "type": "Object",
             "tags": [],
-            "label": "{ savedObjectsClient, savedObjects }",
+            "label": "savedSearch",
             "description": [],
             "signature": [
-              "Services"
+              {
+                "pluginId": "discover",
+                "scope": "public",
+                "docId": "kibDiscoverPluginApi",
+                "section": "def-public.SavedSearch",
+                "text": "SavedSearch"
+              }
             ],
-            "path": "src/plugins/discover/public/saved_searches/saved_searches.ts",
+            "path": "src/plugins/discover/public/saved_searches/saved_searches_utils.ts",
             "deprecated": false,
             "isRequired": true
           }
@@ -58,6 +180,51 @@
         "children": [],
         "returnComment": [],
         "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "discover",
+        "id": "def-public.throwErrorOnSavedSearchUrlConflict",
+        "type": "Function",
+        "tags": [],
+        "label": "throwErrorOnSavedSearchUrlConflict",
+        "description": [],
+        "signature": [
+          "(savedSearch: ",
+          {
+            "pluginId": "discover",
+            "scope": "public",
+            "docId": "kibDiscoverPluginApi",
+            "section": "def-public.SavedSearch",
+            "text": "SavedSearch"
+          },
+          ") => Promise<void>"
+        ],
+        "path": "src/plugins/discover/public/saved_searches/saved_searches_utils.ts",
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.throwErrorOnSavedSearchUrlConflict.$1",
+            "type": "Object",
+            "tags": [],
+            "label": "savedSearch",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "discover",
+                "scope": "public",
+                "docId": "kibDiscoverPluginApi",
+                "section": "def-public.SavedSearch",
+                "text": "SavedSearch"
+              }
+            ],
+            "path": "src/plugins/discover/public/saved_searches/saved_searches_utils.ts",
+            "deprecated": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
       }
     ],
     "interfaces": [
@@ -602,181 +769,341 @@
       },
       {
         "parentPluginId": "discover",
-        "id": "def-public.SavedSearch",
+        "id": "def-public.LegacySavedSearch",
         "type": "Interface",
-        "tags": [],
-        "label": "SavedSearch",
+        "tags": [
+          "deprecated"
+        ],
+        "label": "LegacySavedSearch",
         "description": [],
-        "path": "src/plugins/discover/public/saved_searches/types.ts",
-        "deprecated": false,
+        "path": "src/plugins/discover/public/saved_searches/legacy/types.ts",
+        "deprecated": true,
+        "references": [],
         "children": [
           {
             "parentPluginId": "discover",
-            "id": "def-public.SavedSearch.id",
+            "id": "def-public.LegacySavedSearch.id",
             "type": "string",
             "tags": [],
             "label": "id",
             "description": [],
-            "path": "src/plugins/discover/public/saved_searches/types.ts",
+            "path": "src/plugins/discover/public/saved_searches/legacy/types.ts",
             "deprecated": false
           },
           {
             "parentPluginId": "discover",
-            "id": "def-public.SavedSearch.title",
+            "id": "def-public.LegacySavedSearch.title",
             "type": "string",
             "tags": [],
             "label": "title",
             "description": [],
-            "path": "src/plugins/discover/public/saved_searches/types.ts",
+            "path": "src/plugins/discover/public/saved_searches/legacy/types.ts",
             "deprecated": false
           },
           {
             "parentPluginId": "discover",
-            "id": "def-public.SavedSearch.searchSource",
+            "id": "def-public.LegacySavedSearch.searchSource",
             "type": "Object",
             "tags": [],
             "label": "searchSource",
             "description": [],
             "signature": [
+              "{ create: () => ",
               {
                 "pluginId": "data",
                 "scope": "common",
                 "docId": "kibDataSearchPluginApi",
                 "section": "def-common.SearchSource",
                 "text": "SearchSource"
-              }
-            ],
-            "path": "src/plugins/discover/public/saved_searches/types.ts",
-            "deprecated": false
-          },
-          {
-            "parentPluginId": "discover",
-            "id": "def-public.SavedSearch.description",
-            "type": "string",
-            "tags": [],
-            "label": "description",
-            "description": [],
-            "signature": [
-              "string | undefined"
-            ],
-            "path": "src/plugins/discover/public/saved_searches/types.ts",
-            "deprecated": false
-          },
-          {
-            "parentPluginId": "discover",
-            "id": "def-public.SavedSearch.columns",
-            "type": "Array",
-            "tags": [],
-            "label": "columns",
-            "description": [],
-            "signature": [
-              "string[]"
-            ],
-            "path": "src/plugins/discover/public/saved_searches/types.ts",
-            "deprecated": false
-          },
-          {
-            "parentPluginId": "discover",
-            "id": "def-public.SavedSearch.sort",
-            "type": "Array",
-            "tags": [],
-            "label": "sort",
-            "description": [],
-            "signature": [
-              "SortOrder",
-              "[]"
-            ],
-            "path": "src/plugins/discover/public/saved_searches/types.ts",
-            "deprecated": false
-          },
-          {
-            "parentPluginId": "discover",
-            "id": "def-public.SavedSearch.grid",
-            "type": "Object",
-            "tags": [],
-            "label": "grid",
-            "description": [],
-            "signature": [
-              "DiscoverGridSettings"
-            ],
-            "path": "src/plugins/discover/public/saved_searches/types.ts",
-            "deprecated": false
-          },
-          {
-            "parentPluginId": "discover",
-            "id": "def-public.SavedSearch.destroy",
-            "type": "Function",
-            "tags": [],
-            "label": "destroy",
-            "description": [],
-            "signature": [
-              "() => void"
-            ],
-            "path": "src/plugins/discover/public/saved_searches/types.ts",
-            "deprecated": false,
-            "children": [],
-            "returnComment": []
-          },
-          {
-            "parentPluginId": "discover",
-            "id": "def-public.SavedSearch.save",
-            "type": "Function",
-            "tags": [],
-            "label": "save",
-            "description": [],
-            "signature": [
-              "(saveOptions: ",
+              },
+              "; history: Record<string, any>[]; setPreferredSearchStrategyId: (searchStrategyId: string) => void; setField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, value: ",
               {
-                "pluginId": "savedObjects",
-                "scope": "public",
-                "docId": "kibSavedObjectsPluginApi",
-                "section": "def-public.SavedObjectSaveOpts",
-                "text": "SavedObjectSaveOpts"
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSourceFields",
+                "text": "SearchSourceFields"
               },
-              ") => Promise<string>"
-            ],
-            "path": "src/plugins/discover/public/saved_searches/types.ts",
-            "deprecated": false,
-            "children": [
+              "[K]) => ",
               {
-                "parentPluginId": "discover",
-                "id": "def-public.SavedSearch.save.$1",
-                "type": "Object",
-                "tags": [],
-                "label": "saveOptions",
-                "description": [],
-                "signature": [
-                  {
-                    "pluginId": "savedObjects",
-                    "scope": "public",
-                    "docId": "kibSavedObjectsPluginApi",
-                    "section": "def-public.SavedObjectSaveOpts",
-                    "text": "SavedObjectSaveOpts"
-                  }
-                ],
-                "path": "src/plugins/discover/public/saved_searches/types.ts",
-                "deprecated": false,
-                "isRequired": true
-              }
-            ],
-            "returnComment": []
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSource",
+                "text": "SearchSource"
+              },
+              "; removeField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSource",
+                "text": "SearchSource"
+              },
+              "; setFields: (newFields: ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSourceFields",
+                "text": "SearchSourceFields"
+              },
+              ") => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSource",
+                "text": "SearchSource"
+              },
+              "; getId: () => string; getFields: () => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSourceFields",
+                "text": "SearchSourceFields"
+              },
+              "; getField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, recurse?: boolean) => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSourceFields",
+                "text": "SearchSourceFields"
+              },
+              "[K]; getOwnField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSourceFields",
+                "text": "SearchSourceFields"
+              },
+              "[K]; createCopy: () => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSource",
+                "text": "SearchSource"
+              },
+              "; createChild: (options?: {}) => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSource",
+                "text": "SearchSource"
+              },
+              "; setParent: (parent?: Pick<",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSource",
+                "text": "SearchSource"
+              },
+              ", \"create\" | \"history\" | \"setPreferredSearchStrategyId\" | \"setField\" | \"removeField\" | \"setFields\" | \"getId\" | \"getFields\" | \"getField\" | \"getOwnField\" | \"createCopy\" | \"createChild\" | \"setParent\" | \"getParent\" | \"fetch$\" | \"fetch\" | \"onRequestStart\" | \"getSearchRequestBody\" | \"destroy\" | \"getSerializedFields\" | \"serialize\"> | undefined, options?: ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSourceOptions",
+                "text": "SearchSourceOptions"
+              },
+              ") => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSource",
+                "text": "SearchSource"
+              },
+              "; getParent: () => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSource",
+                "text": "SearchSource"
+              },
+              " | undefined; fetch$: (options?: ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.ISearchOptions",
+                "text": "ISearchOptions"
+              },
+              ") => ",
+              "Observable",
+              "<",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.IKibanaSearchResponse",
+                "text": "IKibanaSearchResponse"
+              },
+              "<",
+              "SearchResponse",
+              "<any>>>; fetch: (options?: ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.ISearchOptions",
+                "text": "ISearchOptions"
+              },
+              ") => Promise<",
+              "SearchResponse",
+              "<any>>; onRequestStart: (handler: (searchSource: ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSource",
+                "text": "SearchSource"
+              },
+              ", options?: ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.ISearchOptions",
+                "text": "ISearchOptions"
+              },
+              " | undefined) => Promise<unknown>) => void; getSearchRequestBody: () => any; destroy: () => void; getSerializedFields: (recurse?: boolean) => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSourceFields",
+                "text": "SearchSourceFields"
+              },
+              "; serialize: () => { searchSourceJSON: string; references: ",
+              "SavedObjectReference",
+              "[]; }; }"
+            ],
+            "path": "src/plugins/discover/public/saved_searches/legacy/types.ts",
+            "deprecated": false
           },
           {
             "parentPluginId": "discover",
-            "id": "def-public.SavedSearch.lastSavedTitle",
+            "id": "def-public.LegacySavedSearch.description",
             "type": "string",
             "tags": [],
-            "label": "lastSavedTitle",
+            "label": "description",
             "description": [],
             "signature": [
               "string | undefined"
             ],
-            "path": "src/plugins/discover/public/saved_searches/types.ts",
+            "path": "src/plugins/discover/public/saved_searches/legacy/types.ts",
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.LegacySavedSearch.columns",
+            "type": "Array",
+            "tags": [],
+            "label": "columns",
+            "description": [],
+            "signature": [
+              "string[]"
+            ],
+            "path": "src/plugins/discover/public/saved_searches/legacy/types.ts",
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.LegacySavedSearch.sort",
+            "type": "Array",
+            "tags": [],
+            "label": "sort",
+            "description": [],
+            "signature": [
+              "SortOrder",
+              "[]"
+            ],
+            "path": "src/plugins/discover/public/saved_searches/legacy/types.ts",
             "deprecated": false
           },
           {
             "parentPluginId": "discover",
-            "id": "def-public.SavedSearch.copyOnSave",
+            "id": "def-public.LegacySavedSearch.grid",
+            "type": "Object",
+            "tags": [],
+            "label": "grid",
+            "description": [],
+            "signature": [
+              "DiscoverGridSettings"
+            ],
+            "path": "src/plugins/discover/public/saved_searches/legacy/types.ts",
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.LegacySavedSearch.destroy",
+            "type": "Function",
+            "tags": [],
+            "label": "destroy",
+            "description": [],
+            "signature": [
+              "() => void"
+            ],
+            "path": "src/plugins/discover/public/saved_searches/legacy/types.ts",
+            "deprecated": false,
+            "children": [],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.LegacySavedSearch.save",
+            "type": "Function",
+            "tags": [],
+            "label": "save",
+            "description": [],
+            "signature": [
+              "(saveOptions: ",
+              {
+                "pluginId": "savedObjects",
+                "scope": "public",
+                "docId": "kibSavedObjectsPluginApi",
+                "section": "def-public.SavedObjectSaveOpts",
+                "text": "SavedObjectSaveOpts"
+              },
+              ") => Promise<string>"
+            ],
+            "path": "src/plugins/discover/public/saved_searches/legacy/types.ts",
+            "deprecated": false,
+            "children": [
+              {
+                "parentPluginId": "discover",
+                "id": "def-public.LegacySavedSearch.save.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "saveOptions",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "savedObjects",
+                    "scope": "public",
+                    "docId": "kibSavedObjectsPluginApi",
+                    "section": "def-public.SavedObjectSaveOpts",
+                    "text": "SavedObjectSaveOpts"
+                  }
+                ],
+                "path": "src/plugins/discover/public/saved_searches/legacy/types.ts",
+                "deprecated": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.LegacySavedSearch.copyOnSave",
             "type": "CompoundType",
             "tags": [],
             "label": "copyOnSave",
@@ -784,6 +1111,301 @@
             "signature": [
               "boolean | undefined"
             ],
+            "path": "src/plugins/discover/public/saved_searches/legacy/types.ts",
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.LegacySavedSearch.hideChart",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "hideChart",
+            "description": [],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "path": "src/plugins/discover/public/saved_searches/legacy/types.ts",
+            "deprecated": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "discover",
+        "id": "def-public.SavedSearch",
+        "type": "Interface",
+        "tags": [],
+        "label": "SavedSearch",
+        "description": [],
+        "path": "src/plugins/discover/public/saved_searches/types.ts",
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.SavedSearch.searchSource",
+            "type": "Object",
+            "tags": [],
+            "label": "searchSource",
+            "description": [],
+            "signature": [
+              "{ create: () => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSource",
+                "text": "SearchSource"
+              },
+              "; history: Record<string, any>[]; setPreferredSearchStrategyId: (searchStrategyId: string) => void; setField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, value: ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSourceFields",
+                "text": "SearchSourceFields"
+              },
+              "[K]) => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSource",
+                "text": "SearchSource"
+              },
+              "; removeField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSource",
+                "text": "SearchSource"
+              },
+              "; setFields: (newFields: ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSourceFields",
+                "text": "SearchSourceFields"
+              },
+              ") => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSource",
+                "text": "SearchSource"
+              },
+              "; getId: () => string; getFields: () => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSourceFields",
+                "text": "SearchSourceFields"
+              },
+              "; getField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K, recurse?: boolean) => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSourceFields",
+                "text": "SearchSourceFields"
+              },
+              "[K]; getOwnField: <K extends \"type\" | \"query\" | \"source\" | \"sort\" | \"version\" | \"filter\" | \"highlight\" | \"highlightAll\" | \"trackTotalHits\" | \"aggs\" | \"from\" | \"size\" | \"fields\" | \"fieldsFromSource\" | \"index\" | \"searchAfter\" | \"timeout\" | \"terminate_after\" | \"parent\">(field: K) => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSourceFields",
+                "text": "SearchSourceFields"
+              },
+              "[K]; createCopy: () => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSource",
+                "text": "SearchSource"
+              },
+              "; createChild: (options?: {}) => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSource",
+                "text": "SearchSource"
+              },
+              "; setParent: (parent?: Pick<",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSource",
+                "text": "SearchSource"
+              },
+              ", \"create\" | \"history\" | \"setPreferredSearchStrategyId\" | \"setField\" | \"removeField\" | \"setFields\" | \"getId\" | \"getFields\" | \"getField\" | \"getOwnField\" | \"createCopy\" | \"createChild\" | \"setParent\" | \"getParent\" | \"fetch$\" | \"fetch\" | \"onRequestStart\" | \"getSearchRequestBody\" | \"destroy\" | \"getSerializedFields\" | \"serialize\"> | undefined, options?: ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSourceOptions",
+                "text": "SearchSourceOptions"
+              },
+              ") => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSource",
+                "text": "SearchSource"
+              },
+              "; getParent: () => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSource",
+                "text": "SearchSource"
+              },
+              " | undefined; fetch$: (options?: ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.ISearchOptions",
+                "text": "ISearchOptions"
+              },
+              ") => ",
+              "Observable",
+              "<",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.IKibanaSearchResponse",
+                "text": "IKibanaSearchResponse"
+              },
+              "<",
+              "SearchResponse",
+              "<any>>>; fetch: (options?: ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.ISearchOptions",
+                "text": "ISearchOptions"
+              },
+              ") => Promise<",
+              "SearchResponse",
+              "<any>>; onRequestStart: (handler: (searchSource: ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSource",
+                "text": "SearchSource"
+              },
+              ", options?: ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.ISearchOptions",
+                "text": "ISearchOptions"
+              },
+              " | undefined) => Promise<unknown>) => void; getSearchRequestBody: () => any; destroy: () => void; getSerializedFields: (recurse?: boolean) => ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchSourceFields",
+                "text": "SearchSourceFields"
+              },
+              "; serialize: () => { searchSourceJSON: string; references: ",
+              "SavedObjectReference",
+              "[]; }; }"
+            ],
+            "path": "src/plugins/discover/public/saved_searches/types.ts",
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.SavedSearch.id",
+            "type": "string",
+            "tags": [],
+            "label": "id",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "src/plugins/discover/public/saved_searches/types.ts",
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.SavedSearch.title",
+            "type": "string",
+            "tags": [],
+            "label": "title",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "src/plugins/discover/public/saved_searches/types.ts",
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.SavedSearch.sort",
+            "type": "Array",
+            "tags": [],
+            "label": "sort",
+            "description": [],
+            "signature": [
+              "[string, string][] | undefined"
+            ],
+            "path": "src/plugins/discover/public/saved_searches/types.ts",
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.SavedSearch.columns",
+            "type": "Array",
+            "tags": [],
+            "label": "columns",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "src/plugins/discover/public/saved_searches/types.ts",
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.SavedSearch.description",
+            "type": "string",
+            "tags": [],
+            "label": "description",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "src/plugins/discover/public/saved_searches/types.ts",
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.SavedSearch.grid",
+            "type": "Object",
+            "tags": [],
+            "label": "grid",
+            "description": [],
+            "signature": [
+              "{ columns?: Record<string, ",
+              "DiscoverGridSettingsColumn",
+              "> | undefined; } | undefined"
+            ],
             "path": "src/plugins/discover/public/saved_searches/types.ts",
             "deprecated": false
           },
@@ -799,6 +1421,19 @@
             ],
             "path": "src/plugins/discover/public/saved_searches/types.ts",
             "deprecated": false
+          },
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.SavedSearch.sharingSavedObjectProps",
+            "type": "Object",
+            "tags": [],
+            "label": "sharingSavedObjectProps",
+            "description": [],
+            "signature": [
+              "{ outcome?: \"conflict\" | \"exactMatch\" | \"aliasMatch\" | undefined; aliasTargetId?: string | undefined; errorJSON?: string | undefined; } | undefined"
+            ],
+            "path": "src/plugins/discover/public/saved_searches/types.ts",
+            "deprecated": false
           }
         ],
         "initialIsOpen": false
@@ -807,11 +1442,14 @@
         "parentPluginId": "discover",
         "id": "def-public.SavedSearchLoader",
         "type": "Interface",
-        "tags": [],
+        "tags": [
+          "deprecated"
+        ],
         "label": "SavedSearchLoader",
         "description": [],
-        "path": "src/plugins/discover/public/saved_searches/types.ts",
-        "deprecated": false,
+        "path": "src/plugins/discover/public/saved_searches/legacy/types.ts",
+        "deprecated": true,
+        "references": [],
         "children": [
           {
             "parentPluginId": "discover",
@@ -826,12 +1464,12 @@
                 "pluginId": "discover",
                 "scope": "public",
                 "docId": "kibDiscoverPluginApi",
-                "section": "def-public.SavedSearch",
-                "text": "SavedSearch"
+                "section": "def-public.LegacySavedSearch",
+                "text": "LegacySavedSearch"
               },
               ">"
             ],
-            "path": "src/plugins/discover/public/saved_searches/types.ts",
+            "path": "src/plugins/discover/public/saved_searches/legacy/types.ts",
             "deprecated": false,
             "children": [
               {
@@ -844,7 +1482,7 @@
                 "signature": [
                   "string"
                 ],
-                "path": "src/plugins/discover/public/saved_searches/types.ts",
+                "path": "src/plugins/discover/public/saved_searches/legacy/types.ts",
                 "deprecated": false,
                 "isRequired": true
               }
@@ -861,7 +1499,7 @@
             "signature": [
               "(id: string) => string"
             ],
-            "path": "src/plugins/discover/public/saved_searches/types.ts",
+            "path": "src/plugins/discover/public/saved_searches/legacy/types.ts",
             "deprecated": false,
             "children": [
               {
@@ -874,7 +1512,7 @@
                 "signature": [
                   "string"
                 ],
-                "path": "src/plugins/discover/public/saved_searches/types.ts",
+                "path": "src/plugins/discover/public/saved_searches/legacy/types.ts",
                 "deprecated": false,
                 "isRequired": true
               }
@@ -1068,7 +1706,69 @@
         "initialIsOpen": false
       }
     ],
-    "objects": [],
+    "objects": [
+      {
+        "parentPluginId": "discover",
+        "id": "def-public.__LEGACY",
+        "type": "Object",
+        "tags": [
+          "deprecated"
+        ],
+        "label": "__LEGACY",
+        "description": [],
+        "path": "src/plugins/discover/public/saved_searches/index.ts",
+        "deprecated": true,
+        "references": [
+          {
+            "plugin": "visualizations",
+            "path": "src/plugins/visualizations/public/saved_visualizations/_saved_vis.ts"
+          },
+          {
+            "plugin": "visualizations",
+            "path": "src/plugins/visualizations/public/saved_visualizations/_saved_vis.ts"
+          }
+        ],
+        "children": [
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.__LEGACY.createSavedSearchesLoader",
+            "type": "Function",
+            "tags": [],
+            "label": "createSavedSearchesLoader",
+            "description": [],
+            "signature": [
+              "({ savedObjectsClient, savedObjects }: Services) => ",
+              {
+                "pluginId": "savedObjects",
+                "scope": "public",
+                "docId": "kibSavedObjectsPluginApi",
+                "section": "def-public.SavedObjectLoader",
+                "text": "SavedObjectLoader"
+              }
+            ],
+            "path": "src/plugins/discover/public/saved_searches/index.ts",
+            "deprecated": false,
+            "returnComment": [],
+            "children": [
+              {
+                "parentPluginId": "discover",
+                "id": "def-public.__LEGACY.createSavedSearchesLoader.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "__0",
+                "description": [],
+                "signature": [
+                  "Services"
+                ],
+                "path": "src/plugins/discover/public/saved_searches/legacy/saved_searches.ts",
+                "deprecated": false
+              }
+            ]
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ],
     "setup": {
       "parentPluginId": "discover",
       "id": "def-public.DiscoverSetup",
@@ -1134,19 +1834,21 @@
       "children": [
         {
           "parentPluginId": "discover",
-          "id": "def-public.DiscoverStart.savedSearchLoader",
+          "id": "def-public.DiscoverStart.__LEGACY",
           "type": "Object",
           "tags": [],
-          "label": "savedSearchLoader",
+          "label": "__LEGACY",
           "description": [],
           "signature": [
+            "{ savedSearchLoader: ",
             {
               "pluginId": "savedObjects",
               "scope": "public",
               "docId": "kibSavedObjectsPluginApi",
               "section": "def-public.SavedObjectLoader",
               "text": "SavedObjectLoader"
-            }
+            },
+            "; }"
           ],
           "path": "src/plugins/discover/public/plugin.tsx",
           "deprecated": false
diff --git a/api_docs/discover.mdx b/api_docs/discover.mdx
index aee0f4b9724c68..46e681aabc0a66 100644
--- a/api_docs/discover.mdx
+++ b/api_docs/discover.mdx
@@ -18,7 +18,7 @@ Contact [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-disco
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 82 | 0 | 56 | 6 |
+| 103 | 0 | 77 | 7 |
 
 ## Client
 
@@ -28,6 +28,9 @@ Contact [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-disco
 ### Start
 <DocDefinitionList data={[discoverObj.client.start]}/>
 
+### Objects
+<DocDefinitionList data={discoverObj.client.objects}/>
+
 ### Functions
 <DocDefinitionList data={discoverObj.client.functions}/>
 
diff --git a/api_docs/elastic_apm_generator.json b/api_docs/elastic_apm_generator.json
index dc69c08bba5b27..24f11791d92b66 100644
--- a/api_docs/elastic_apm_generator.json
+++ b/api_docs/elastic_apm_generator.json
@@ -11,6 +11,37 @@
   "server": {
     "classes": [],
     "functions": [
+      {
+        "parentPluginId": "@elastic/apm-generator",
+        "id": "def-server.getBreakdownMetrics",
+        "type": "Function",
+        "tags": [],
+        "label": "getBreakdownMetrics",
+        "description": [],
+        "signature": [
+          "(events: Partial<{ '@timestamp': number; 'agent.name': string; 'agent.version': string; 'container.id': string; 'ecs.version': string; 'event.outcome': string; 'event.ingested': number; 'host.name': string; 'metricset.name': string; 'observer.version': string; 'observer.version_major': number; 'parent.id': string; 'processor.event': string; 'processor.name': string; 'trace.id': string; 'transaction.name': string; 'transaction.type': string; 'transaction.id': string; 'transaction.duration.us': number; 'transaction.duration.histogram': { values: number[]; counts: number[]; }; 'transaction.sampled': true; 'service.name': string; 'service.environment': string; 'service.node.name': string; 'span.id': string; 'span.name': string; 'span.type': string; 'span.subtype': string; 'span.duration.us': number; 'span.destination.service.name': string; 'span.destination.service.resource': string; 'span.destination.service.type': string; 'span.destination.service.response_time.sum.us': number; 'span.destination.service.response_time.count': number; 'span.self_time.count': number; 'span.self_time.sum.us': number; }>[]) => Partial<{ '@timestamp': number; 'agent.name': string; 'agent.version': string; 'container.id': string; 'ecs.version': string; 'event.outcome': string; 'event.ingested': number; 'host.name': string; 'metricset.name': string; 'observer.version': string; 'observer.version_major': number; 'parent.id': string; 'processor.event': string; 'processor.name': string; 'trace.id': string; 'transaction.name': string; 'transaction.type': string; 'transaction.id': string; 'transaction.duration.us': number; 'transaction.duration.histogram': { values: number[]; counts: number[]; }; 'transaction.sampled': true; 'service.name': string; 'service.environment': string; 'service.node.name': string; 'span.id': string; 'span.name': string; 'span.type': string; 'span.subtype': string; 'span.duration.us': number; 'span.destination.service.name': string; 'span.destination.service.resource': string; 'span.destination.service.type': string; 'span.destination.service.response_time.sum.us': number; 'span.destination.service.response_time.count': number; 'span.self_time.count': number; 'span.self_time.sum.us': number; }>[]"
+        ],
+        "path": "packages/elastic-apm-generator/src/lib/utils/get_breakdown_metrics.ts",
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "@elastic/apm-generator",
+            "id": "def-server.getBreakdownMetrics.$1",
+            "type": "Array",
+            "tags": [],
+            "label": "events",
+            "description": [],
+            "signature": [
+              "Partial<{ '@timestamp': number; 'agent.name': string; 'agent.version': string; 'container.id': string; 'ecs.version': string; 'event.outcome': string; 'event.ingested': number; 'host.name': string; 'metricset.name': string; 'observer.version': string; 'observer.version_major': number; 'parent.id': string; 'processor.event': string; 'processor.name': string; 'trace.id': string; 'transaction.name': string; 'transaction.type': string; 'transaction.id': string; 'transaction.duration.us': number; 'transaction.duration.histogram': { values: number[]; counts: number[]; }; 'transaction.sampled': true; 'service.name': string; 'service.environment': string; 'service.node.name': string; 'span.id': string; 'span.name': string; 'span.type': string; 'span.subtype': string; 'span.duration.us': number; 'span.destination.service.name': string; 'span.destination.service.resource': string; 'span.destination.service.type': string; 'span.destination.service.response_time.sum.us': number; 'span.destination.service.response_time.count': number; 'span.self_time.count': number; 'span.self_time.sum.us': number; }>[]"
+            ],
+            "path": "packages/elastic-apm-generator/src/lib/utils/get_breakdown_metrics.ts",
+            "deprecated": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@elastic/apm-generator",
         "id": "def-server.getObserverDefaults",
@@ -19,7 +50,7 @@
         "label": "getObserverDefaults",
         "description": [],
         "signature": [
-          "() => Partial<{ '@timestamp': number; 'agent.name': string; 'agent.version': string; 'ecs.version': string; 'event.outcome': string; 'event.ingested': number; 'metricset.name': string; 'observer.version': string; 'observer.version_major': number; 'parent.id': string; 'processor.event': string; 'processor.name': string; 'trace.id': string; 'transaction.name': string; 'transaction.type': string; 'transaction.id': string; 'transaction.duration.us': number; 'transaction.duration.histogram': { values: number[]; counts: number[]; }; 'transaction.sampled': true; 'service.name': string; 'service.environment': string; 'service.node.name': string; 'span.id': string; 'span.name': string; 'span.type': string; 'span.subtype': string; 'span.duration.us': number; 'span.destination.service.name': string; 'span.destination.service.resource': string; 'span.destination.service.type': string; 'span.destination.service.response_time.sum.us': number; 'span.destination.service.response_time.count': number; }>"
+          "() => Partial<{ '@timestamp': number; 'agent.name': string; 'agent.version': string; 'container.id': string; 'ecs.version': string; 'event.outcome': string; 'event.ingested': number; 'host.name': string; 'metricset.name': string; 'observer.version': string; 'observer.version_major': number; 'parent.id': string; 'processor.event': string; 'processor.name': string; 'trace.id': string; 'transaction.name': string; 'transaction.type': string; 'transaction.id': string; 'transaction.duration.us': number; 'transaction.duration.histogram': { values: number[]; counts: number[]; }; 'transaction.sampled': true; 'service.name': string; 'service.environment': string; 'service.node.name': string; 'span.id': string; 'span.name': string; 'span.type': string; 'span.subtype': string; 'span.duration.us': number; 'span.destination.service.name': string; 'span.destination.service.resource': string; 'span.destination.service.type': string; 'span.destination.service.response_time.sum.us': number; 'span.destination.service.response_time.count': number; 'span.self_time.count': number; 'span.self_time.sum.us': number; }>"
         ],
         "path": "packages/elastic-apm-generator/src/lib/defaults/get_observer_defaults.ts",
         "deprecated": false,
@@ -35,7 +66,7 @@
         "label": "getSpanDestinationMetrics",
         "description": [],
         "signature": [
-          "(events: Partial<{ '@timestamp': number; 'agent.name': string; 'agent.version': string; 'ecs.version': string; 'event.outcome': string; 'event.ingested': number; 'metricset.name': string; 'observer.version': string; 'observer.version_major': number; 'parent.id': string; 'processor.event': string; 'processor.name': string; 'trace.id': string; 'transaction.name': string; 'transaction.type': string; 'transaction.id': string; 'transaction.duration.us': number; 'transaction.duration.histogram': { values: number[]; counts: number[]; }; 'transaction.sampled': true; 'service.name': string; 'service.environment': string; 'service.node.name': string; 'span.id': string; 'span.name': string; 'span.type': string; 'span.subtype': string; 'span.duration.us': number; 'span.destination.service.name': string; 'span.destination.service.resource': string; 'span.destination.service.type': string; 'span.destination.service.response_time.sum.us': number; 'span.destination.service.response_time.count': number; }>[]) => Partial<{ '@timestamp': number; 'agent.name': string; 'agent.version': string; 'ecs.version': string; 'event.outcome': string; 'event.ingested': number; 'metricset.name': string; 'observer.version': string; 'observer.version_major': number; 'parent.id': string; 'processor.event': string; 'processor.name': string; 'trace.id': string; 'transaction.name': string; 'transaction.type': string; 'transaction.id': string; 'transaction.duration.us': number; 'transaction.duration.histogram': { values: number[]; counts: number[]; }; 'transaction.sampled': true; 'service.name': string; 'service.environment': string; 'service.node.name': string; 'span.id': string; 'span.name': string; 'span.type': string; 'span.subtype': string; 'span.duration.us': number; 'span.destination.service.name': string; 'span.destination.service.resource': string; 'span.destination.service.type': string; 'span.destination.service.response_time.sum.us': number; 'span.destination.service.response_time.count': number; }>[]"
+          "(events: Partial<{ '@timestamp': number; 'agent.name': string; 'agent.version': string; 'container.id': string; 'ecs.version': string; 'event.outcome': string; 'event.ingested': number; 'host.name': string; 'metricset.name': string; 'observer.version': string; 'observer.version_major': number; 'parent.id': string; 'processor.event': string; 'processor.name': string; 'trace.id': string; 'transaction.name': string; 'transaction.type': string; 'transaction.id': string; 'transaction.duration.us': number; 'transaction.duration.histogram': { values: number[]; counts: number[]; }; 'transaction.sampled': true; 'service.name': string; 'service.environment': string; 'service.node.name': string; 'span.id': string; 'span.name': string; 'span.type': string; 'span.subtype': string; 'span.duration.us': number; 'span.destination.service.name': string; 'span.destination.service.resource': string; 'span.destination.service.type': string; 'span.destination.service.response_time.sum.us': number; 'span.destination.service.response_time.count': number; 'span.self_time.count': number; 'span.self_time.sum.us': number; }>[]) => { \"metricset.name\": string; 'span.destination.service.response_time.sum.us': number; 'span.destination.service.response_time.count': number; '@timestamp'?: number | undefined; 'agent.name'?: string | undefined; 'agent.version'?: string | undefined; 'container.id'?: string | undefined; 'ecs.version'?: string | undefined; 'event.outcome'?: string | undefined; 'event.ingested'?: number | undefined; 'host.name'?: string | undefined; 'observer.version'?: string | undefined; 'observer.version_major'?: number | undefined; 'parent.id'?: string | undefined; 'processor.event'?: string | undefined; 'processor.name'?: string | undefined; 'trace.id'?: string | undefined; 'transaction.name'?: string | undefined; 'transaction.type'?: string | undefined; 'transaction.id'?: string | undefined; 'transaction.duration.us'?: number | undefined; 'transaction.duration.histogram'?: { values: number[]; counts: number[]; } | undefined; 'transaction.sampled'?: true | undefined; 'service.name'?: string | undefined; 'service.environment'?: string | undefined; 'service.node.name'?: string | undefined; 'span.id'?: string | undefined; 'span.name'?: string | undefined; 'span.type'?: string | undefined; 'span.subtype'?: string | undefined; 'span.duration.us'?: number | undefined; 'span.destination.service.name'?: string | undefined; 'span.destination.service.resource'?: string | undefined; 'span.destination.service.type'?: string | undefined; 'span.self_time.count'?: number | undefined; 'span.self_time.sum.us'?: number | undefined; }[]"
         ],
         "path": "packages/elastic-apm-generator/src/lib/utils/get_span_destination_metrics.ts",
         "deprecated": false,
@@ -48,7 +79,7 @@
             "label": "events",
             "description": [],
             "signature": [
-              "Partial<{ '@timestamp': number; 'agent.name': string; 'agent.version': string; 'ecs.version': string; 'event.outcome': string; 'event.ingested': number; 'metricset.name': string; 'observer.version': string; 'observer.version_major': number; 'parent.id': string; 'processor.event': string; 'processor.name': string; 'trace.id': string; 'transaction.name': string; 'transaction.type': string; 'transaction.id': string; 'transaction.duration.us': number; 'transaction.duration.histogram': { values: number[]; counts: number[]; }; 'transaction.sampled': true; 'service.name': string; 'service.environment': string; 'service.node.name': string; 'span.id': string; 'span.name': string; 'span.type': string; 'span.subtype': string; 'span.duration.us': number; 'span.destination.service.name': string; 'span.destination.service.resource': string; 'span.destination.service.type': string; 'span.destination.service.response_time.sum.us': number; 'span.destination.service.response_time.count': number; }>[]"
+              "Partial<{ '@timestamp': number; 'agent.name': string; 'agent.version': string; 'container.id': string; 'ecs.version': string; 'event.outcome': string; 'event.ingested': number; 'host.name': string; 'metricset.name': string; 'observer.version': string; 'observer.version_major': number; 'parent.id': string; 'processor.event': string; 'processor.name': string; 'trace.id': string; 'transaction.name': string; 'transaction.type': string; 'transaction.id': string; 'transaction.duration.us': number; 'transaction.duration.histogram': { values: number[]; counts: number[]; }; 'transaction.sampled': true; 'service.name': string; 'service.environment': string; 'service.node.name': string; 'span.id': string; 'span.name': string; 'span.type': string; 'span.subtype': string; 'span.duration.us': number; 'span.destination.service.name': string; 'span.destination.service.resource': string; 'span.destination.service.type': string; 'span.destination.service.response_time.sum.us': number; 'span.destination.service.response_time.count': number; 'span.self_time.count': number; 'span.self_time.sum.us': number; }>[]"
             ],
             "path": "packages/elastic-apm-generator/src/lib/utils/get_span_destination_metrics.ts",
             "deprecated": false,
@@ -66,7 +97,7 @@
         "label": "getTransactionMetrics",
         "description": [],
         "signature": [
-          "(events: Partial<{ '@timestamp': number; 'agent.name': string; 'agent.version': string; 'ecs.version': string; 'event.outcome': string; 'event.ingested': number; 'metricset.name': string; 'observer.version': string; 'observer.version_major': number; 'parent.id': string; 'processor.event': string; 'processor.name': string; 'trace.id': string; 'transaction.name': string; 'transaction.type': string; 'transaction.id': string; 'transaction.duration.us': number; 'transaction.duration.histogram': { values: number[]; counts: number[]; }; 'transaction.sampled': true; 'service.name': string; 'service.environment': string; 'service.node.name': string; 'span.id': string; 'span.name': string; 'span.type': string; 'span.subtype': string; 'span.duration.us': number; 'span.destination.service.name': string; 'span.destination.service.resource': string; 'span.destination.service.type': string; 'span.destination.service.response_time.sum.us': number; 'span.destination.service.response_time.count': number; }>[]) => { \"transaction.duration.histogram\": { values: number[]; counts: number[]; }; _doc_count: number; '@timestamp'?: number | undefined; 'agent.name'?: string | undefined; 'agent.version'?: string | undefined; 'ecs.version'?: string | undefined; 'event.outcome'?: string | undefined; 'event.ingested'?: number | undefined; 'metricset.name'?: string | undefined; 'observer.version'?: string | undefined; 'observer.version_major'?: number | undefined; 'parent.id'?: string | undefined; 'processor.event'?: string | undefined; 'processor.name'?: string | undefined; 'trace.id'?: string | undefined; 'transaction.name'?: string | undefined; 'transaction.type'?: string | undefined; 'transaction.id'?: string | undefined; 'transaction.duration.us'?: number | undefined; 'transaction.sampled'?: true | undefined; 'service.name'?: string | undefined; 'service.environment'?: string | undefined; 'service.node.name'?: string | undefined; 'span.id'?: string | undefined; 'span.name'?: string | undefined; 'span.type'?: string | undefined; 'span.subtype'?: string | undefined; 'span.duration.us'?: number | undefined; 'span.destination.service.name'?: string | undefined; 'span.destination.service.resource'?: string | undefined; 'span.destination.service.type'?: string | undefined; 'span.destination.service.response_time.sum.us'?: number | undefined; 'span.destination.service.response_time.count'?: number | undefined; }[]"
+          "(events: Partial<{ '@timestamp': number; 'agent.name': string; 'agent.version': string; 'container.id': string; 'ecs.version': string; 'event.outcome': string; 'event.ingested': number; 'host.name': string; 'metricset.name': string; 'observer.version': string; 'observer.version_major': number; 'parent.id': string; 'processor.event': string; 'processor.name': string; 'trace.id': string; 'transaction.name': string; 'transaction.type': string; 'transaction.id': string; 'transaction.duration.us': number; 'transaction.duration.histogram': { values: number[]; counts: number[]; }; 'transaction.sampled': true; 'service.name': string; 'service.environment': string; 'service.node.name': string; 'span.id': string; 'span.name': string; 'span.type': string; 'span.subtype': string; 'span.duration.us': number; 'span.destination.service.name': string; 'span.destination.service.resource': string; 'span.destination.service.type': string; 'span.destination.service.response_time.sum.us': number; 'span.destination.service.response_time.count': number; 'span.self_time.count': number; 'span.self_time.sum.us': number; }>[]) => { 'transaction.duration.histogram': { values: number[]; counts: number[]; }; _doc_count: number; '@timestamp'?: number | undefined; 'agent.name'?: string | undefined; 'agent.version'?: string | undefined; 'container.id'?: string | undefined; 'ecs.version'?: string | undefined; 'event.outcome'?: string | undefined; 'event.ingested'?: number | undefined; 'host.name'?: string | undefined; 'metricset.name'?: string | undefined; 'observer.version'?: string | undefined; 'observer.version_major'?: number | undefined; 'parent.id'?: string | undefined; 'processor.event'?: string | undefined; 'processor.name'?: string | undefined; 'trace.id'?: string | undefined; 'transaction.name'?: string | undefined; 'transaction.type'?: string | undefined; 'transaction.id'?: string | undefined; 'transaction.duration.us'?: number | undefined; 'transaction.sampled'?: true | undefined; 'service.name'?: string | undefined; 'service.environment'?: string | undefined; 'service.node.name'?: string | undefined; 'span.id'?: string | undefined; 'span.name'?: string | undefined; 'span.type'?: string | undefined; 'span.subtype'?: string | undefined; 'span.duration.us'?: number | undefined; 'span.destination.service.name'?: string | undefined; 'span.destination.service.resource'?: string | undefined; 'span.destination.service.type'?: string | undefined; 'span.destination.service.response_time.sum.us'?: number | undefined; 'span.destination.service.response_time.count'?: number | undefined; 'span.self_time.count'?: number | undefined; 'span.self_time.sum.us'?: number | undefined; }[]"
         ],
         "path": "packages/elastic-apm-generator/src/lib/utils/get_transaction_metrics.ts",
         "deprecated": false,
@@ -79,7 +110,7 @@
             "label": "events",
             "description": [],
             "signature": [
-              "Partial<{ '@timestamp': number; 'agent.name': string; 'agent.version': string; 'ecs.version': string; 'event.outcome': string; 'event.ingested': number; 'metricset.name': string; 'observer.version': string; 'observer.version_major': number; 'parent.id': string; 'processor.event': string; 'processor.name': string; 'trace.id': string; 'transaction.name': string; 'transaction.type': string; 'transaction.id': string; 'transaction.duration.us': number; 'transaction.duration.histogram': { values: number[]; counts: number[]; }; 'transaction.sampled': true; 'service.name': string; 'service.environment': string; 'service.node.name': string; 'span.id': string; 'span.name': string; 'span.type': string; 'span.subtype': string; 'span.duration.us': number; 'span.destination.service.name': string; 'span.destination.service.resource': string; 'span.destination.service.type': string; 'span.destination.service.response_time.sum.us': number; 'span.destination.service.response_time.count': number; }>[]"
+              "Partial<{ '@timestamp': number; 'agent.name': string; 'agent.version': string; 'container.id': string; 'ecs.version': string; 'event.outcome': string; 'event.ingested': number; 'host.name': string; 'metricset.name': string; 'observer.version': string; 'observer.version_major': number; 'parent.id': string; 'processor.event': string; 'processor.name': string; 'trace.id': string; 'transaction.name': string; 'transaction.type': string; 'transaction.id': string; 'transaction.duration.us': number; 'transaction.duration.histogram': { values: number[]; counts: number[]; }; 'transaction.sampled': true; 'service.name': string; 'service.environment': string; 'service.node.name': string; 'span.id': string; 'span.name': string; 'span.type': string; 'span.subtype': string; 'span.duration.us': number; 'span.destination.service.name': string; 'span.destination.service.resource': string; 'span.destination.service.type': string; 'span.destination.service.response_time.sum.us': number; 'span.destination.service.response_time.count': number; 'span.self_time.count': number; 'span.self_time.sum.us': number; }>[]"
             ],
             "path": "packages/elastic-apm-generator/src/lib/utils/get_transaction_metrics.ts",
             "deprecated": false,
@@ -203,7 +234,7 @@
         "label": "toElasticsearchOutput",
         "description": [],
         "signature": [
-          "(events: Partial<{ '@timestamp': number; 'agent.name': string; 'agent.version': string; 'ecs.version': string; 'event.outcome': string; 'event.ingested': number; 'metricset.name': string; 'observer.version': string; 'observer.version_major': number; 'parent.id': string; 'processor.event': string; 'processor.name': string; 'trace.id': string; 'transaction.name': string; 'transaction.type': string; 'transaction.id': string; 'transaction.duration.us': number; 'transaction.duration.histogram': { values: number[]; counts: number[]; }; 'transaction.sampled': true; 'service.name': string; 'service.environment': string; 'service.node.name': string; 'span.id': string; 'span.name': string; 'span.type': string; 'span.subtype': string; 'span.duration.us': number; 'span.destination.service.name': string; 'span.destination.service.resource': string; 'span.destination.service.type': string; 'span.destination.service.response_time.sum.us': number; 'span.destination.service.response_time.count': number; }>[], versionOverride: string | undefined) => { _index: string; _source: {}; }[]"
+          "(events: Partial<{ '@timestamp': number; 'agent.name': string; 'agent.version': string; 'container.id': string; 'ecs.version': string; 'event.outcome': string; 'event.ingested': number; 'host.name': string; 'metricset.name': string; 'observer.version': string; 'observer.version_major': number; 'parent.id': string; 'processor.event': string; 'processor.name': string; 'trace.id': string; 'transaction.name': string; 'transaction.type': string; 'transaction.id': string; 'transaction.duration.us': number; 'transaction.duration.histogram': { values: number[]; counts: number[]; }; 'transaction.sampled': true; 'service.name': string; 'service.environment': string; 'service.node.name': string; 'span.id': string; 'span.name': string; 'span.type': string; 'span.subtype': string; 'span.duration.us': number; 'span.destination.service.name': string; 'span.destination.service.resource': string; 'span.destination.service.type': string; 'span.destination.service.response_time.sum.us': number; 'span.destination.service.response_time.count': number; 'span.self_time.count': number; 'span.self_time.sum.us': number; }>[], versionOverride: string | undefined) => { _index: string; _source: {}; }[]"
         ],
         "path": "packages/elastic-apm-generator/src/lib/output/to_elasticsearch_output.ts",
         "deprecated": false,
@@ -216,7 +247,7 @@
             "label": "events",
             "description": [],
             "signature": [
-              "Partial<{ '@timestamp': number; 'agent.name': string; 'agent.version': string; 'ecs.version': string; 'event.outcome': string; 'event.ingested': number; 'metricset.name': string; 'observer.version': string; 'observer.version_major': number; 'parent.id': string; 'processor.event': string; 'processor.name': string; 'trace.id': string; 'transaction.name': string; 'transaction.type': string; 'transaction.id': string; 'transaction.duration.us': number; 'transaction.duration.histogram': { values: number[]; counts: number[]; }; 'transaction.sampled': true; 'service.name': string; 'service.environment': string; 'service.node.name': string; 'span.id': string; 'span.name': string; 'span.type': string; 'span.subtype': string; 'span.duration.us': number; 'span.destination.service.name': string; 'span.destination.service.resource': string; 'span.destination.service.type': string; 'span.destination.service.response_time.sum.us': number; 'span.destination.service.response_time.count': number; }>[]"
+              "Partial<{ '@timestamp': number; 'agent.name': string; 'agent.version': string; 'container.id': string; 'ecs.version': string; 'event.outcome': string; 'event.ingested': number; 'host.name': string; 'metricset.name': string; 'observer.version': string; 'observer.version_major': number; 'parent.id': string; 'processor.event': string; 'processor.name': string; 'trace.id': string; 'transaction.name': string; 'transaction.type': string; 'transaction.id': string; 'transaction.duration.us': number; 'transaction.duration.histogram': { values: number[]; counts: number[]; }; 'transaction.sampled': true; 'service.name': string; 'service.environment': string; 'service.node.name': string; 'span.id': string; 'span.name': string; 'span.type': string; 'span.subtype': string; 'span.duration.us': number; 'span.destination.service.name': string; 'span.destination.service.resource': string; 'span.destination.service.type': string; 'span.destination.service.response_time.sum.us': number; 'span.destination.service.response_time.count': number; 'span.self_time.count': number; 'span.self_time.sum.us': number; }>[]"
             ],
             "path": "packages/elastic-apm-generator/src/lib/output/to_elasticsearch_output.ts",
             "deprecated": false,
diff --git a/api_docs/elastic_apm_generator.mdx b/api_docs/elastic_apm_generator.mdx
index 3b7667a6837b55..4c95050b09c28d 100644
--- a/api_docs/elastic_apm_generator.mdx
+++ b/api_docs/elastic_apm_generator.mdx
@@ -18,7 +18,7 @@ Contact [Owner missing] for questions regarding this plugin.
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 15 | 0 | 15 | 2 |
+| 17 | 0 | 17 | 2 |
 
 ## Server
 
diff --git a/api_docs/es_ui_shared.json b/api_docs/es_ui_shared.json
index 83d71b321cfcf1..da0ba7b688c934 100644
--- a/api_docs/es_ui_shared.json
+++ b/api_docs/es_ui_shared.json
@@ -1175,7 +1175,7 @@
             "label": "method",
             "description": [],
             "signature": [
-              "\"get\" | \"post\" | \"put\" | \"delete\" | \"patch\" | \"head\""
+              "\"delete\" | \"get\" | \"post\" | \"put\" | \"patch\" | \"head\""
             ],
             "path": "src/plugins/es_ui_shared/public/request/send_request.ts",
             "deprecated": false
diff --git a/api_docs/event_log.json b/api_docs/event_log.json
index 1991fbff2589da..60a3d9e83be7b7 100644
--- a/api_docs/event_log.json
+++ b/api_docs/event_log.json
@@ -753,7 +753,7 @@
             "label": "logEvent",
             "description": [],
             "signature": [
-              "(properties: DeepPartial<DeepWriteable<Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; outcome?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => void"
+              "(properties: DeepPartial<DeepWriteable<Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; outcome?: string | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => void"
             ],
             "path": "x-pack/plugins/event_log/server/types.ts",
             "deprecated": false,
@@ -766,7 +766,7 @@
                 "label": "properties",
                 "description": [],
                 "signature": [
-                  "DeepPartial<DeepWriteable<Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; outcome?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
+                  "DeepPartial<DeepWriteable<Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; outcome?: string | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
                 ],
                 "path": "x-pack/plugins/event_log/server/types.ts",
                 "deprecated": false,
@@ -783,7 +783,7 @@
             "label": "startTiming",
             "description": [],
             "signature": [
-              "(event: DeepPartial<DeepWriteable<Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; outcome?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => void"
+              "(event: DeepPartial<DeepWriteable<Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; outcome?: string | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => void"
             ],
             "path": "x-pack/plugins/event_log/server/types.ts",
             "deprecated": false,
@@ -796,7 +796,7 @@
                 "label": "event",
                 "description": [],
                 "signature": [
-                  "DeepPartial<DeepWriteable<Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; outcome?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
+                  "DeepPartial<DeepWriteable<Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; outcome?: string | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
                 ],
                 "path": "x-pack/plugins/event_log/server/types.ts",
                 "deprecated": false,
@@ -813,7 +813,7 @@
             "label": "stopTiming",
             "description": [],
             "signature": [
-              "(event: DeepPartial<DeepWriteable<Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; outcome?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => void"
+              "(event: DeepPartial<DeepWriteable<Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; outcome?: string | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => void"
             ],
             "path": "x-pack/plugins/event_log/server/types.ts",
             "deprecated": false,
@@ -826,7 +826,7 @@
                 "label": "event",
                 "description": [],
                 "signature": [
-                  "DeepPartial<DeepWriteable<Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; outcome?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
+                  "DeepPartial<DeepWriteable<Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; outcome?: string | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
                 ],
                 "path": "x-pack/plugins/event_log/server/types.ts",
                 "deprecated": false,
@@ -886,7 +886,7 @@
             "label": "data",
             "description": [],
             "signature": [
-              "(Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; outcome?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}> | undefined)[]"
+              "(Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; outcome?: string | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}> | undefined)[]"
             ],
             "path": "x-pack/plugins/event_log/server/es/cluster_client_adapter.ts",
             "deprecated": false
@@ -905,7 +905,7 @@
         "label": "IEvent",
         "description": [],
         "signature": [
-          "DeepPartial<DeepWriteable<Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; outcome?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
+          "DeepPartial<DeepWriteable<Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; outcome?: string | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
         ],
         "path": "x-pack/plugins/event_log/generated/schemas.ts",
         "deprecated": false,
@@ -919,7 +919,7 @@
         "label": "IValidatedEvent",
         "description": [],
         "signature": [
-          "Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; outcome?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}> | undefined"
+          "Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; outcome?: string | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}> | undefined"
         ],
         "path": "x-pack/plugins/event_log/generated/schemas.ts",
         "deprecated": false,
@@ -1138,7 +1138,7 @@
           "label": "getLogger",
           "description": [],
           "signature": [
-            "(properties: DeepPartial<DeepWriteable<Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; outcome?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => ",
+            "(properties: DeepPartial<DeepWriteable<Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; outcome?: string | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => ",
             {
               "pluginId": "eventLog",
               "scope": "server",
@@ -1158,7 +1158,7 @@
               "label": "properties",
               "description": [],
               "signature": [
-                "DeepPartial<DeepWriteable<Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; outcome?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
+                "DeepPartial<DeepWriteable<Readonly<{ tags?: string[] | undefined; kibana?: Readonly<{ version?: string | undefined; alert?: Readonly<{ rule?: Readonly<{ execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ total_indexing_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; } & {}> | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ scheduled?: string | undefined; schedule_delay?: number | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; outcome?: string | undefined; url?: string | undefined; code?: string | undefined; original?: string | undefined; action?: string | undefined; kind?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
               ],
               "path": "x-pack/plugins/event_log/server/types.ts",
               "deprecated": false,
diff --git a/api_docs/expressions.json b/api_docs/expressions.json
index 5cb989ee85e619..952184350bc79e 100644
--- a/api_docs/expressions.json
+++ b/api_docs/expressions.json
@@ -2494,7 +2494,7 @@
             "label": "types",
             "description": [],
             "signature": [
-              "(string[] & (\"date\" | \"filter\" | ",
+              "(string[] & (\"filter\" | \"date\" | ",
               {
                 "pluginId": "expressions",
                 "scope": "common",
@@ -2502,7 +2502,7 @@
                 "section": "def-common.KnownTypeToString",
                 "text": "KnownTypeToString"
               },
-              "<T>)[]) | (string[] & (\"date\" | \"filter\" | ArrayTypeToArgumentString<T>)[]) | (string[] & (\"date\" | \"filter\" | UnresolvedTypeToArgumentString<T>)[]) | (string[] & (\"date\" | \"filter\" | UnresolvedArrayTypeToArgumentString<T>)[]) | undefined"
+              "<T>)[]) | (string[] & (\"filter\" | \"date\" | ArrayTypeToArgumentString<T>)[]) | (string[] & (\"filter\" | \"date\" | UnresolvedTypeToArgumentString<T>)[]) | (string[] & (\"filter\" | \"date\" | UnresolvedArrayTypeToArgumentString<T>)[]) | undefined"
             ],
             "path": "src/plugins/expressions/common/expression_functions/expression_function_parameter.ts",
             "deprecated": false
@@ -7683,7 +7683,7 @@
               "\nName of type of value this function outputs."
             ],
             "signature": [
-              "\"date\" | \"filter\" | ",
+              "\"filter\" | \"date\" | ",
               {
                 "pluginId": "expressions",
                 "scope": "common",
@@ -10477,57 +10477,6 @@
           }
         ],
         "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "expressions",
-        "id": "def-public.SerializedFieldFormat",
-        "type": "Interface",
-        "tags": [],
-        "label": "SerializedFieldFormat",
-        "description": [
-          "\nJSON representation of a field formatter configuration.\nIs used to carry information about how to format data in\na data table as part of the column definition."
-        ],
-        "signature": [
-          {
-            "pluginId": "expressions",
-            "scope": "common",
-            "docId": "kibExpressionsPluginApi",
-            "section": "def-common.SerializedFieldFormat",
-            "text": "SerializedFieldFormat"
-          },
-          "<TParams>"
-        ],
-        "path": "src/plugins/expressions/common/types/common.ts",
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "expressions",
-            "id": "def-public.SerializedFieldFormat.id",
-            "type": "string",
-            "tags": [],
-            "label": "id",
-            "description": [],
-            "signature": [
-              "string | undefined"
-            ],
-            "path": "src/plugins/expressions/common/types/common.ts",
-            "deprecated": false
-          },
-          {
-            "parentPluginId": "expressions",
-            "id": "def-public.SerializedFieldFormat.params",
-            "type": "Uncategorized",
-            "tags": [],
-            "label": "params",
-            "description": [],
-            "signature": [
-              "TParams | undefined"
-            ],
-            "path": "src/plugins/expressions/common/types/common.ts",
-            "deprecated": false
-          }
-        ],
-        "initialIsOpen": false
       }
     ],
     "enums": [
@@ -10692,7 +10641,7 @@
           "\nThis type represents the `type` of any `DatatableColumn` in a `Datatable`.\nits duplicated from KBN_FIELD_TYPES"
         ],
         "signature": [
-          "\"string\" | \"number\" | \"boolean\" | \"object\" | \"date\" | \"_source\" | \"attachment\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"murmur3\" | \"unknown\" | \"conflict\" | \"nested\" | \"histogram\" | \"null\""
+          "\"string\" | \"number\" | \"boolean\" | \"object\" | \"_source\" | \"attachment\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"murmur3\" | \"unknown\" | \"conflict\" | \"nested\" | \"histogram\" | \"null\""
         ],
         "path": "src/plugins/expressions/common/expression_types/specs/datatable.ts",
         "deprecated": false,
@@ -11558,7 +11507,7 @@
           "\nThis can convert a type into a known Expression string representation of\nthat type. For example, `TypeToString<Datatable>` will resolve to `'datatable'`.\nThis allows Expression Functions to continue to specify their type in a\nsimple string format."
         ],
         "signature": [
-          "\"date\" | \"filter\" | ",
+          "\"filter\" | \"date\" | ",
           {
             "pluginId": "expressions",
             "scope": "common",
@@ -11582,7 +11531,7 @@
           "\nTypes used in Expressions that don't map to a primitive cleanly:\n\n`date` is typed as a number or string, and represents a date"
         ],
         "signature": [
-          "\"date\" | \"filter\""
+          "\"filter\" | \"date\""
         ],
         "path": "src/plugins/expressions/common/types/common.ts",
         "deprecated": false,
@@ -14170,7 +14119,7 @@
             "label": "types",
             "description": [],
             "signature": [
-              "(string[] & (\"date\" | \"filter\" | ",
+              "(string[] & (\"filter\" | \"date\" | ",
               {
                 "pluginId": "expressions",
                 "scope": "common",
@@ -14178,7 +14127,7 @@
                 "section": "def-common.KnownTypeToString",
                 "text": "KnownTypeToString"
               },
-              "<T>)[]) | (string[] & (\"date\" | \"filter\" | ArrayTypeToArgumentString<T>)[]) | (string[] & (\"date\" | \"filter\" | UnresolvedTypeToArgumentString<T>)[]) | (string[] & (\"date\" | \"filter\" | UnresolvedArrayTypeToArgumentString<T>)[]) | undefined"
+              "<T>)[]) | (string[] & (\"filter\" | \"date\" | ArrayTypeToArgumentString<T>)[]) | (string[] & (\"filter\" | \"date\" | UnresolvedTypeToArgumentString<T>)[]) | (string[] & (\"filter\" | \"date\" | UnresolvedArrayTypeToArgumentString<T>)[]) | undefined"
             ],
             "path": "src/plugins/expressions/common/expression_functions/expression_function_parameter.ts",
             "deprecated": false
@@ -17730,7 +17679,7 @@
               "\nName of type of value this function outputs."
             ],
             "signature": [
-              "\"date\" | \"filter\" | ",
+              "\"filter\" | \"date\" | ",
               {
                 "pluginId": "expressions",
                 "scope": "common",
@@ -19489,57 +19438,6 @@
           }
         ],
         "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "expressions",
-        "id": "def-server.SerializedFieldFormat",
-        "type": "Interface",
-        "tags": [],
-        "label": "SerializedFieldFormat",
-        "description": [
-          "\nJSON representation of a field formatter configuration.\nIs used to carry information about how to format data in\na data table as part of the column definition."
-        ],
-        "signature": [
-          {
-            "pluginId": "expressions",
-            "scope": "common",
-            "docId": "kibExpressionsPluginApi",
-            "section": "def-common.SerializedFieldFormat",
-            "text": "SerializedFieldFormat"
-          },
-          "<TParams>"
-        ],
-        "path": "src/plugins/expressions/common/types/common.ts",
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "expressions",
-            "id": "def-server.SerializedFieldFormat.id",
-            "type": "string",
-            "tags": [],
-            "label": "id",
-            "description": [],
-            "signature": [
-              "string | undefined"
-            ],
-            "path": "src/plugins/expressions/common/types/common.ts",
-            "deprecated": false
-          },
-          {
-            "parentPluginId": "expressions",
-            "id": "def-server.SerializedFieldFormat.params",
-            "type": "Uncategorized",
-            "tags": [],
-            "label": "params",
-            "description": [],
-            "signature": [
-              "TParams | undefined"
-            ],
-            "path": "src/plugins/expressions/common/types/common.ts",
-            "deprecated": false
-          }
-        ],
-        "initialIsOpen": false
       }
     ],
     "enums": [
@@ -19704,7 +19602,7 @@
           "\nThis type represents the `type` of any `DatatableColumn` in a `Datatable`.\nits duplicated from KBN_FIELD_TYPES"
         ],
         "signature": [
-          "\"string\" | \"number\" | \"boolean\" | \"object\" | \"date\" | \"_source\" | \"attachment\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"murmur3\" | \"unknown\" | \"conflict\" | \"nested\" | \"histogram\" | \"null\""
+          "\"string\" | \"number\" | \"boolean\" | \"object\" | \"_source\" | \"attachment\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"murmur3\" | \"unknown\" | \"conflict\" | \"nested\" | \"histogram\" | \"null\""
         ],
         "path": "src/plugins/expressions/common/expression_types/specs/datatable.ts",
         "deprecated": false,
@@ -20468,7 +20366,7 @@
           "\nThis can convert a type into a known Expression string representation of\nthat type. For example, `TypeToString<Datatable>` will resolve to `'datatable'`.\nThis allows Expression Functions to continue to specify their type in a\nsimple string format."
         ],
         "signature": [
-          "\"date\" | \"filter\" | ",
+          "\"filter\" | \"date\" | ",
           {
             "pluginId": "expressions",
             "scope": "common",
@@ -20492,7 +20390,7 @@
           "\nTypes used in Expressions that don't map to a primitive cleanly:\n\n`date` is typed as a number or string, and represents a date"
         ],
         "signature": [
-          "\"date\" | \"filter\""
+          "\"filter\" | \"date\""
         ],
         "path": "src/plugins/expressions/common/types/common.ts",
         "deprecated": false,
@@ -23037,7 +22935,7 @@
             "label": "types",
             "description": [],
             "signature": [
-              "(string[] & (\"date\" | \"filter\" | ",
+              "(string[] & (\"filter\" | \"date\" | ",
               {
                 "pluginId": "expressions",
                 "scope": "common",
@@ -23045,7 +22943,7 @@
                 "section": "def-common.KnownTypeToString",
                 "text": "KnownTypeToString"
               },
-              "<T>)[]) | (string[] & (\"date\" | \"filter\" | ArrayTypeToArgumentString<T>)[]) | (string[] & (\"date\" | \"filter\" | UnresolvedTypeToArgumentString<T>)[]) | (string[] & (\"date\" | \"filter\" | UnresolvedArrayTypeToArgumentString<T>)[]) | undefined"
+              "<T>)[]) | (string[] & (\"filter\" | \"date\" | ArrayTypeToArgumentString<T>)[]) | (string[] & (\"filter\" | \"date\" | UnresolvedTypeToArgumentString<T>)[]) | (string[] & (\"filter\" | \"date\" | UnresolvedArrayTypeToArgumentString<T>)[]) | undefined"
             ],
             "path": "src/plugins/expressions/common/expression_functions/expression_function_parameter.ts",
             "deprecated": false
@@ -27529,7 +27427,7 @@
             "label": "type",
             "description": [],
             "signature": [
-              "\"string\" | \"number\" | \"boolean\" | \"object\" | \"date\" | \"_source\" | \"attachment\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"murmur3\" | \"unknown\" | \"conflict\" | \"nested\" | \"histogram\" | \"null\""
+              "\"string\" | \"number\" | \"boolean\" | \"object\" | \"_source\" | \"attachment\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"murmur3\" | \"unknown\" | \"conflict\" | \"nested\" | \"histogram\" | \"null\""
             ],
             "path": "src/plugins/expressions/common/expression_types/specs/datatable.ts",
             "deprecated": false
@@ -27590,13 +27488,21 @@
             ],
             "signature": [
               {
-                "pluginId": "expressions",
+                "pluginId": "fieldFormats",
                 "scope": "common",
-                "docId": "kibExpressionsPluginApi",
+                "docId": "kibFieldFormatsPluginApi",
                 "section": "def-common.SerializedFieldFormat",
                 "text": "SerializedFieldFormat"
               },
-              "<Record<string, any>> | undefined"
+              "<",
+              {
+                "pluginId": "fieldFormats",
+                "scope": "common",
+                "docId": "kibFieldFormatsPluginApi",
+                "section": "def-common.FieldFormatParams",
+                "text": "FieldFormatParams"
+              },
+              "> | undefined"
             ],
             "path": "src/plugins/expressions/common/expression_types/specs/datatable.ts",
             "deprecated": false
@@ -29657,7 +29563,7 @@
               "\nName of type of value this function outputs."
             ],
             "signature": [
-              "\"date\" | \"filter\" | ",
+              "\"filter\" | \"date\" | ",
               {
                 "pluginId": "expressions",
                 "scope": "common",
@@ -32751,57 +32657,6 @@
         ],
         "initialIsOpen": false
       },
-      {
-        "parentPluginId": "expressions",
-        "id": "def-common.SerializedFieldFormat",
-        "type": "Interface",
-        "tags": [],
-        "label": "SerializedFieldFormat",
-        "description": [
-          "\nJSON representation of a field formatter configuration.\nIs used to carry information about how to format data in\na data table as part of the column definition."
-        ],
-        "signature": [
-          {
-            "pluginId": "expressions",
-            "scope": "common",
-            "docId": "kibExpressionsPluginApi",
-            "section": "def-common.SerializedFieldFormat",
-            "text": "SerializedFieldFormat"
-          },
-          "<TParams>"
-        ],
-        "path": "src/plugins/expressions/common/types/common.ts",
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "expressions",
-            "id": "def-common.SerializedFieldFormat.id",
-            "type": "string",
-            "tags": [],
-            "label": "id",
-            "description": [],
-            "signature": [
-              "string | undefined"
-            ],
-            "path": "src/plugins/expressions/common/types/common.ts",
-            "deprecated": false
-          },
-          {
-            "parentPluginId": "expressions",
-            "id": "def-common.SerializedFieldFormat.params",
-            "type": "Uncategorized",
-            "tags": [],
-            "label": "params",
-            "description": [],
-            "signature": [
-              "TParams | undefined"
-            ],
-            "path": "src/plugins/expressions/common/types/common.ts",
-            "deprecated": false
-          }
-        ],
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "expressions",
         "id": "def-common.UiSettingArguments",
@@ -33048,7 +32903,7 @@
           "\nThis type represents the `type` of any `DatatableColumn` in a `Datatable`.\nits duplicated from KBN_FIELD_TYPES"
         ],
         "signature": [
-          "\"string\" | \"number\" | \"boolean\" | \"object\" | \"date\" | \"_source\" | \"attachment\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"murmur3\" | \"unknown\" | \"conflict\" | \"nested\" | \"histogram\" | \"null\""
+          "\"string\" | \"number\" | \"boolean\" | \"object\" | \"_source\" | \"attachment\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"murmur3\" | \"unknown\" | \"conflict\" | \"nested\" | \"histogram\" | \"null\""
         ],
         "path": "src/plugins/expressions/common/expression_types/specs/datatable.ts",
         "deprecated": false,
@@ -34684,7 +34539,7 @@
           "\nThis can convert a type into a known Expression string representation of\nthat type. For example, `TypeToString<Datatable>` will resolve to `'datatable'`.\nThis allows Expression Functions to continue to specify their type in a\nsimple string format."
         ],
         "signature": [
-          "\"date\" | \"filter\" | ",
+          "\"filter\" | \"date\" | ",
           {
             "pluginId": "expressions",
             "scope": "common",
@@ -34722,7 +34577,7 @@
           "\nTypes used in Expressions that don't map to a primitive cleanly:\n\n`date` is typed as a number or string, and represents a date"
         ],
         "signature": [
-          "\"date\" | \"filter\""
+          "\"filter\" | \"date\""
         ],
         "path": "src/plugins/expressions/common/types/common.ts",
         "deprecated": false,
diff --git a/api_docs/expressions.mdx b/api_docs/expressions.mdx
index 82b35631ddfe18..9f086cc496faf7 100644
--- a/api_docs/expressions.mdx
+++ b/api_docs/expressions.mdx
@@ -18,7 +18,7 @@ Contact [App Services](https://github.com/orgs/elastic/teams/kibana-app-services
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 2095 | 27 | 1646 | 4 |
+| 2086 | 27 | 1640 | 4 |
 
 ## Client
 
diff --git a/api_docs/fleet.json b/api_docs/fleet.json
index 0bdb078d6f70db..b50a2f598b9267 100644
--- a/api_docs/fleet.json
+++ b/api_docs/fleet.json
@@ -2624,7 +2624,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, id: string, withPackagePolicies?: boolean) => Promise<",
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, id: string, withPackagePolicies?: boolean) => Promise<",
               {
                 "pluginId": "fleet",
                 "scope": "common",
@@ -2646,25 +2646,7 @@
                 "label": "soClient",
                 "description": [],
                 "signature": [
-                  "{ get: <T = unknown>(type: string, id: string, options?: ",
-                  {
-                    "pluginId": "core",
-                    "scope": "server",
-                    "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-server.SavedObjectsBaseOptions",
-                    "text": "SavedObjectsBaseOptions"
-                  },
-                  ") => Promise<",
-                  "SavedObject",
-                  "<T>>; delete: (type: string, id: string, options?: ",
-                  {
-                    "pluginId": "core",
-                    "scope": "server",
-                    "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-server.SavedObjectsDeleteOptions",
-                    "text": "SavedObjectsDeleteOptions"
-                  },
-                  ") => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: ",
+                  "{ create: <T = unknown>(type: string, attributes: T, options?: ",
                   {
                     "pluginId": "core",
                     "scope": "server",
@@ -2722,7 +2704,15 @@
                     "section": "def-server.SavedObjectsCheckConflictsResponse",
                     "text": "SavedObjectsCheckConflictsResponse"
                   },
-                  ">; find: <T = unknown, A = unknown>(options: ",
+                  ">; delete: (type: string, id: string, options?: ",
+                  {
+                    "pluginId": "core",
+                    "scope": "server",
+                    "docId": "kibCoreSavedObjectsPluginApi",
+                    "section": "def-server.SavedObjectsDeleteOptions",
+                    "text": "SavedObjectsDeleteOptions"
+                  },
+                  ") => Promise<{}>; find: <T = unknown, A = unknown>(options: ",
                   {
                     "pluginId": "core",
                     "scope": "server",
@@ -2786,6 +2776,16 @@
                     "section": "def-server.SavedObjectsBulkResolveResponse",
                     "text": "SavedObjectsBulkResolveResponse"
                   },
+                  "<T>>; get: <T = unknown>(type: string, id: string, options?: ",
+                  {
+                    "pluginId": "core",
+                    "scope": "server",
+                    "docId": "kibCoreSavedObjectsPluginApi",
+                    "section": "def-server.SavedObjectsBaseOptions",
+                    "text": "SavedObjectsBaseOptions"
+                  },
+                  ") => Promise<",
+                  "SavedObject",
                   "<T>>; resolve: <T = unknown>(type: string, id: string, options?: ",
                   {
                     "pluginId": "core",
@@ -3013,7 +3013,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, options: Readonly<{ page?: number | undefined; perPage?: number | undefined; sortField?: string | undefined; sortOrder?: \"asc\" | \"desc\" | undefined; kuery?: any; showUpgradeable?: boolean | undefined; } & {}> & { withPackagePolicies?: boolean | undefined; }) => Promise<{ items: ",
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, options: Readonly<{ page?: number | undefined; perPage?: number | undefined; sortField?: string | undefined; sortOrder?: \"asc\" | \"desc\" | undefined; kuery?: any; showUpgradeable?: boolean | undefined; } & {}> & { withPackagePolicies?: boolean | undefined; }) => Promise<{ items: ",
               {
                 "pluginId": "fleet",
                 "scope": "common",
@@ -3035,25 +3035,7 @@
                 "label": "soClient",
                 "description": [],
                 "signature": [
-                  "{ get: <T = unknown>(type: string, id: string, options?: ",
-                  {
-                    "pluginId": "core",
-                    "scope": "server",
-                    "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-server.SavedObjectsBaseOptions",
-                    "text": "SavedObjectsBaseOptions"
-                  },
-                  ") => Promise<",
-                  "SavedObject",
-                  "<T>>; delete: (type: string, id: string, options?: ",
-                  {
-                    "pluginId": "core",
-                    "scope": "server",
-                    "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-server.SavedObjectsDeleteOptions",
-                    "text": "SavedObjectsDeleteOptions"
-                  },
-                  ") => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: ",
+                  "{ create: <T = unknown>(type: string, attributes: T, options?: ",
                   {
                     "pluginId": "core",
                     "scope": "server",
@@ -3111,7 +3093,15 @@
                     "section": "def-server.SavedObjectsCheckConflictsResponse",
                     "text": "SavedObjectsCheckConflictsResponse"
                   },
-                  ">; find: <T = unknown, A = unknown>(options: ",
+                  ">; delete: (type: string, id: string, options?: ",
+                  {
+                    "pluginId": "core",
+                    "scope": "server",
+                    "docId": "kibCoreSavedObjectsPluginApi",
+                    "section": "def-server.SavedObjectsDeleteOptions",
+                    "text": "SavedObjectsDeleteOptions"
+                  },
+                  ") => Promise<{}>; find: <T = unknown, A = unknown>(options: ",
                   {
                     "pluginId": "core",
                     "scope": "server",
@@ -3175,6 +3165,16 @@
                     "section": "def-server.SavedObjectsBulkResolveResponse",
                     "text": "SavedObjectsBulkResolveResponse"
                   },
+                  "<T>>; get: <T = unknown>(type: string, id: string, options?: ",
+                  {
+                    "pluginId": "core",
+                    "scope": "server",
+                    "docId": "kibCoreSavedObjectsPluginApi",
+                    "section": "def-server.SavedObjectsBaseOptions",
+                    "text": "SavedObjectsBaseOptions"
+                  },
+                  ") => Promise<",
+                  "SavedObject",
                   "<T>>; resolve: <T = unknown>(type: string, id: string, options?: ",
                   {
                     "pluginId": "core",
@@ -3395,7 +3395,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => Promise<string>"
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => Promise<string>"
             ],
             "path": "x-pack/plugins/fleet/server/services/index.ts",
             "deprecated": false,
@@ -3409,25 +3409,7 @@
                 "label": "soClient",
                 "description": [],
                 "signature": [
-                  "{ get: <T = unknown>(type: string, id: string, options?: ",
-                  {
-                    "pluginId": "core",
-                    "scope": "server",
-                    "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-server.SavedObjectsBaseOptions",
-                    "text": "SavedObjectsBaseOptions"
-                  },
-                  ") => Promise<",
-                  "SavedObject",
-                  "<T>>; delete: (type: string, id: string, options?: ",
-                  {
-                    "pluginId": "core",
-                    "scope": "server",
-                    "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-server.SavedObjectsDeleteOptions",
-                    "text": "SavedObjectsDeleteOptions"
-                  },
-                  ") => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: ",
+                  "{ create: <T = unknown>(type: string, attributes: T, options?: ",
                   {
                     "pluginId": "core",
                     "scope": "server",
@@ -3485,7 +3467,15 @@
                     "section": "def-server.SavedObjectsCheckConflictsResponse",
                     "text": "SavedObjectsCheckConflictsResponse"
                   },
-                  ">; find: <T = unknown, A = unknown>(options: ",
+                  ">; delete: (type: string, id: string, options?: ",
+                  {
+                    "pluginId": "core",
+                    "scope": "server",
+                    "docId": "kibCoreSavedObjectsPluginApi",
+                    "section": "def-server.SavedObjectsDeleteOptions",
+                    "text": "SavedObjectsDeleteOptions"
+                  },
+                  ") => Promise<{}>; find: <T = unknown, A = unknown>(options: ",
                   {
                     "pluginId": "core",
                     "scope": "server",
@@ -3549,6 +3539,16 @@
                     "section": "def-server.SavedObjectsBulkResolveResponse",
                     "text": "SavedObjectsBulkResolveResponse"
                   },
+                  "<T>>; get: <T = unknown>(type: string, id: string, options?: ",
+                  {
+                    "pluginId": "core",
+                    "scope": "server",
+                    "docId": "kibCoreSavedObjectsPluginApi",
+                    "section": "def-server.SavedObjectsBaseOptions",
+                    "text": "SavedObjectsBaseOptions"
+                  },
+                  ") => Promise<",
+                  "SavedObject",
                   "<T>>; resolve: <T = unknown>(type: string, id: string, options?: ",
                   {
                     "pluginId": "core",
@@ -3756,7 +3756,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, id: string, options?: { standalone: boolean; } | undefined) => Promise<",
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, id: string, options?: { standalone: boolean; } | undefined) => Promise<",
               {
                 "pluginId": "fleet",
                 "scope": "common",
@@ -3778,25 +3778,7 @@
                 "label": "soClient",
                 "description": [],
                 "signature": [
-                  "{ get: <T = unknown>(type: string, id: string, options?: ",
-                  {
-                    "pluginId": "core",
-                    "scope": "server",
-                    "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-server.SavedObjectsBaseOptions",
-                    "text": "SavedObjectsBaseOptions"
-                  },
-                  ") => Promise<",
-                  "SavedObject",
-                  "<T>>; delete: (type: string, id: string, options?: ",
-                  {
-                    "pluginId": "core",
-                    "scope": "server",
-                    "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-server.SavedObjectsDeleteOptions",
-                    "text": "SavedObjectsDeleteOptions"
-                  },
-                  ") => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: ",
+                  "{ create: <T = unknown>(type: string, attributes: T, options?: ",
                   {
                     "pluginId": "core",
                     "scope": "server",
@@ -3854,7 +3836,15 @@
                     "section": "def-server.SavedObjectsCheckConflictsResponse",
                     "text": "SavedObjectsCheckConflictsResponse"
                   },
-                  ">; find: <T = unknown, A = unknown>(options: ",
+                  ">; delete: (type: string, id: string, options?: ",
+                  {
+                    "pluginId": "core",
+                    "scope": "server",
+                    "docId": "kibCoreSavedObjectsPluginApi",
+                    "section": "def-server.SavedObjectsDeleteOptions",
+                    "text": "SavedObjectsDeleteOptions"
+                  },
+                  ") => Promise<{}>; find: <T = unknown, A = unknown>(options: ",
                   {
                     "pluginId": "core",
                     "scope": "server",
@@ -3918,6 +3908,16 @@
                     "section": "def-server.SavedObjectsBulkResolveResponse",
                     "text": "SavedObjectsBulkResolveResponse"
                   },
+                  "<T>>; get: <T = unknown>(type: string, id: string, options?: ",
+                  {
+                    "pluginId": "core",
+                    "scope": "server",
+                    "docId": "kibCoreSavedObjectsPluginApi",
+                    "section": "def-server.SavedObjectsBaseOptions",
+                    "text": "SavedObjectsBaseOptions"
+                  },
+                  ") => Promise<",
+                  "SavedObject",
                   "<T>>; resolve: <T = unknown>(type: string, id: string, options?: ",
                   {
                     "pluginId": "core",
@@ -4148,7 +4148,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, ids: string[], options?: { fields?: string[] | undefined; }) => Promise<",
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, ids: string[], options?: { fields?: string[] | undefined; }) => Promise<",
               {
                 "pluginId": "fleet",
                 "scope": "common",
@@ -4170,25 +4170,7 @@
                 "label": "soClient",
                 "description": [],
                 "signature": [
-                  "{ get: <T = unknown>(type: string, id: string, options?: ",
-                  {
-                    "pluginId": "core",
-                    "scope": "server",
-                    "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-server.SavedObjectsBaseOptions",
-                    "text": "SavedObjectsBaseOptions"
-                  },
-                  ") => Promise<",
-                  "SavedObject",
-                  "<T>>; delete: (type: string, id: string, options?: ",
-                  {
-                    "pluginId": "core",
-                    "scope": "server",
-                    "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-server.SavedObjectsDeleteOptions",
-                    "text": "SavedObjectsDeleteOptions"
-                  },
-                  ") => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: ",
+                  "{ create: <T = unknown>(type: string, attributes: T, options?: ",
                   {
                     "pluginId": "core",
                     "scope": "server",
@@ -4246,7 +4228,15 @@
                     "section": "def-server.SavedObjectsCheckConflictsResponse",
                     "text": "SavedObjectsCheckConflictsResponse"
                   },
-                  ">; find: <T = unknown, A = unknown>(options: ",
+                  ">; delete: (type: string, id: string, options?: ",
+                  {
+                    "pluginId": "core",
+                    "scope": "server",
+                    "docId": "kibCoreSavedObjectsPluginApi",
+                    "section": "def-server.SavedObjectsDeleteOptions",
+                    "text": "SavedObjectsDeleteOptions"
+                  },
+                  ") => Promise<{}>; find: <T = unknown, A = unknown>(options: ",
                   {
                     "pluginId": "core",
                     "scope": "server",
@@ -4310,6 +4300,16 @@
                     "section": "def-server.SavedObjectsBulkResolveResponse",
                     "text": "SavedObjectsBulkResolveResponse"
                   },
+                  "<T>>; get: <T = unknown>(type: string, id: string, options?: ",
+                  {
+                    "pluginId": "core",
+                    "scope": "server",
+                    "docId": "kibCoreSavedObjectsPluginApi",
+                    "section": "def-server.SavedObjectsBaseOptions",
+                    "text": "SavedObjectsBaseOptions"
+                  },
+                  ") => Promise<",
+                  "SavedObject",
                   "<T>>; resolve: <T = unknown>(type: string, id: string, options?: ",
                   {
                     "pluginId": "core",
@@ -4584,7 +4584,7 @@
                 "signature": [
                   "Pick<",
                   "KibanaClient",
-                  ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
+                  ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
                   "TransportRequestParams",
                   ", options?: ",
                   "TransportRequestOptions",
@@ -4876,7 +4876,7 @@
                 "signature": [
                   "Pick<",
                   "KibanaClient",
-                  ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
+                  ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
                   "TransportRequestParams",
                   ", options?: ",
                   "TransportRequestOptions",
@@ -5231,7 +5231,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, pkgName: string, datasetPath: string) => Promise<string | undefined>"
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, pkgName: string, datasetPath: string) => Promise<string | undefined>"
             ],
             "path": "x-pack/plugins/fleet/server/services/index.ts",
             "deprecated": false,
@@ -5252,7 +5252,7 @@
                     "section": "def-server.SavedObjectsClient",
                     "text": "SavedObjectsClient"
                   },
-                  ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+                  ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
                 ],
                 "path": "x-pack/plugins/fleet/server/services/index.ts",
                 "deprecated": false,
@@ -5451,7 +5451,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; pkgName: string; }) => Promise<",
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; pkgName: string; }) => Promise<",
               {
                 "pluginId": "fleet",
                 "scope": "common",
@@ -5481,7 +5481,7 @@
                     "section": "def-server.SavedObjectsClient",
                     "text": "SavedObjectsClient"
                   },
-                  ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; pkgName: string; }"
+                  ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; pkgName: string; }"
                 ],
                 "path": "x-pack/plugins/fleet/server/services/epm/packages/get.ts",
                 "deprecated": false
@@ -6579,7 +6579,7 @@
             "section": "def-common.RegistryPackage",
             "text": "RegistryPackage"
           },
-          ", \"type\" | \"title\" | \"description\" | \"icons\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"installed\"; savedObject: ",
+          ", \"type\" | \"title\" | \"description\" | \"icons\" | \"categories\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"installed\"; savedObject: ",
           "SavedObject",
           "<",
           {
@@ -6597,7 +6597,7 @@
             "section": "def-common.RegistryPackage",
             "text": "RegistryPackage"
           },
-          ", \"type\" | \"title\" | \"description\" | \"icons\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"installing\"; savedObject: ",
+          ", \"type\" | \"title\" | \"description\" | \"icons\" | \"categories\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"installing\"; savedObject: ",
           "SavedObject",
           "<",
           {
@@ -6615,7 +6615,7 @@
             "section": "def-common.RegistryPackage",
             "text": "RegistryPackage"
           },
-          ", \"type\" | \"title\" | \"description\" | \"icons\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"not_installed\"; } & { integration?: string | undefined; id: string; }) | (Pick<",
+          ", \"type\" | \"title\" | \"description\" | \"icons\" | \"categories\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"not_installed\"; } & { integration?: string | undefined; id: string; }) | (Pick<",
           {
             "pluginId": "fleet",
             "scope": "common",
@@ -6623,7 +6623,7 @@
             "section": "def-common.RegistryPackage",
             "text": "RegistryPackage"
           },
-          ", \"type\" | \"title\" | \"description\" | \"icons\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"install_failed\"; } & { integration?: string | undefined; id: string; })) => boolean"
+          ", \"type\" | \"title\" | \"description\" | \"icons\" | \"categories\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"install_failed\"; } & { integration?: string | undefined; id: string; })) => boolean"
         ],
         "path": "x-pack/plugins/fleet/common/services/packages_with_integrations.ts",
         "deprecated": false,
@@ -6835,7 +6835,7 @@
                 "section": "def-common.RegistryPackage",
                 "text": "RegistryPackage"
               },
-              ", \"type\" | \"title\" | \"description\" | \"icons\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"installed\"; savedObject: ",
+              ", \"type\" | \"title\" | \"description\" | \"icons\" | \"categories\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"installed\"; savedObject: ",
               "SavedObject",
               "<",
               {
@@ -6853,7 +6853,7 @@
                 "section": "def-common.RegistryPackage",
                 "text": "RegistryPackage"
               },
-              ", \"type\" | \"title\" | \"description\" | \"icons\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"installing\"; savedObject: ",
+              ", \"type\" | \"title\" | \"description\" | \"icons\" | \"categories\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"installing\"; savedObject: ",
               "SavedObject",
               "<",
               {
@@ -6871,7 +6871,7 @@
                 "section": "def-common.RegistryPackage",
                 "text": "RegistryPackage"
               },
-              ", \"type\" | \"title\" | \"description\" | \"icons\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"not_installed\"; } & { integration?: string | undefined; id: string; }) | (Pick<",
+              ", \"type\" | \"title\" | \"description\" | \"icons\" | \"categories\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"not_installed\"; } & { integration?: string | undefined; id: string; }) | (Pick<",
               {
                 "pluginId": "fleet",
                 "scope": "common",
@@ -6879,7 +6879,7 @@
                 "section": "def-common.RegistryPackage",
                 "text": "RegistryPackage"
               },
-              ", \"type\" | \"title\" | \"description\" | \"icons\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"install_failed\"; } & { integration?: string | undefined; id: string; })"
+              ", \"type\" | \"title\" | \"description\" | \"icons\" | \"categories\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"install_failed\"; } & { integration?: string | undefined; id: string; })"
             ],
             "path": "x-pack/plugins/fleet/common/services/packages_with_integrations.ts",
             "deprecated": false,
@@ -7854,7 +7854,7 @@
             "label": "status",
             "description": [],
             "signature": [
-              "\"warning\" | \"offline\" | \"online\" | \"error\" | \"inactive\" | \"enrolling\" | \"unenrolling\" | \"updating\" | \"degraded\" | undefined"
+              "\"offline\" | \"online\" | \"error\" | \"warning\" | \"inactive\" | \"enrolling\" | \"unenrolling\" | \"updating\" | \"degraded\" | undefined"
             ],
             "path": "x-pack/plugins/fleet/common/types/models/agent.ts",
             "deprecated": false
@@ -11241,7 +11241,7 @@
             "label": "missing_requirements",
             "description": [],
             "signature": [
-              "(\"fleet_server\" | \"tls_required\" | \"api_keys\" | \"fleet_admin_user\" | \"encrypted_saved_object_encryption_key_required\")[]"
+              "(\"fleet_server\" | \"security_required\" | \"tls_required\" | \"api_keys\" | \"fleet_admin_user\" | \"encrypted_saved_object_encryption_key_required\")[]"
             ],
             "path": "x-pack/plugins/fleet/common/types/rest_spec/fleet_setup.ts",
             "deprecated": false
@@ -12795,6 +12795,19 @@
             "description": [],
             "path": "x-pack/plugins/fleet/common/types/models/epm.ts",
             "deprecated": false
+          },
+          {
+            "parentPluginId": "fleet",
+            "id": "def-common.IntegrationCardItem.categories",
+            "type": "Array",
+            "tags": [],
+            "label": "categories",
+            "description": [],
+            "signature": [
+              "string[]"
+            ],
+            "path": "x-pack/plugins/fleet/common/types/models/epm.ts",
+            "deprecated": false
           }
         ],
         "initialIsOpen": false
@@ -13668,7 +13681,7 @@
             "section": "def-common.NewPackagePolicy",
             "text": "NewPackagePolicy"
           },
-          ", \"enabled\" | \"description\" | \"name\" | \"package\" | \"policy_id\" | \"namespace\" | \"output_id\" | \"vars\">"
+          ", \"description\" | \"name\" | \"enabled\" | \"package\" | \"policy_id\" | \"namespace\" | \"output_id\" | \"vars\">"
         ],
         "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
         "deprecated": false,
@@ -14857,7 +14870,7 @@
                 "section": "def-common.NewPackagePolicy",
                 "text": "NewPackagePolicy"
               },
-              ", \"enabled\" | \"description\" | \"name\" | \"policy_id\" | \"namespace\" | \"output_id\" | \"vars\">> & { name: string; package: Partial<",
+              ", \"description\" | \"name\" | \"enabled\" | \"policy_id\" | \"namespace\" | \"output_id\" | \"vars\">> & { name: string; package: Partial<",
               {
                 "pluginId": "fleet",
                 "scope": "common",
@@ -17011,7 +17024,7 @@
         "label": "AgentStatus",
         "description": [],
         "signature": [
-          "\"warning\" | \"offline\" | \"online\" | \"error\" | \"inactive\" | \"enrolling\" | \"unenrolling\" | \"updating\" | \"degraded\""
+          "\"offline\" | \"online\" | \"error\" | \"warning\" | \"inactive\" | \"enrolling\" | \"unenrolling\" | \"updating\" | \"degraded\""
         ],
         "path": "x-pack/plugins/fleet/common/types/models/agent.ts",
         "deprecated": false,
@@ -17662,6 +17675,20 @@
         "deprecated": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "fleet",
+        "id": "def-common.FLEET_APM_PACKAGE",
+        "type": "string",
+        "tags": [],
+        "label": "FLEET_APM_PACKAGE",
+        "description": [],
+        "signature": [
+          "\"apm\""
+        ],
+        "path": "x-pack/plugins/fleet/common/constants/epm.ts",
+        "deprecated": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "fleet",
         "id": "def-common.FLEET_ELASTIC_AGENT_PACKAGE",
@@ -17760,6 +17787,20 @@
         "deprecated": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "fleet",
+        "id": "def-common.FLEET_SYNTHETICS_PACKAGE",
+        "type": "string",
+        "tags": [],
+        "label": "FLEET_SYNTHETICS_PACKAGE",
+        "description": [],
+        "signature": [
+          "\"synthetics\""
+        ],
+        "path": "x-pack/plugins/fleet/common/constants/epm.ts",
+        "deprecated": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "fleet",
         "id": "def-common.FLEET_SYSTEM_PACKAGE",
@@ -18639,7 +18680,7 @@
             "section": "def-common.RegistryPackage",
             "text": "RegistryPackage"
           },
-          ", \"type\" | \"title\" | \"description\" | \"icons\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"installed\"; savedObject: ",
+          ", \"type\" | \"title\" | \"description\" | \"icons\" | \"categories\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"installed\"; savedObject: ",
           "SavedObject",
           "<",
           {
@@ -18657,7 +18698,7 @@
             "section": "def-common.RegistryPackage",
             "text": "RegistryPackage"
           },
-          ", \"type\" | \"title\" | \"description\" | \"icons\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"installing\"; savedObject: ",
+          ", \"type\" | \"title\" | \"description\" | \"icons\" | \"categories\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"installing\"; savedObject: ",
           "SavedObject",
           "<",
           {
@@ -18675,7 +18716,7 @@
             "section": "def-common.RegistryPackage",
             "text": "RegistryPackage"
           },
-          ", \"type\" | \"title\" | \"description\" | \"icons\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"not_installed\"; } & { integration?: string | undefined; id: string; }) | (Pick<",
+          ", \"type\" | \"title\" | \"description\" | \"icons\" | \"categories\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"not_installed\"; } & { integration?: string | undefined; id: string; }) | (Pick<",
           {
             "pluginId": "fleet",
             "scope": "common",
@@ -18683,7 +18724,7 @@
             "section": "def-common.RegistryPackage",
             "text": "RegistryPackage"
           },
-          ", \"type\" | \"title\" | \"description\" | \"icons\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"install_failed\"; } & { integration?: string | undefined; id: string; })"
+          ", \"type\" | \"title\" | \"description\" | \"icons\" | \"categories\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\"> & { status: \"install_failed\"; } & { integration?: string | undefined; id: string; })"
         ],
         "path": "x-pack/plugins/fleet/common/types/models/epm.ts",
         "deprecated": false,
@@ -18748,7 +18789,7 @@
         "label": "PackagePolicySOAttributes",
         "description": [],
         "signature": [
-          "{ enabled: boolean; description?: string | undefined; name: string; package?: ",
+          "{ description?: string | undefined; name: string; enabled: boolean; package?: ",
           {
             "pluginId": "fleet",
             "scope": "common",
@@ -19074,7 +19115,7 @@
             "section": "def-common.RegistryImage",
             "text": "RegistryImage"
           },
-          "[]) | undefined; name: string; version: string; path: string; download: string; internal?: boolean | undefined; data_streams?: ",
+          "[]) | undefined; categories?: (\"custom\" | \"aws\" | \"azure\" | \"cloud\" | \"config_management\" | \"containers\" | \"crm\" | \"datastore\" | \"elastic_stack\" | \"google_cloud\" | \"kubernetes\" | \"languages\" | \"message_queue\" | \"monitoring\" | \"network\" | \"notification\" | \"os_system\" | \"productivity\" | \"security\" | \"support\" | \"ticketing\" | \"version_control\" | \"web\" | undefined)[] | undefined; name: string; version: string; path: string; download: string; internal?: boolean | undefined; data_streams?: ",
           {
             "pluginId": "fleet",
             "scope": "common",
@@ -19112,7 +19153,7 @@
             "section": "def-common.RegistryPackage",
             "text": "RegistryPackage"
           },
-          ", \"type\" | \"title\" | \"description\" | \"icons\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\">[]"
+          ", \"type\" | \"title\" | \"description\" | \"icons\" | \"categories\" | \"name\" | \"version\" | \"path\" | \"download\" | \"internal\" | \"data_streams\" | \"release\" | \"policy_templates\">[]"
         ],
         "path": "x-pack/plugins/fleet/common/types/models/epm.ts",
         "deprecated": false,
diff --git a/api_docs/fleet.mdx b/api_docs/fleet.mdx
index 88d006982d0f07..3d01ccbb559a17 100644
--- a/api_docs/fleet.mdx
+++ b/api_docs/fleet.mdx
@@ -18,7 +18,7 @@ Contact [Fleet](https://github.com/orgs/elastic/teams/fleet) for questions regar
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 1207 | 15 | 1107 | 10 |
+| 1210 | 15 | 1110 | 10 |
 
 ## Client
 
diff --git a/api_docs/global_search.json b/api_docs/global_search.json
index a8b5ca35c634e0..7dd6198974f6c7 100644
--- a/api_docs/global_search.json
+++ b/api_docs/global_search.json
@@ -625,7 +625,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; typeRegistry: Pick<",
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; typeRegistry: Pick<",
               {
                 "pluginId": "core",
                 "scope": "server",
diff --git a/api_docs/home.json b/api_docs/home.json
index 585bd6b18d07ba..1bda24024cf7c3 100644
--- a/api_docs/home.json
+++ b/api_docs/home.json
@@ -959,7 +959,7 @@
         "label": "InstructionsSchema",
         "description": [],
         "signature": [
-          "{ readonly params?: Readonly<{ defaultValue?: any; } & { type: \"string\" | \"number\"; label: string; id: string; }>[] | undefined; readonly instructionSets: Readonly<{ title?: string | undefined; callOut?: Readonly<{ iconType?: string | undefined; message?: string | undefined; } & { title: string; }> | undefined; statusCheck?: Readonly<{ title?: string | undefined; text?: string | undefined; error?: string | undefined; success?: string | undefined; btnLabel?: string | undefined; } & { esHitsCheck: Readonly<{} & { query: Record<string, any>; index: string | string[]; }>; }> | undefined; } & { instructionVariants: Readonly<{} & { id: string; instructions: Readonly<{ title?: string | undefined; commands?: string[] | undefined; textPre?: string | undefined; textPost?: string | undefined; customComponentName?: string | undefined; } & {}>[]; }>[]; }>[]; }"
+          "{ readonly params?: Readonly<{ defaultValue?: any; } & { label: string; type: \"string\" | \"number\"; id: string; }>[] | undefined; readonly instructionSets: Readonly<{ title?: string | undefined; callOut?: Readonly<{ iconType?: string | undefined; message?: string | undefined; } & { title: string; }> | undefined; statusCheck?: Readonly<{ title?: string | undefined; text?: string | undefined; error?: string | undefined; success?: string | undefined; btnLabel?: string | undefined; } & { esHitsCheck: Readonly<{} & { query: Record<string, any>; index: string | string[]; }>; }> | undefined; } & { instructionVariants: Readonly<{} & { id: string; instructions: Readonly<{ title?: string | undefined; commands?: string[] | undefined; textPre?: string | undefined; textPost?: string | undefined; customComponentName?: string | undefined; } & {}>[]; }>[]; }>[]; }"
         ],
         "path": "src/plugins/home/server/services/tutorials/lib/tutorial_schema.ts",
         "deprecated": false,
@@ -981,7 +981,7 @@
             "section": "def-server.Writable",
             "text": "Writable"
           },
-          "<Readonly<{ status?: string | undefined; darkPreviewImagePath?: string | undefined; iconPath?: string | undefined; statusMsg?: string | undefined; } & { id: string; description: string; name: string; savedObjects: Readonly<{ version?: any; attributes?: any; } & { type: string; id: string; references: any[]; }>[]; defaultIndex: string; previewImagePath: string; overviewDashboard: string; appLinks: Readonly<{} & { label: string; path: string; icon: string; }>[]; dataIndices: Readonly<{} & { id: string; fields: Record<string, any>; timeFields: string[]; dataPath: string; currentTimeMarker: string; preserveDayOfWeekTimeOfDay: boolean; }>[]; }>>[]; addSavedObjectsToSampleDataset: (id: string, savedObjects: ",
+          "<Readonly<{ status?: string | undefined; darkPreviewImagePath?: string | undefined; iconPath?: string | undefined; statusMsg?: string | undefined; } & { id: string; description: string; name: string; defaultIndex: string; savedObjects: Readonly<{ version?: any; attributes?: any; } & { type: string; id: string; references: any[]; }>[]; previewImagePath: string; overviewDashboard: string; appLinks: Readonly<{} & { label: string; path: string; icon: string; }>[]; dataIndices: Readonly<{} & { id: string; fields: Record<string, any>; timeFields: string[]; dataPath: string; currentTimeMarker: string; preserveDayOfWeekTimeOfDay: boolean; }>[]; }>>[]; addSavedObjectsToSampleDataset: (id: string, savedObjects: ",
           "SavedObject",
           "<unknown>[]) => void; addAppLinksToSampleDataset: (id: string, appLinks: Readonly<{} & { label: string; path: string; icon: string; }>[]) => void; replacePanelInSampleDatasetDashboard: ({ sampleDataId, dashboardId, oldEmbeddableId, embeddableId, embeddableType, embeddableConfig, }: ",
           "SampleDatasetDashboardPanel",
@@ -1007,7 +1007,7 @@
             "section": "def-server.Writable",
             "text": "Writable"
           },
-          "<Readonly<{ status?: string | undefined; darkPreviewImagePath?: string | undefined; iconPath?: string | undefined; statusMsg?: string | undefined; } & { id: string; description: string; name: string; savedObjects: Readonly<{ version?: any; attributes?: any; } & { type: string; id: string; references: any[]; }>[]; defaultIndex: string; previewImagePath: string; overviewDashboard: string; appLinks: Readonly<{} & { label: string; path: string; icon: string; }>[]; dataIndices: Readonly<{} & { id: string; fields: Record<string, any>; timeFields: string[]; dataPath: string; currentTimeMarker: string; preserveDayOfWeekTimeOfDay: boolean; }>[]; }>>"
+          "<Readonly<{ status?: string | undefined; darkPreviewImagePath?: string | undefined; iconPath?: string | undefined; statusMsg?: string | undefined; } & { id: string; description: string; name: string; defaultIndex: string; savedObjects: Readonly<{ version?: any; attributes?: any; } & { type: string; id: string; references: any[]; }>[]; previewImagePath: string; overviewDashboard: string; appLinks: Readonly<{} & { label: string; path: string; icon: string; }>[]; dataIndices: Readonly<{} & { id: string; fields: Record<string, any>; timeFields: string[]; dataPath: string; currentTimeMarker: string; preserveDayOfWeekTimeOfDay: boolean; }>[]; }>>"
         ],
         "path": "src/plugins/home/server/services/sample_data/lib/sample_dataset_registry_types.ts",
         "deprecated": false,
@@ -1025,7 +1025,7 @@
         "signature": [
           "(context: ",
           "TutorialContext",
-          ") => Readonly<{ isBeta?: boolean | undefined; savedObjects?: any[] | undefined; euiIconType?: string | undefined; previewImagePath?: string | undefined; moduleName?: string | undefined; completionTimeMinutes?: number | undefined; elasticCloud?: Readonly<{ params?: Readonly<{ defaultValue?: any; } & { type: \"string\" | \"number\"; label: string; id: string; }>[] | undefined; } & { instructionSets: Readonly<{ title?: string | undefined; callOut?: Readonly<{ iconType?: string | undefined; message?: string | undefined; } & { title: string; }> | undefined; statusCheck?: Readonly<{ title?: string | undefined; text?: string | undefined; error?: string | undefined; success?: string | undefined; btnLabel?: string | undefined; } & { esHitsCheck: Readonly<{} & { query: Record<string, any>; index: string | string[]; }>; }> | undefined; } & { instructionVariants: Readonly<{} & { id: string; instructions: Readonly<{ title?: string | undefined; commands?: string[] | undefined; textPre?: string | undefined; textPost?: string | undefined; customComponentName?: string | undefined; } & {}>[]; }>[]; }>[]; }> | undefined; onPremElasticCloud?: Readonly<{ params?: Readonly<{ defaultValue?: any; } & { type: \"string\" | \"number\"; label: string; id: string; }>[] | undefined; } & { instructionSets: Readonly<{ title?: string | undefined; callOut?: Readonly<{ iconType?: string | undefined; message?: string | undefined; } & { title: string; }> | undefined; statusCheck?: Readonly<{ title?: string | undefined; text?: string | undefined; error?: string | undefined; success?: string | undefined; btnLabel?: string | undefined; } & { esHitsCheck: Readonly<{} & { query: Record<string, any>; index: string | string[]; }>; }> | undefined; } & { instructionVariants: Readonly<{} & { id: string; instructions: Readonly<{ title?: string | undefined; commands?: string[] | undefined; textPre?: string | undefined; textPost?: string | undefined; customComponentName?: string | undefined; } & {}>[]; }>[]; }>[]; }> | undefined; artifacts?: Readonly<{ application?: Readonly<{} & { label: string; path: string; }> | undefined; exportedFields?: Readonly<{} & { documentationUrl: string; }> | undefined; } & { dashboards: Readonly<{ linkLabel?: string | undefined; } & { id: string; isOverview: boolean; }>[]; }> | undefined; savedObjectsInstallMsg?: string | undefined; customStatusCheckName?: string | undefined; integrationBrowserCategories?: string[] | undefined; eprPackageOverlap?: string | undefined; } & { id: string; name: string; category: \"security\" | \"metrics\" | \"other\" | \"logging\"; shortDescription: string; longDescription: string; onPrem: Readonly<{ params?: Readonly<{ defaultValue?: any; } & { type: \"string\" | \"number\"; label: string; id: string; }>[] | undefined; } & { instructionSets: Readonly<{ title?: string | undefined; callOut?: Readonly<{ iconType?: string | undefined; message?: string | undefined; } & { title: string; }> | undefined; statusCheck?: Readonly<{ title?: string | undefined; text?: string | undefined; error?: string | undefined; success?: string | undefined; btnLabel?: string | undefined; } & { esHitsCheck: Readonly<{} & { query: Record<string, any>; index: string | string[]; }>; }> | undefined; } & { instructionVariants: Readonly<{} & { id: string; instructions: Readonly<{ title?: string | undefined; commands?: string[] | undefined; textPre?: string | undefined; textPost?: string | undefined; customComponentName?: string | undefined; } & {}>[]; }>[]; }>[]; }>; }>"
+          ") => Readonly<{ isBeta?: boolean | undefined; savedObjects?: any[] | undefined; euiIconType?: string | undefined; previewImagePath?: string | undefined; moduleName?: string | undefined; completionTimeMinutes?: number | undefined; elasticCloud?: Readonly<{ params?: Readonly<{ defaultValue?: any; } & { label: string; type: \"string\" | \"number\"; id: string; }>[] | undefined; } & { instructionSets: Readonly<{ title?: string | undefined; callOut?: Readonly<{ iconType?: string | undefined; message?: string | undefined; } & { title: string; }> | undefined; statusCheck?: Readonly<{ title?: string | undefined; text?: string | undefined; error?: string | undefined; success?: string | undefined; btnLabel?: string | undefined; } & { esHitsCheck: Readonly<{} & { query: Record<string, any>; index: string | string[]; }>; }> | undefined; } & { instructionVariants: Readonly<{} & { id: string; instructions: Readonly<{ title?: string | undefined; commands?: string[] | undefined; textPre?: string | undefined; textPost?: string | undefined; customComponentName?: string | undefined; } & {}>[]; }>[]; }>[]; }> | undefined; onPremElasticCloud?: Readonly<{ params?: Readonly<{ defaultValue?: any; } & { label: string; type: \"string\" | \"number\"; id: string; }>[] | undefined; } & { instructionSets: Readonly<{ title?: string | undefined; callOut?: Readonly<{ iconType?: string | undefined; message?: string | undefined; } & { title: string; }> | undefined; statusCheck?: Readonly<{ title?: string | undefined; text?: string | undefined; error?: string | undefined; success?: string | undefined; btnLabel?: string | undefined; } & { esHitsCheck: Readonly<{} & { query: Record<string, any>; index: string | string[]; }>; }> | undefined; } & { instructionVariants: Readonly<{} & { id: string; instructions: Readonly<{ title?: string | undefined; commands?: string[] | undefined; textPre?: string | undefined; textPost?: string | undefined; customComponentName?: string | undefined; } & {}>[]; }>[]; }>[]; }> | undefined; artifacts?: Readonly<{ application?: Readonly<{} & { label: string; path: string; }> | undefined; exportedFields?: Readonly<{} & { documentationUrl: string; }> | undefined; } & { dashboards: Readonly<{ linkLabel?: string | undefined; } & { id: string; isOverview: boolean; }>[]; }> | undefined; savedObjectsInstallMsg?: string | undefined; customStatusCheckName?: string | undefined; integrationBrowserCategories?: string[] | undefined; eprPackageOverlap?: string | undefined; } & { id: string; name: string; category: \"other\" | \"security\" | \"metrics\" | \"logging\"; shortDescription: string; longDescription: string; onPrem: Readonly<{ params?: Readonly<{ defaultValue?: any; } & { label: string; type: \"string\" | \"number\"; id: string; }>[] | undefined; } & { instructionSets: Readonly<{ title?: string | undefined; callOut?: Readonly<{ iconType?: string | undefined; message?: string | undefined; } & { title: string; }> | undefined; statusCheck?: Readonly<{ title?: string | undefined; text?: string | undefined; error?: string | undefined; success?: string | undefined; btnLabel?: string | undefined; } & { esHitsCheck: Readonly<{} & { query: Record<string, any>; index: string | string[]; }>; }> | undefined; } & { instructionVariants: Readonly<{} & { id: string; instructions: Readonly<{ title?: string | undefined; commands?: string[] | undefined; textPre?: string | undefined; textPost?: string | undefined; customComponentName?: string | undefined; } & {}>[]; }>[]; }>[]; }>; }>"
         ],
         "path": "src/plugins/home/server/services/tutorials/lib/tutorials_registry_types.ts",
         "deprecated": false,
@@ -1055,7 +1055,7 @@
         "label": "TutorialSchema",
         "description": [],
         "signature": [
-          "{ readonly isBeta?: boolean | undefined; readonly savedObjects?: any[] | undefined; readonly euiIconType?: string | undefined; readonly previewImagePath?: string | undefined; readonly moduleName?: string | undefined; readonly completionTimeMinutes?: number | undefined; readonly elasticCloud?: Readonly<{ params?: Readonly<{ defaultValue?: any; } & { type: \"string\" | \"number\"; label: string; id: string; }>[] | undefined; } & { instructionSets: Readonly<{ title?: string | undefined; callOut?: Readonly<{ iconType?: string | undefined; message?: string | undefined; } & { title: string; }> | undefined; statusCheck?: Readonly<{ title?: string | undefined; text?: string | undefined; error?: string | undefined; success?: string | undefined; btnLabel?: string | undefined; } & { esHitsCheck: Readonly<{} & { query: Record<string, any>; index: string | string[]; }>; }> | undefined; } & { instructionVariants: Readonly<{} & { id: string; instructions: Readonly<{ title?: string | undefined; commands?: string[] | undefined; textPre?: string | undefined; textPost?: string | undefined; customComponentName?: string | undefined; } & {}>[]; }>[]; }>[]; }> | undefined; readonly onPremElasticCloud?: Readonly<{ params?: Readonly<{ defaultValue?: any; } & { type: \"string\" | \"number\"; label: string; id: string; }>[] | undefined; } & { instructionSets: Readonly<{ title?: string | undefined; callOut?: Readonly<{ iconType?: string | undefined; message?: string | undefined; } & { title: string; }> | undefined; statusCheck?: Readonly<{ title?: string | undefined; text?: string | undefined; error?: string | undefined; success?: string | undefined; btnLabel?: string | undefined; } & { esHitsCheck: Readonly<{} & { query: Record<string, any>; index: string | string[]; }>; }> | undefined; } & { instructionVariants: Readonly<{} & { id: string; instructions: Readonly<{ title?: string | undefined; commands?: string[] | undefined; textPre?: string | undefined; textPost?: string | undefined; customComponentName?: string | undefined; } & {}>[]; }>[]; }>[]; }> | undefined; readonly artifacts?: Readonly<{ application?: Readonly<{} & { label: string; path: string; }> | undefined; exportedFields?: Readonly<{} & { documentationUrl: string; }> | undefined; } & { dashboards: Readonly<{ linkLabel?: string | undefined; } & { id: string; isOverview: boolean; }>[]; }> | undefined; readonly savedObjectsInstallMsg?: string | undefined; readonly customStatusCheckName?: string | undefined; readonly integrationBrowserCategories?: string[] | undefined; readonly eprPackageOverlap?: string | undefined; readonly id: string; readonly name: string; readonly category: \"security\" | \"metrics\" | \"other\" | \"logging\"; readonly shortDescription: string; readonly longDescription: string; readonly onPrem: Readonly<{ params?: Readonly<{ defaultValue?: any; } & { type: \"string\" | \"number\"; label: string; id: string; }>[] | undefined; } & { instructionSets: Readonly<{ title?: string | undefined; callOut?: Readonly<{ iconType?: string | undefined; message?: string | undefined; } & { title: string; }> | undefined; statusCheck?: Readonly<{ title?: string | undefined; text?: string | undefined; error?: string | undefined; success?: string | undefined; btnLabel?: string | undefined; } & { esHitsCheck: Readonly<{} & { query: Record<string, any>; index: string | string[]; }>; }> | undefined; } & { instructionVariants: Readonly<{} & { id: string; instructions: Readonly<{ title?: string | undefined; commands?: string[] | undefined; textPre?: string | undefined; textPost?: string | undefined; customComponentName?: string | undefined; } & {}>[]; }>[]; }>[]; }>; }"
+          "{ readonly isBeta?: boolean | undefined; readonly savedObjects?: any[] | undefined; readonly euiIconType?: string | undefined; readonly previewImagePath?: string | undefined; readonly moduleName?: string | undefined; readonly completionTimeMinutes?: number | undefined; readonly elasticCloud?: Readonly<{ params?: Readonly<{ defaultValue?: any; } & { label: string; type: \"string\" | \"number\"; id: string; }>[] | undefined; } & { instructionSets: Readonly<{ title?: string | undefined; callOut?: Readonly<{ iconType?: string | undefined; message?: string | undefined; } & { title: string; }> | undefined; statusCheck?: Readonly<{ title?: string | undefined; text?: string | undefined; error?: string | undefined; success?: string | undefined; btnLabel?: string | undefined; } & { esHitsCheck: Readonly<{} & { query: Record<string, any>; index: string | string[]; }>; }> | undefined; } & { instructionVariants: Readonly<{} & { id: string; instructions: Readonly<{ title?: string | undefined; commands?: string[] | undefined; textPre?: string | undefined; textPost?: string | undefined; customComponentName?: string | undefined; } & {}>[]; }>[]; }>[]; }> | undefined; readonly onPremElasticCloud?: Readonly<{ params?: Readonly<{ defaultValue?: any; } & { label: string; type: \"string\" | \"number\"; id: string; }>[] | undefined; } & { instructionSets: Readonly<{ title?: string | undefined; callOut?: Readonly<{ iconType?: string | undefined; message?: string | undefined; } & { title: string; }> | undefined; statusCheck?: Readonly<{ title?: string | undefined; text?: string | undefined; error?: string | undefined; success?: string | undefined; btnLabel?: string | undefined; } & { esHitsCheck: Readonly<{} & { query: Record<string, any>; index: string | string[]; }>; }> | undefined; } & { instructionVariants: Readonly<{} & { id: string; instructions: Readonly<{ title?: string | undefined; commands?: string[] | undefined; textPre?: string | undefined; textPost?: string | undefined; customComponentName?: string | undefined; } & {}>[]; }>[]; }>[]; }> | undefined; readonly artifacts?: Readonly<{ application?: Readonly<{} & { label: string; path: string; }> | undefined; exportedFields?: Readonly<{} & { documentationUrl: string; }> | undefined; } & { dashboards: Readonly<{ linkLabel?: string | undefined; } & { id: string; isOverview: boolean; }>[]; }> | undefined; readonly savedObjectsInstallMsg?: string | undefined; readonly customStatusCheckName?: string | undefined; readonly integrationBrowserCategories?: string[] | undefined; readonly eprPackageOverlap?: string | undefined; readonly id: string; readonly name: string; readonly category: \"other\" | \"security\" | \"metrics\" | \"logging\"; readonly shortDescription: string; readonly longDescription: string; readonly onPrem: Readonly<{ params?: Readonly<{ defaultValue?: any; } & { label: string; type: \"string\" | \"number\"; id: string; }>[] | undefined; } & { instructionSets: Readonly<{ title?: string | undefined; callOut?: Readonly<{ iconType?: string | undefined; message?: string | undefined; } & { title: string; }> | undefined; statusCheck?: Readonly<{ title?: string | undefined; text?: string | undefined; error?: string | undefined; success?: string | undefined; btnLabel?: string | undefined; } & { esHitsCheck: Readonly<{} & { query: Record<string, any>; index: string | string[]; }>; }> | undefined; } & { instructionVariants: Readonly<{} & { id: string; instructions: Readonly<{ title?: string | undefined; commands?: string[] | undefined; textPre?: string | undefined; textPost?: string | undefined; customComponentName?: string | undefined; } & {}>[]; }>[]; }>[]; }>; }"
         ],
         "path": "src/plugins/home/server/services/tutorials/lib/tutorial_schema.ts",
         "deprecated": false,
@@ -1314,7 +1314,7 @@
               "section": "def-server.Writable",
               "text": "Writable"
             },
-            "<Readonly<{ status?: string | undefined; darkPreviewImagePath?: string | undefined; iconPath?: string | undefined; statusMsg?: string | undefined; } & { id: string; description: string; name: string; savedObjects: Readonly<{ version?: any; attributes?: any; } & { type: string; id: string; references: any[]; }>[]; defaultIndex: string; previewImagePath: string; overviewDashboard: string; appLinks: Readonly<{} & { label: string; path: string; icon: string; }>[]; dataIndices: Readonly<{} & { id: string; fields: Record<string, any>; timeFields: string[]; dataPath: string; currentTimeMarker: string; preserveDayOfWeekTimeOfDay: boolean; }>[]; }>>[]; addSavedObjectsToSampleDataset: (id: string, savedObjects: ",
+            "<Readonly<{ status?: string | undefined; darkPreviewImagePath?: string | undefined; iconPath?: string | undefined; statusMsg?: string | undefined; } & { id: string; description: string; name: string; defaultIndex: string; savedObjects: Readonly<{ version?: any; attributes?: any; } & { type: string; id: string; references: any[]; }>[]; previewImagePath: string; overviewDashboard: string; appLinks: Readonly<{} & { label: string; path: string; icon: string; }>[]; dataIndices: Readonly<{} & { id: string; fields: Record<string, any>; timeFields: string[]; dataPath: string; currentTimeMarker: string; preserveDayOfWeekTimeOfDay: boolean; }>[]; }>>[]; addSavedObjectsToSampleDataset: (id: string, savedObjects: ",
             "SavedObject",
             "<unknown>[]) => void; addAppLinksToSampleDataset: (id: string, appLinks: Readonly<{} & { label: string; path: string; icon: string; }>[]) => void; replacePanelInSampleDatasetDashboard: ({ sampleDataId, dashboardId, oldEmbeddableId, embeddableId, embeddableType, embeddableConfig, }: ",
             "SampleDatasetDashboardPanel",
diff --git a/api_docs/kbn_dev_utils.json b/api_docs/kbn_dev_utils.json
index 04ce7aebc51e62..1fea3bfd21ae85 100644
--- a/api_docs/kbn_dev_utils.json
+++ b/api_docs/kbn_dev_utils.json
@@ -26,7 +26,9 @@
             "type": "Function",
             "tags": [],
             "label": "fromEnv",
-            "description": [],
+            "description": [
+              "\nCreate a CiStatsReporter by inspecting the ENV for the necessary config"
+            ],
             "signature": [
               "(log: ",
               {
@@ -92,7 +94,13 @@
                 "label": "config",
                 "description": [],
                 "signature": [
-                  "Config",
+                  {
+                    "pluginId": "@kbn/dev-utils",
+                    "scope": "server",
+                    "docId": "kibKbnDevUtilsPluginApi",
+                    "section": "def-server.Config",
+                    "text": "Config"
+                  },
                   " | undefined"
                 ],
                 "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
@@ -128,7 +136,9 @@
             "type": "Function",
             "tags": [],
             "label": "isEnabled",
-            "description": [],
+            "description": [
+              "\nDetermine if CI_STATS is explicitly disabled by the environment. To determine\nif the CiStatsReporter has enough information in the environment to send metrics\nfor builds use #hasBuildConfig()."
+            ],
             "signature": [
               "() => boolean"
             ],
@@ -143,7 +153,9 @@
             "type": "Function",
             "tags": [],
             "label": "hasBuildConfig",
-            "description": [],
+            "description": [
+              "\nDetermines if the CiStatsReporter is disabled by the environment, or properly\nconfigured and able to send stats"
+            ],
             "signature": [
               "() => boolean"
             ],
@@ -216,7 +228,15 @@
                 "section": "def-server.CiStatsMetric",
                 "text": "CiStatsMetric"
               },
-              "[]) => Promise<true | undefined>"
+              "[], options?: ",
+              {
+                "pluginId": "@kbn/dev-utils",
+                "scope": "server",
+                "docId": "kibKbnDevUtilsPluginApi",
+                "section": "def-server.MetricsOptions",
+                "text": "MetricsOptions"
+              },
+              " | undefined) => Promise<true | undefined>"
             ],
             "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
             "deprecated": false,
@@ -241,6 +261,27 @@
                 "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
                 "deprecated": false,
                 "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/dev-utils",
+                "id": "def-server.CiStatsReporter.metrics.$2",
+                "type": "Object",
+                "tags": [],
+                "label": "options",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/dev-utils",
+                    "scope": "server",
+                    "docId": "kibKbnDevUtilsPluginApi",
+                    "section": "def-server.MetricsOptions",
+                    "text": "MetricsOptions"
+                  },
+                  " | undefined"
+                ],
+                "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
+                "deprecated": false,
+                "isRequired": false
               }
             ],
             "returnComment": []
@@ -644,19 +685,59 @@
                 "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log.ts",
                 "deprecated": false,
                 "isRequired": false
+              },
+              {
+                "parentPluginId": "@kbn/dev-utils",
+                "id": "def-server.ToolingLog.Unnamed.$2",
+                "type": "Object",
+                "tags": [],
+                "label": "options",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/dev-utils",
+                    "scope": "server",
+                    "docId": "kibKbnDevUtilsPluginApi",
+                    "section": "def-server.ToolingLogOptions",
+                    "text": "ToolingLogOptions"
+                  },
+                  " | undefined"
+                ],
+                "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log.ts",
+                "deprecated": false,
+                "isRequired": false
               }
             ],
             "returnComment": []
           },
+          {
+            "parentPluginId": "@kbn/dev-utils",
+            "id": "def-server.ToolingLog.getIndent",
+            "type": "Function",
+            "tags": [],
+            "label": "getIndent",
+            "description": [
+              "\nGet the current indentation level of the ToolingLog"
+            ],
+            "signature": [
+              "() => number"
+            ],
+            "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log.ts",
+            "deprecated": false,
+            "children": [],
+            "returnComment": []
+          },
           {
             "parentPluginId": "@kbn/dev-utils",
             "id": "def-server.ToolingLog.indent",
             "type": "Function",
             "tags": [],
             "label": "indent",
-            "description": [],
+            "description": [
+              "\nIndent the output of the ToolingLog by some character (4 is a good choice usually).\n\nIf provided, the `block` function will be executed and once it's promise is resolved\nor rejected the indentation will be reset to its original state.\n"
+            ],
             "signature": [
-              "(delta?: number) => number"
+              "<T>(delta?: number, block?: (() => Promise<T>) | undefined) => Promise<T> | undefined"
             ],
             "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log.ts",
             "deprecated": false,
@@ -667,13 +748,31 @@
                 "type": "number",
                 "tags": [],
                 "label": "delta",
-                "description": [],
+                "description": [
+                  "the number of spaces to increase/decrease the indentation"
+                ],
                 "signature": [
                   "number"
                 ],
                 "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log.ts",
                 "deprecated": false,
                 "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/dev-utils",
+                "id": "def-server.ToolingLog.indent.$2",
+                "type": "Function",
+                "tags": [],
+                "label": "block",
+                "description": [
+                  "a function to run and reset any indentation changes after"
+                ],
+                "signature": [
+                  "(() => Promise<T>) | undefined"
+                ],
+                "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log.ts",
+                "deprecated": false,
+                "isRequired": false
               }
             ],
             "returnComment": []
@@ -897,7 +996,13 @@
             "description": [],
             "signature": [
               "() => ",
-              "Writer",
+              {
+                "pluginId": "@kbn/dev-utils",
+                "scope": "server",
+                "docId": "kibKbnDevUtilsPluginApi",
+                "section": "def-server.Writer",
+                "text": "Writer"
+              },
               "[]"
             ],
             "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log.ts",
@@ -914,7 +1019,13 @@
             "description": [],
             "signature": [
               "(writers: ",
-              "Writer",
+              {
+                "pluginId": "@kbn/dev-utils",
+                "scope": "server",
+                "docId": "kibKbnDevUtilsPluginApi",
+                "section": "def-server.Writer",
+                "text": "Writer"
+              },
               "[]) => void"
             ],
             "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log.ts",
@@ -928,7 +1039,13 @@
                 "label": "writers",
                 "description": [],
                 "signature": [
-                  "Writer",
+                  {
+                    "pluginId": "@kbn/dev-utils",
+                    "scope": "server",
+                    "docId": "kibKbnDevUtilsPluginApi",
+                    "section": "def-server.Writer",
+                    "text": "Writer"
+                  },
                   "[]"
                 ],
                 "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log.ts",
@@ -949,13 +1066,60 @@
               "() => ",
               "Observable",
               "<",
-              "Message",
+              {
+                "pluginId": "@kbn/dev-utils",
+                "scope": "server",
+                "docId": "kibKbnDevUtilsPluginApi",
+                "section": "def-server.Message",
+                "text": "Message"
+              },
               ">"
             ],
             "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log.ts",
             "deprecated": false,
             "children": [],
             "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/dev-utils",
+            "id": "def-server.ToolingLog.withType",
+            "type": "Function",
+            "tags": [],
+            "label": "withType",
+            "description": [
+              "\nCreate a new ToolingLog which sets a different \"type\", allowing messages to be filtered out by \"source\""
+            ],
+            "signature": [
+              "(type: string) => ",
+              {
+                "pluginId": "@kbn/dev-utils",
+                "scope": "server",
+                "docId": "kibKbnDevUtilsPluginApi",
+                "section": "def-server.ToolingLog",
+                "text": "ToolingLog"
+              }
+            ],
+            "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log.ts",
+            "deprecated": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/dev-utils",
+                "id": "def-server.ToolingLog.withType.$1",
+                "type": "string",
+                "tags": [],
+                "label": "type",
+                "description": [
+                  "A string that will be passed along with messages from this logger which can be used to filter messages with `ignoreSources`"
+                ],
+                "signature": [
+                  "string"
+                ],
+                "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log.ts",
+                "deprecated": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
           }
         ],
         "initialIsOpen": false
@@ -1021,7 +1185,53 @@
                 "label": "level",
                 "description": [],
                 "signature": [
-                  "\"warning\" | \"error\" | \"info\" | \"success\" | \"debug\" | \"silent\" | \"verbose\""
+                  "\"error\" | \"info\" | \"success\" | \"warning\" | \"debug\" | \"silent\" | \"verbose\""
+                ],
+                "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log_collecting_writer.ts",
+                "deprecated": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/dev-utils",
+            "id": "def-server.ToolingLogCollectingWriter.write",
+            "type": "Function",
+            "tags": [],
+            "label": "write",
+            "description": [
+              "\nCalled by ToolingLog, extends messages with the source if message includes one."
+            ],
+            "signature": [
+              "(msg: ",
+              {
+                "pluginId": "@kbn/dev-utils",
+                "scope": "server",
+                "docId": "kibKbnDevUtilsPluginApi",
+                "section": "def-server.Message",
+                "text": "Message"
+              },
+              ") => boolean"
+            ],
+            "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log_collecting_writer.ts",
+            "deprecated": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/dev-utils",
+                "id": "def-server.ToolingLogCollectingWriter.write.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "msg",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/dev-utils",
+                    "scope": "server",
+                    "docId": "kibKbnDevUtilsPluginApi",
+                    "section": "def-server.Message",
+                    "text": "Message"
+                  }
                 ],
                 "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log_collecting_writer.ts",
                 "deprecated": false,
@@ -1049,7 +1259,13 @@
             "text": "ToolingLogTextWriter"
           },
           " implements ",
-          "Writer"
+          {
+            "pluginId": "@kbn/dev-utils",
+            "scope": "server",
+            "docId": "kibKbnDevUtilsPluginApi",
+            "section": "def-server.Writer",
+            "text": "Writer"
+          }
         ],
         "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log_text_writer.ts",
         "deprecated": false,
@@ -1062,7 +1278,7 @@
             "label": "level",
             "description": [],
             "signature": [
-              "{ name: \"warning\" | \"error\" | \"info\" | \"success\" | \"debug\" | \"silent\" | \"verbose\"; flags: { warning: boolean; error: boolean; info: boolean; success: boolean; debug: boolean; silent: boolean; verbose: boolean; }; }"
+              "{ name: \"error\" | \"info\" | \"success\" | \"warning\" | \"debug\" | \"silent\" | \"verbose\"; flags: { error: boolean; info: boolean; success: boolean; warning: boolean; debug: boolean; silent: boolean; verbose: boolean; }; }"
             ],
             "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log_text_writer.ts",
             "deprecated": false
@@ -1125,7 +1341,13 @@
             "description": [],
             "signature": [
               "(msg: ",
-              "Message",
+              {
+                "pluginId": "@kbn/dev-utils",
+                "scope": "server",
+                "docId": "kibKbnDevUtilsPluginApi",
+                "section": "def-server.Message",
+                "text": "Message"
+              },
               ") => boolean"
             ],
             "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log_text_writer.ts",
@@ -1139,7 +1361,13 @@
                 "label": "msg",
                 "description": [],
                 "signature": [
-                  "Message"
+                  {
+                    "pluginId": "@kbn/dev-utils",
+                    "scope": "server",
+                    "docId": "kibKbnDevUtilsPluginApi",
+                    "section": "def-server.Message",
+                    "text": "Message"
+                  }
                 ],
                 "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log_text_writer.ts",
                 "deprecated": false,
@@ -1157,7 +1385,13 @@
             "description": [],
             "signature": [
               "(writeTo: { write(msg: string): void; }, prefix: string, msg: ",
-              "Message",
+              {
+                "pluginId": "@kbn/dev-utils",
+                "scope": "server",
+                "docId": "kibKbnDevUtilsPluginApi",
+                "section": "def-server.Message",
+                "text": "Message"
+              },
               ") => void"
             ],
             "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log_text_writer.ts",
@@ -1199,7 +1433,13 @@
                 "label": "msg",
                 "description": [],
                 "signature": [
-                  "Message"
+                  {
+                    "pluginId": "@kbn/dev-utils",
+                    "scope": "server",
+                    "docId": "kibKbnDevUtilsPluginApi",
+                    "section": "def-server.Message",
+                    "text": "Message"
+                  }
                 ],
                 "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log_text_writer.ts",
                 "deprecated": false,
@@ -2455,7 +2695,7 @@
         "label": "parseLogLevel",
         "description": [],
         "signature": [
-          "(name: \"warning\" | \"error\" | \"info\" | \"success\" | \"debug\" | \"silent\" | \"verbose\") => { name: \"warning\" | \"error\" | \"info\" | \"success\" | \"debug\" | \"silent\" | \"verbose\"; flags: { warning: boolean; error: boolean; info: boolean; success: boolean; debug: boolean; silent: boolean; verbose: boolean; }; }"
+          "(name: \"error\" | \"info\" | \"success\" | \"warning\" | \"debug\" | \"silent\" | \"verbose\") => { name: \"error\" | \"info\" | \"success\" | \"warning\" | \"debug\" | \"silent\" | \"verbose\"; flags: { error: boolean; info: boolean; success: boolean; warning: boolean; debug: boolean; silent: boolean; verbose: boolean; }; }"
         ],
         "path": "packages/kbn-dev-utils/src/tooling_log/log_levels.ts",
         "deprecated": false,
@@ -2468,7 +2708,7 @@
             "label": "name",
             "description": [],
             "signature": [
-              "\"warning\" | \"error\" | \"info\" | \"success\" | \"debug\" | \"silent\" | \"verbose\""
+              "\"error\" | \"info\" | \"success\" | \"warning\" | \"debug\" | \"silent\" | \"verbose\""
             ],
             "path": "packages/kbn-dev-utils/src/tooling_log/log_levels.ts",
             "deprecated": false,
@@ -2486,7 +2726,7 @@
         "label": "pickLevelFromFlags",
         "description": [],
         "signature": [
-          "(flags: Record<string, string | boolean | string[] | undefined>, options: { default?: \"warning\" | \"error\" | \"info\" | \"success\" | \"debug\" | \"silent\" | \"verbose\" | undefined; }) => \"warning\" | \"error\" | \"info\" | \"success\" | \"debug\" | \"silent\" | \"verbose\""
+          "(flags: Record<string, string | boolean | string[] | undefined>, options: { default?: \"error\" | \"info\" | \"success\" | \"warning\" | \"debug\" | \"silent\" | \"verbose\" | undefined; }) => \"error\" | \"info\" | \"success\" | \"warning\" | \"debug\" | \"silent\" | \"verbose\""
         ],
         "path": "packages/kbn-dev-utils/src/tooling_log/log_levels.ts",
         "deprecated": false,
@@ -2523,7 +2763,7 @@
                 "label": "default",
                 "description": [],
                 "signature": [
-                  "\"warning\" | \"error\" | \"info\" | \"success\" | \"debug\" | \"silent\" | \"verbose\" | undefined"
+                  "\"error\" | \"info\" | \"success\" | \"warning\" | \"debug\" | \"silent\" | \"verbose\" | undefined"
                 ],
                 "path": "packages/kbn-dev-utils/src/tooling_log/log_levels.ts",
                 "deprecated": false
@@ -2945,6 +3185,34 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/dev-utils",
+        "id": "def-server.CiStatsMetadata",
+        "type": "Interface",
+        "tags": [],
+        "label": "CiStatsMetadata",
+        "description": [],
+        "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/dev-utils",
+            "id": "def-server.CiStatsMetadata.Unnamed",
+            "type": "Any",
+            "tags": [],
+            "label": "Unnamed",
+            "description": [
+              "\nArbitrary key-value pairs which can be attached to CiStatsTiming and CiStatsMetric\nobjects stored in the ci-stats service"
+            ],
+            "signature": [
+              "any"
+            ],
+            "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
+            "deprecated": false
+          }
+        ],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/dev-utils",
         "id": "def-server.CiStatsMetric",
@@ -2961,7 +3229,9 @@
             "type": "string",
             "tags": [],
             "label": "group",
-            "description": [],
+            "description": [
+              "Top-level categorization for the metric, e.g. \"page load bundle size\""
+            ],
             "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
             "deprecated": false
           },
@@ -2971,7 +3241,9 @@
             "type": "string",
             "tags": [],
             "label": "id",
-            "description": [],
+            "description": [
+              "Specific sub-set of the \"group\", e.g. \"dashboard\""
+            ],
             "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
             "deprecated": false
           },
@@ -2981,7 +3253,9 @@
             "type": "number",
             "tags": [],
             "label": "value",
-            "description": [],
+            "description": [
+              "integer value recorded as the value of this metric"
+            ],
             "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
             "deprecated": false
           },
@@ -2991,7 +3265,9 @@
             "type": "number",
             "tags": [],
             "label": "limit",
-            "description": [],
+            "description": [
+              "optional limit which will generate an error on PRs when the metric exceeds the limit"
+            ],
             "signature": [
               "number | undefined"
             ],
@@ -3004,33 +3280,59 @@
             "type": "string",
             "tags": [],
             "label": "limitConfigPath",
-            "description": [],
+            "description": [
+              "\npath, relative to the repo, where the config file contianing limits\nis kept. Linked from PR comments instructing contributors how to fix\ntheir PRs."
+            ],
             "signature": [
               "string | undefined"
             ],
             "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
             "deprecated": false
-          }
-        ],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "@kbn/dev-utils",
-        "id": "def-server.CiStatsTiming",
-        "type": "Interface",
-        "tags": [],
-        "label": "CiStatsTiming",
-        "description": [],
-        "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
-        "deprecated": false,
-        "children": [
+          },
           {
             "parentPluginId": "@kbn/dev-utils",
-            "id": "def-server.CiStatsTiming.group",
+            "id": "def-server.CiStatsMetric.meta",
+            "type": "Object",
+            "tags": [],
+            "label": "meta",
+            "description": [
+              "Arbitrary key-value pairs which can be used for additional filtering/reporting"
+            ],
+            "signature": [
+              {
+                "pluginId": "@kbn/dev-utils",
+                "scope": "server",
+                "docId": "kibKbnDevUtilsPluginApi",
+                "section": "def-server.CiStatsMetadata",
+                "text": "CiStatsMetadata"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
+            "deprecated": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/dev-utils",
+        "id": "def-server.CiStatsTiming",
+        "type": "Interface",
+        "tags": [],
+        "label": "CiStatsTiming",
+        "description": [],
+        "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/dev-utils",
+            "id": "def-server.CiStatsTiming.group",
             "type": "string",
             "tags": [],
             "label": "group",
-            "description": [],
+            "description": [
+              "Top-level categorization for the timing, e.g. \"scripts/foo\", process type, etc."
+            ],
             "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
             "deprecated": false
           },
@@ -3040,7 +3342,9 @@
             "type": "string",
             "tags": [],
             "label": "id",
-            "description": [],
+            "description": [
+              "Specific timing (witin the \"group\" being tracked) e.g. \"total\""
+            ],
             "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
             "deprecated": false
           },
@@ -3050,7 +3354,9 @@
             "type": "number",
             "tags": [],
             "label": "ms",
-            "description": [],
+            "description": [
+              "time in milliseconds which should be recorded"
+            ],
             "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
             "deprecated": false
           },
@@ -3060,14 +3366,16 @@
             "type": "Object",
             "tags": [],
             "label": "meta",
-            "description": [],
+            "description": [
+              "hash of key-value pairs which will be stored with the timing for additional filtering and reporting"
+            ],
             "signature": [
               {
                 "pluginId": "@kbn/dev-utils",
                 "scope": "server",
                 "docId": "kibKbnDevUtilsPluginApi",
-                "section": "def-server.CiStatsTimingMetadata",
-                "text": "CiStatsTimingMetadata"
+                "section": "def-server.CiStatsMetadata",
+                "text": "CiStatsMetadata"
               },
               " | undefined"
             ],
@@ -3077,32 +3385,6 @@
         ],
         "initialIsOpen": false
       },
-      {
-        "parentPluginId": "@kbn/dev-utils",
-        "id": "def-server.CiStatsTimingMetadata",
-        "type": "Interface",
-        "tags": [],
-        "label": "CiStatsTimingMetadata",
-        "description": [],
-        "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "@kbn/dev-utils",
-            "id": "def-server.CiStatsTimingMetadata.Unnamed",
-            "type": "Any",
-            "tags": [],
-            "label": "Unnamed",
-            "description": [],
-            "signature": [
-              "any"
-            ],
-            "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
-            "deprecated": false
-          }
-        ],
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "@kbn/dev-utils",
         "id": "def-server.Command",
@@ -3226,6 +3508,45 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/dev-utils",
+        "id": "def-server.Config",
+        "type": "Interface",
+        "tags": [],
+        "label": "Config",
+        "description": [
+          "\nInformation about how CiStatsReporter should talk to the ci-stats service. Normally\nit is read from a JSON environment variable using the `parseConfig()` function\nexported by this module."
+        ],
+        "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_config.ts",
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/dev-utils",
+            "id": "def-server.Config.apiToken",
+            "type": "string",
+            "tags": [],
+            "label": "apiToken",
+            "description": [
+              "ApiToken necessary for writing build data to ci-stats service"
+            ],
+            "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_config.ts",
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "@kbn/dev-utils",
+            "id": "def-server.Config.buildId",
+            "type": "string",
+            "tags": [],
+            "label": "buildId",
+            "description": [
+              "\nuuid which should be obtained by first creating a build with the\nci-stats service and then passing it to all subsequent steps"
+            ],
+            "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_config.ts",
+            "deprecated": false
+          }
+        ],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/dev-utils",
         "id": "def-server.FlagOptions",
@@ -3480,54 +3801,105 @@
       },
       {
         "parentPluginId": "@kbn/dev-utils",
-        "id": "def-server.ReqOptions",
+        "id": "def-server.Message",
         "type": "Interface",
         "tags": [],
-        "label": "ReqOptions",
-        "description": [],
-        "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
+        "label": "Message",
+        "description": [
+          "\nThe object shape passed to ToolingLog writers each time the log is used."
+        ],
+        "path": "packages/kbn-dev-utils/src/tooling_log/message.ts",
         "deprecated": false,
         "children": [
           {
             "parentPluginId": "@kbn/dev-utils",
-            "id": "def-server.ReqOptions.auth",
-            "type": "boolean",
+            "id": "def-server.Message.type",
+            "type": "CompoundType",
             "tags": [],
-            "label": "auth",
-            "description": [],
-            "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
+            "label": "type",
+            "description": [
+              "level/type of message"
+            ],
+            "signature": [
+              "\"write\" | \"error\" | \"info\" | \"success\" | \"warning\" | \"debug\" | \"verbose\""
+            ],
+            "path": "packages/kbn-dev-utils/src/tooling_log/message.ts",
             "deprecated": false
           },
           {
             "parentPluginId": "@kbn/dev-utils",
-            "id": "def-server.ReqOptions.path",
-            "type": "string",
+            "id": "def-server.Message.indent",
+            "type": "number",
             "tags": [],
-            "label": "path",
-            "description": [],
-            "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
+            "label": "indent",
+            "description": [
+              "indentation intended when message written to a text log"
+            ],
+            "path": "packages/kbn-dev-utils/src/tooling_log/message.ts",
             "deprecated": false
           },
           {
             "parentPluginId": "@kbn/dev-utils",
-            "id": "def-server.ReqOptions.body",
-            "type": "Any",
+            "id": "def-server.Message.source",
+            "type": "string",
             "tags": [],
-            "label": "body",
-            "description": [],
+            "label": "source",
+            "description": [
+              "type of logger this message came from"
+            ],
             "signature": [
-              "any"
+              "string | undefined"
             ],
-            "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
+            "path": "packages/kbn-dev-utils/src/tooling_log/message.ts",
             "deprecated": false
           },
           {
             "parentPluginId": "@kbn/dev-utils",
-            "id": "def-server.ReqOptions.bodyDesc",
-            "type": "string",
+            "id": "def-server.Message.args",
+            "type": "Array",
             "tags": [],
-            "label": "bodyDesc",
-            "description": [],
+            "label": "args",
+            "description": [
+              "args passed to the logging method"
+            ],
+            "signature": [
+              "any[]"
+            ],
+            "path": "packages/kbn-dev-utils/src/tooling_log/message.ts",
+            "deprecated": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/dev-utils",
+        "id": "def-server.MetricsOptions",
+        "type": "Interface",
+        "tags": [],
+        "label": "MetricsOptions",
+        "description": [],
+        "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/dev-utils",
+            "id": "def-server.MetricsOptions.defaultMeta",
+            "type": "Object",
+            "tags": [],
+            "label": "defaultMeta",
+            "description": [
+              "Default metadata to add to each metric"
+            ],
+            "signature": [
+              {
+                "pluginId": "@kbn/dev-utils",
+                "scope": "server",
+                "docId": "kibKbnDevUtilsPluginApi",
+                "section": "def-server.CiStatsMetadata",
+                "text": "CiStatsMetadata"
+              },
+              " | undefined"
+            ],
             "path": "packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts",
             "deprecated": false
           }
@@ -3625,7 +3997,13 @@
             "description": [],
             "signature": [
               "(task: ",
-              "CleanupTask",
+              {
+                "pluginId": "@kbn/dev-utils",
+                "scope": "server",
+                "docId": "kibKbnDevUtilsPluginApi",
+                "section": "def-server.CleanupTask",
+                "text": "CleanupTask"
+              },
               ") => void"
             ],
             "path": "packages/kbn-dev-utils/src/run/run.ts",
@@ -3639,7 +4017,13 @@
                 "label": "task",
                 "description": [],
                 "signature": [
-                  "CleanupTask"
+                  {
+                    "pluginId": "@kbn/dev-utils",
+                    "scope": "server",
+                    "docId": "kibKbnDevUtilsPluginApi",
+                    "section": "def-server.CleanupTask",
+                    "text": "CleanupTask"
+                  }
                 ],
                 "path": "packages/kbn-dev-utils/src/run/run.ts",
                 "deprecated": false,
@@ -3695,7 +4079,7 @@
             "label": "log",
             "description": [],
             "signature": [
-              "{ defaultLevel?: \"warning\" | \"error\" | \"info\" | \"success\" | \"debug\" | \"silent\" | \"verbose\" | undefined; } | undefined"
+              "{ defaultLevel?: \"error\" | \"info\" | \"success\" | \"warning\" | \"debug\" | \"silent\" | \"verbose\" | undefined; } | undefined"
             ],
             "path": "packages/kbn-dev-utils/src/run/run.ts",
             "deprecated": false
@@ -3751,7 +4135,7 @@
             "label": "log",
             "description": [],
             "signature": [
-              "{ defaultLevel?: \"warning\" | \"error\" | \"info\" | \"success\" | \"debug\" | \"silent\" | \"verbose\" | undefined; } | undefined"
+              "{ defaultLevel?: \"error\" | \"info\" | \"success\" | \"warning\" | \"debug\" | \"silent\" | \"verbose\" | undefined; } | undefined"
             ],
             "path": "packages/kbn-dev-utils/src/run/run_with_commands.ts",
             "deprecated": false
@@ -3914,6 +4298,56 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/dev-utils",
+        "id": "def-server.ToolingLogOptions",
+        "type": "Interface",
+        "tags": [],
+        "label": "ToolingLogOptions",
+        "description": [],
+        "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log.ts",
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/dev-utils",
+            "id": "def-server.ToolingLogOptions.type",
+            "type": "string",
+            "tags": [],
+            "label": "type",
+            "description": [
+              "\ntype name for this logger, will be assigned to the \"source\"\nproperties of messages produced by this logger"
+            ],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log.ts",
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "@kbn/dev-utils",
+            "id": "def-server.ToolingLogOptions.parent",
+            "type": "Object",
+            "tags": [],
+            "label": "parent",
+            "description": [
+              "\nparent ToolingLog. When a ToolingLog has a parent they will both\nshare indent and writers state. Changing the indent width or\nwriters on either log will update the other too."
+            ],
+            "signature": [
+              {
+                "pluginId": "@kbn/dev-utils",
+                "scope": "server",
+                "docId": "kibKbnDevUtilsPluginApi",
+                "section": "def-server.ToolingLog",
+                "text": "ToolingLog"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log.ts",
+            "deprecated": false
+          }
+        ],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/dev-utils",
         "id": "def-server.ToolingLogTextWriterConfig",
@@ -3930,9 +4364,26 @@
             "type": "CompoundType",
             "tags": [],
             "label": "level",
-            "description": [],
+            "description": [
+              "\nLog level, messages below this level will be ignored"
+            ],
             "signature": [
-              "\"warning\" | \"error\" | \"info\" | \"success\" | \"debug\" | \"silent\" | \"verbose\""
+              "\"error\" | \"info\" | \"success\" | \"warning\" | \"debug\" | \"silent\" | \"verbose\""
+            ],
+            "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log_text_writer.ts",
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "@kbn/dev-utils",
+            "id": "def-server.ToolingLogTextWriterConfig.ignoreSources",
+            "type": "Array",
+            "tags": [],
+            "label": "ignoreSources",
+            "description": [
+              "\nList of message sources/ToolingLog types which will be ignored. Create\na logger with `ToolingLog#withType()` to create messages with a specific\nsource. Ignored messages will be dropped without writing."
+            ],
+            "signature": [
+              "string[] | undefined"
             ],
             "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log_text_writer.ts",
             "deprecated": false
@@ -3943,7 +4394,9 @@
             "type": "Object",
             "tags": [],
             "label": "writeTo",
-            "description": [],
+            "description": [
+              "\nTarget which will receive formatted message lines, a common value for `writeTo`\nis process.stdout"
+            ],
             "signature": [
               "{ write(s: string): void; }"
             ],
@@ -3952,6 +4405,69 @@
           }
         ],
         "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/dev-utils",
+        "id": "def-server.Writer",
+        "type": "Interface",
+        "tags": [],
+        "label": "Writer",
+        "description": [
+          "\nAn object which received ToolingLog `Messages` and sends them to\nsome interface for collecting logs like stdio, or a file"
+        ],
+        "path": "packages/kbn-dev-utils/src/tooling_log/writer.ts",
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/dev-utils",
+            "id": "def-server.Writer.write",
+            "type": "Function",
+            "tags": [],
+            "label": "write",
+            "description": [
+              "\nCalled with every log message, should return true if the message\nwas written and false if it was ignored."
+            ],
+            "signature": [
+              "(msg: ",
+              {
+                "pluginId": "@kbn/dev-utils",
+                "scope": "server",
+                "docId": "kibKbnDevUtilsPluginApi",
+                "section": "def-server.Message",
+                "text": "Message"
+              },
+              ") => boolean"
+            ],
+            "path": "packages/kbn-dev-utils/src/tooling_log/writer.ts",
+            "deprecated": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/dev-utils",
+                "id": "def-server.Writer.write.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "msg",
+                "description": [
+                  "The log message to write"
+                ],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/dev-utils",
+                    "scope": "server",
+                    "docId": "kibKbnDevUtilsPluginApi",
+                    "section": "def-server.Message",
+                    "text": "Message"
+                  }
+                ],
+                "path": "packages/kbn-dev-utils/src/tooling_log/writer.ts",
+                "deprecated": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          }
+        ],
+        "initialIsOpen": false
       }
     ],
     "enums": [],
@@ -3967,6 +4483,24 @@
         "deprecated": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/dev-utils",
+        "id": "def-server.CleanupTask",
+        "type": "Type",
+        "tags": [],
+        "label": "CleanupTask",
+        "description": [
+          "\nA function which will be called when the CLI is torn-down which should\nquickly cleanup whatever it needs."
+        ],
+        "signature": [
+          "() => void"
+        ],
+        "path": "packages/kbn-dev-utils/src/run/cleanup.ts",
+        "deprecated": false,
+        "returnComment": [],
+        "children": [],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/dev-utils",
         "id": "def-server.CommandRunFn",
@@ -4150,7 +4684,7 @@
         "label": "LogLevel",
         "description": [],
         "signature": [
-          "\"warning\" | \"error\" | \"info\" | \"success\" | \"debug\" | \"silent\" | \"verbose\""
+          "\"error\" | \"info\" | \"success\" | \"warning\" | \"debug\" | \"silent\" | \"verbose\""
         ],
         "path": "packages/kbn-dev-utils/src/tooling_log/log_levels.ts",
         "deprecated": false,
@@ -4164,7 +4698,7 @@
         "label": "ParsedLogLevel",
         "description": [],
         "signature": [
-          "{ name: \"warning\" | \"error\" | \"info\" | \"success\" | \"debug\" | \"silent\" | \"verbose\"; flags: { warning: boolean; error: boolean; info: boolean; success: boolean; debug: boolean; silent: boolean; verbose: boolean; }; }"
+          "{ name: \"error\" | \"info\" | \"success\" | \"warning\" | \"debug\" | \"silent\" | \"verbose\"; flags: { error: boolean; info: boolean; success: boolean; warning: boolean; debug: boolean; silent: boolean; verbose: boolean; }; }"
         ],
         "path": "packages/kbn-dev-utils/src/tooling_log/log_levels.ts",
         "deprecated": false,
diff --git a/api_docs/kbn_dev_utils.mdx b/api_docs/kbn_dev_utils.mdx
index c959baa6fda56b..775e0c03fa49cd 100644
--- a/api_docs/kbn_dev_utils.mdx
+++ b/api_docs/kbn_dev_utils.mdx
@@ -18,7 +18,7 @@ Contact [Owner missing] for questions regarding this plugin.
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 258 | 7 | 231 | 4 |
+| 280 | 6 | 214 | 0 |
 
 ## Server
 
diff --git a/api_docs/kbn_logging.json b/api_docs/kbn_logging.json
index efb4d278311992..7a72a785c57e0c 100644
--- a/api_docs/kbn_logging.json
+++ b/api_docs/kbn_logging.json
@@ -616,7 +616,7 @@
         "label": "EcsEventCategory",
         "description": [],
         "signature": [
-          "\"host\" | \"network\" | \"web\" | \"database\" | \"package\" | \"session\" | \"file\" | \"registry\" | \"process\" | \"authentication\" | \"configuration\" | \"driver\" | \"iam\" | \"intrusion_detection\" | \"malware\""
+          "\"network\" | \"web\" | \"database\" | \"package\" | \"host\" | \"session\" | \"file\" | \"registry\" | \"process\" | \"authentication\" | \"configuration\" | \"driver\" | \"iam\" | \"intrusion_detection\" | \"malware\""
         ],
         "path": "packages/kbn-logging/src/ecs/event.ts",
         "deprecated": false,
@@ -658,7 +658,7 @@
         "label": "EcsEventType",
         "description": [],
         "signature": [
-          "\"start\" | \"connection\" | \"end\" | \"user\" | \"error\" | \"info\" | \"group\" | \"protocol\" | \"access\" | \"admin\" | \"allowed\" | \"change\" | \"creation\" | \"deletion\" | \"denied\" | \"installation\""
+          "\"start\" | \"end\" | \"user\" | \"error\" | \"info\" | \"connection\" | \"group\" | \"protocol\" | \"access\" | \"admin\" | \"allowed\" | \"change\" | \"creation\" | \"deletion\" | \"denied\" | \"installation\""
         ],
         "path": "packages/kbn-logging/src/ecs/event.ts",
         "deprecated": false,
diff --git a/api_docs/kbn_monaco.json b/api_docs/kbn_monaco.json
index b87619f900457f..17323f36e0d89a 100644
--- a/api_docs/kbn_monaco.json
+++ b/api_docs/kbn_monaco.json
@@ -274,7 +274,7 @@
             "label": "kind",
             "description": [],
             "signature": [
-              "\"type\" | \"keyword\" | \"field\" | \"property\" | \"method\" | \"class\" | \"constructor\""
+              "\"keyword\" | \"type\" | \"field\" | \"property\" | \"method\" | \"class\" | \"constructor\""
             ],
             "path": "packages/kbn-monaco/src/painless/types.ts",
             "deprecated": false
@@ -369,7 +369,7 @@
         "label": "PainlessCompletionKind",
         "description": [],
         "signature": [
-          "\"type\" | \"keyword\" | \"field\" | \"property\" | \"method\" | \"class\" | \"constructor\""
+          "\"keyword\" | \"type\" | \"field\" | \"property\" | \"method\" | \"class\" | \"constructor\""
         ],
         "path": "packages/kbn-monaco/src/painless/types.ts",
         "deprecated": false,
diff --git a/api_docs/kbn_securitysolution_autocomplete.json b/api_docs/kbn_securitysolution_autocomplete.json
index 940a7d08d61558..293b1ad2f4e8da 100644
--- a/api_docs/kbn_securitysolution_autocomplete.json
+++ b/api_docs/kbn_securitysolution_autocomplete.json
@@ -274,7 +274,7 @@
           "\nGiven an array of lists and optionally a field this will return all\nthe lists that match against the field based on the types from the field\n\nNOTE: That we support one additional property from \"FieldSpec\" located here:\nsrc/plugins/data/common/index_patterns/fields/types.ts\nThis type property is esTypes. If it exists and is on there we will read off the esTypes."
         ],
         "signature": [
-          "(lists: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }[], field?: (",
+          "(lists: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }[], field?: (",
           {
             "pluginId": "@kbn/es-query",
             "scope": "common",
@@ -282,7 +282,7 @@
             "section": "def-common.DataViewFieldBase",
             "text": "DataViewFieldBase"
           },
-          " & { esTypes?: string[] | undefined; }) | undefined) => { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }[]"
+          " & { esTypes?: string[] | undefined; }) | undefined) => { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }[]"
         ],
         "path": "packages/kbn-securitysolution-autocomplete/src/filter_field_to_list/index.ts",
         "deprecated": false,
@@ -297,7 +297,7 @@
               "The lists to match against the field"
             ],
             "signature": [
-              "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }[]"
+              "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }[]"
             ],
             "path": "packages/kbn-securitysolution-autocomplete/src/filter_field_to_list/index.ts",
             "deprecated": false,
diff --git a/api_docs/kbn_securitysolution_es_utils.json b/api_docs/kbn_securitysolution_es_utils.json
index 680d6993530dd8..3a5bb6e97e90d8 100644
--- a/api_docs/kbn_securitysolution_es_utils.json
+++ b/api_docs/kbn_securitysolution_es_utils.json
@@ -44,7 +44,7 @@
         "signature": [
           "(esClient: Pick<",
           "KibanaClient",
-          ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, index: string) => Promise<unknown>"
+          ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, index: string) => Promise<unknown>"
         ],
         "path": "packages/kbn-securitysolution-es-utils/src/create_boostrap_index/index.ts",
         "deprecated": false,
@@ -59,7 +59,7 @@
             "signature": [
               "Pick<",
               "KibanaClient",
-              ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
+              ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
             ],
             "path": "packages/kbn-securitysolution-es-utils/src/create_boostrap_index/index.ts",
             "deprecated": false,
@@ -124,7 +124,7 @@
         "signature": [
           "(esClient: Pick<",
           "KibanaClient",
-          ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, pattern: string, maxAttempts?: number) => Promise<boolean>"
+          ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, pattern: string, maxAttempts?: number) => Promise<boolean>"
         ],
         "path": "packages/kbn-securitysolution-es-utils/src/delete_all_index/index.ts",
         "deprecated": false,
@@ -139,7 +139,7 @@
             "signature": [
               "Pick<",
               "KibanaClient",
-              ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
+              ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
             ],
             "path": "packages/kbn-securitysolution-es-utils/src/delete_all_index/index.ts",
             "deprecated": false,
@@ -187,7 +187,7 @@
         "signature": [
           "(esClient: Pick<",
           "KibanaClient",
-          ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, policy: string) => Promise<unknown>"
+          ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, policy: string) => Promise<unknown>"
         ],
         "path": "packages/kbn-securitysolution-es-utils/src/delete_policy/index.ts",
         "deprecated": false,
@@ -202,7 +202,7 @@
             "signature": [
               "Pick<",
               "KibanaClient",
-              ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
+              ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
             ],
             "path": "packages/kbn-securitysolution-es-utils/src/delete_policy/index.ts",
             "deprecated": false,
@@ -236,7 +236,7 @@
         "signature": [
           "(esClient: Pick<",
           "KibanaClient",
-          ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, name: string) => Promise<unknown>"
+          ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, name: string) => Promise<unknown>"
         ],
         "path": "packages/kbn-securitysolution-es-utils/src/delete_template/index.ts",
         "deprecated": false,
@@ -251,7 +251,7 @@
             "signature": [
               "Pick<",
               "KibanaClient",
-              ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
+              ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
             ],
             "path": "packages/kbn-securitysolution-es-utils/src/delete_template/index.ts",
             "deprecated": false,
@@ -320,7 +320,7 @@
         "signature": [
           "({ esClient, alias, }: { esClient: Pick<",
           "KibanaClient",
-          ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">; alias: string; }) => Promise<IndexAlias[]>"
+          ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">; alias: string; }) => Promise<IndexAlias[]>"
         ],
         "path": "packages/kbn-securitysolution-es-utils/src/get_index_aliases/index.ts",
         "deprecated": false,
@@ -343,27 +343,7 @@
                 "label": "esClient",
                 "description": [],
                 "signature": [
-                  "{ get: <TDocument = unknown, TContext = unknown>(params: ",
-                  "GetRequest",
-                  ", options?: ",
-                  "TransportRequestOptions",
-                  " | undefined) => ",
-                  "TransportRequestPromise",
-                  "<",
-                  "ApiResponse",
-                  "<",
-                  "GetResponse",
-                  "<TDocument>, TContext>>; delete: <TContext = unknown>(params: ",
-                  "DeleteRequest",
-                  ", options?: ",
-                  "TransportRequestOptions",
-                  " | undefined) => ",
-                  "TransportRequestPromise",
-                  "<",
-                  "ApiResponse",
-                  "<",
-                  "DeleteResponse",
-                  ", TContext>>; monitoring: { bulk<TContext = unknown>(params?: Record<string, any> | undefined, options?: ",
+                  "{ monitoring: { bulk<TContext = unknown>(params?: Record<string, any> | undefined, options?: ",
                   "TransportRequestOptions",
                   " | undefined): ",
                   "TransportRequestPromise",
@@ -765,7 +745,27 @@
                   "ApiResponse",
                   "<",
                   "IndexResponse",
-                  ", TContext>>; update: <TDocumentR = unknown, TDocument = unknown, TPartialDocument = unknown, TContext = unknown>(params: ",
+                  ", TContext>>; delete: <TContext = unknown>(params: ",
+                  "DeleteRequest",
+                  ", options?: ",
+                  "TransportRequestOptions",
+                  " | undefined) => ",
+                  "TransportRequestPromise",
+                  "<",
+                  "ApiResponse",
+                  "<",
+                  "DeleteResponse",
+                  ", TContext>>; get: <TDocument = unknown, TContext = unknown>(params: ",
+                  "GetRequest",
+                  ", options?: ",
+                  "TransportRequestOptions",
+                  " | undefined) => ",
+                  "TransportRequestPromise",
+                  "<",
+                  "ApiResponse",
+                  "<",
+                  "GetResponse",
+                  "<TDocument>, TContext>>; update: <TDocumentR = unknown, TDocument = unknown, TPartialDocument = unknown, TContext = unknown>(params: ",
                   "UpdateRequest",
                   "<TDocument, TPartialDocument>, options?: ",
                   "TransportRequestOptions",
@@ -4120,7 +4120,7 @@
         "signature": [
           "({ esClient, index, }: { esClient: Pick<",
           "KibanaClient",
-          ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">; index: string; }) => Promise<number>"
+          ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">; index: string; }) => Promise<number>"
         ],
         "path": "packages/kbn-securitysolution-es-utils/src/get_index_count/index.ts",
         "deprecated": false,
@@ -4143,27 +4143,7 @@
                 "label": "esClient",
                 "description": [],
                 "signature": [
-                  "{ get: <TDocument = unknown, TContext = unknown>(params: ",
-                  "GetRequest",
-                  ", options?: ",
-                  "TransportRequestOptions",
-                  " | undefined) => ",
-                  "TransportRequestPromise",
-                  "<",
-                  "ApiResponse",
-                  "<",
-                  "GetResponse",
-                  "<TDocument>, TContext>>; delete: <TContext = unknown>(params: ",
-                  "DeleteRequest",
-                  ", options?: ",
-                  "TransportRequestOptions",
-                  " | undefined) => ",
-                  "TransportRequestPromise",
-                  "<",
-                  "ApiResponse",
-                  "<",
-                  "DeleteResponse",
-                  ", TContext>>; monitoring: { bulk<TContext = unknown>(params?: Record<string, any> | undefined, options?: ",
+                  "{ monitoring: { bulk<TContext = unknown>(params?: Record<string, any> | undefined, options?: ",
                   "TransportRequestOptions",
                   " | undefined): ",
                   "TransportRequestPromise",
@@ -4565,7 +4545,27 @@
                   "ApiResponse",
                   "<",
                   "IndexResponse",
-                  ", TContext>>; update: <TDocumentR = unknown, TDocument = unknown, TPartialDocument = unknown, TContext = unknown>(params: ",
+                  ", TContext>>; delete: <TContext = unknown>(params: ",
+                  "DeleteRequest",
+                  ", options?: ",
+                  "TransportRequestOptions",
+                  " | undefined) => ",
+                  "TransportRequestPromise",
+                  "<",
+                  "ApiResponse",
+                  "<",
+                  "DeleteResponse",
+                  ", TContext>>; get: <TDocument = unknown, TContext = unknown>(params: ",
+                  "GetRequest",
+                  ", options?: ",
+                  "TransportRequestOptions",
+                  " | undefined) => ",
+                  "TransportRequestPromise",
+                  "<",
+                  "ApiResponse",
+                  "<",
+                  "GetResponse",
+                  "<TDocument>, TContext>>; update: <TDocumentR = unknown, TDocument = unknown, TPartialDocument = unknown, TContext = unknown>(params: ",
                   "UpdateRequest",
                   "<TDocument, TPartialDocument>, options?: ",
                   "TransportRequestOptions",
@@ -7918,7 +7918,7 @@
         "signature": [
           "(esClient: Pick<",
           "KibanaClient",
-          ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, index: string) => Promise<boolean>"
+          ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, index: string) => Promise<boolean>"
         ],
         "path": "packages/kbn-securitysolution-es-utils/src/get_index_exists/index.ts",
         "deprecated": false,
@@ -7933,7 +7933,7 @@
             "signature": [
               "Pick<",
               "KibanaClient",
-              ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
+              ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
             ],
             "path": "packages/kbn-securitysolution-es-utils/src/get_index_exists/index.ts",
             "deprecated": false,
@@ -7967,7 +7967,7 @@
         "signature": [
           "(esClient: Pick<",
           "KibanaClient",
-          ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, policy: string) => Promise<boolean>"
+          ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, policy: string) => Promise<boolean>"
         ],
         "path": "packages/kbn-securitysolution-es-utils/src/get_policy_exists/index.ts",
         "deprecated": false,
@@ -7982,7 +7982,7 @@
             "signature": [
               "Pick<",
               "KibanaClient",
-              ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
+              ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
             ],
             "path": "packages/kbn-securitysolution-es-utils/src/get_policy_exists/index.ts",
             "deprecated": false,
@@ -8016,7 +8016,7 @@
         "signature": [
           "(esClient: Pick<",
           "KibanaClient",
-          ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, template: string) => Promise<boolean>"
+          ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, template: string) => Promise<boolean>"
         ],
         "path": "packages/kbn-securitysolution-es-utils/src/get_template_exists/index.ts",
         "deprecated": false,
@@ -8031,7 +8031,7 @@
             "signature": [
               "Pick<",
               "KibanaClient",
-              ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
+              ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
             ],
             "path": "packages/kbn-securitysolution-es-utils/src/get_template_exists/index.ts",
             "deprecated": false,
@@ -8065,7 +8065,7 @@
         "signature": [
           "(esClient: Pick<",
           "KibanaClient",
-          ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, index: string) => Promise<unknown>"
+          ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, index: string) => Promise<unknown>"
         ],
         "path": "packages/kbn-securitysolution-es-utils/src/read_index/index.ts",
         "deprecated": false,
@@ -8080,7 +8080,7 @@
             "signature": [
               "Pick<",
               "KibanaClient",
-              ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
+              ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
             ],
             "path": "packages/kbn-securitysolution-es-utils/src/read_index/index.ts",
             "deprecated": false,
@@ -8114,7 +8114,7 @@
         "signature": [
           "(esClient: Pick<",
           "KibanaClient",
-          ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, index: string) => Promise<unknown>"
+          ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, index: string) => Promise<unknown>"
         ],
         "path": "packages/kbn-securitysolution-es-utils/src/read_privileges/index.ts",
         "deprecated": false,
@@ -8129,7 +8129,7 @@
             "signature": [
               "Pick<",
               "KibanaClient",
-              ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
+              ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
             ],
             "path": "packages/kbn-securitysolution-es-utils/src/read_privileges/index.ts",
             "deprecated": false,
@@ -8163,7 +8163,7 @@
         "signature": [
           "(esClient: Pick<",
           "KibanaClient",
-          ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, policy: string, body: Record<string, unknown>) => Promise<unknown>"
+          ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, policy: string, body: Record<string, unknown>) => Promise<unknown>"
         ],
         "path": "packages/kbn-securitysolution-es-utils/src/set_policy/index.ts",
         "deprecated": false,
@@ -8178,7 +8178,7 @@
             "signature": [
               "Pick<",
               "KibanaClient",
-              ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
+              ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
             ],
             "path": "packages/kbn-securitysolution-es-utils/src/set_policy/index.ts",
             "deprecated": false,
@@ -8226,7 +8226,7 @@
         "signature": [
           "(esClient: Pick<",
           "KibanaClient",
-          ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, name: string, body: Record<string, unknown>) => Promise<unknown>"
+          ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">, name: string, body: Record<string, unknown>) => Promise<unknown>"
         ],
         "path": "packages/kbn-securitysolution-es-utils/src/set_template/index.ts",
         "deprecated": false,
@@ -8241,7 +8241,7 @@
             "signature": [
               "Pick<",
               "KibanaClient",
-              ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
+              ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\">"
             ],
             "path": "packages/kbn-securitysolution-es-utils/src/set_template/index.ts",
             "deprecated": false,
diff --git a/api_docs/kbn_securitysolution_io_ts_list_types.json b/api_docs/kbn_securitysolution_io_ts_list_types.json
index 2a1efcc96c5a77..7d10a90dac1673 100644
--- a/api_docs/kbn_securitysolution_io_ts_list_types.json
+++ b/api_docs/kbn_securitysolution_io_ts_list_types.json
@@ -27,7 +27,7 @@
         "label": "updateExceptionListItemValidate",
         "description": [],
         "signature": [
-          "(schema: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => string[]"
+          "(schema: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => string[]"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_validation/index.ts",
         "deprecated": false,
@@ -40,7 +40,7 @@
             "label": "schema",
             "description": [],
             "signature": [
-              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
             ],
             "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_validation/index.ts",
             "deprecated": false,
@@ -58,7 +58,7 @@
         "label": "validateComments",
         "description": [],
         "signature": [
-          "(item: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => string[]"
+          "(item: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => string[]"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_validation/index.ts",
         "deprecated": false,
@@ -71,7 +71,7 @@
             "label": "item",
             "description": [],
             "signature": [
-              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
             ],
             "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_validation/index.ts",
             "deprecated": false,
@@ -153,7 +153,7 @@
             "label": "listItem",
             "description": [],
             "signature": [
-              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
             ],
             "path": "packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts",
             "deprecated": false
@@ -1216,7 +1216,7 @@
             "label": "listItem",
             "description": [],
             "signature": [
-              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
             ],
             "path": "packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts",
             "deprecated": false
@@ -1307,7 +1307,7 @@
             "label": "exceptions",
             "description": [],
             "signature": [
-              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]"
+              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]"
             ],
             "path": "packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts",
             "deprecated": false
@@ -1890,7 +1890,7 @@
         "label": "CreateEndpointListItemSchemaDecoded",
         "description": [],
         "signature": [
-          "Pick<{ description: string; entries: ({ field: string; operator: \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"included\"; type: \"match_any\"; value: string[]; } | { entries: ({ field: string; operator: \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; comments: { comment: string; }[] | undefined; item_id: string | undefined; meta: object | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"type\" | \"description\" | \"name\" | \"meta\"> & { comments: { comment: string; }[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }"
+          "Pick<{ description: string; entries: ({ field: string; operator: \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"included\"; type: \"match_any\"; value: string[]; } | { entries: ({ field: string; operator: \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; comments: { comment: string; }[] | undefined; item_id: string | undefined; meta: object | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"type\" | \"description\" | \"name\" | \"meta\"> & { comments: { comment: string; }[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_endpoint_list_item_schema/index.ts",
         "deprecated": false,
@@ -1918,7 +1918,7 @@
         "label": "CreateExceptionListItemSchema",
         "description": [],
         "signature": [
-          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_exception_list_item_schema/index.ts",
         "deprecated": false,
@@ -1932,7 +1932,7 @@
         "label": "CreateExceptionListItemSchemaDecoded",
         "description": [],
         "signature": [
-          "Pick<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; comments: { comment: string; }[] | undefined; item_id: string | undefined; meta: object | undefined; namespace_type: \"single\" | \"agnostic\" | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"type\" | \"description\" | \"name\" | \"meta\" | \"list_id\" | \"os_types\"> & { comments: { comment: string; }[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }"
+          "Pick<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; comments: { comment: string; }[] | undefined; item_id: string | undefined; meta: object | undefined; namespace_type: \"single\" | \"agnostic\" | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"type\" | \"description\" | \"name\" | \"meta\" | \"list_id\" | \"os_types\"> & { comments: { comment: string; }[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_exception_list_item_schema/index.ts",
         "deprecated": false,
@@ -2002,7 +2002,7 @@
         "label": "CreateListSchema",
         "description": [],
         "signature": [
-          "{ description: string; name: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; } & { deserializer?: string | undefined; id?: string | undefined; meta?: object | undefined; serializer?: string | undefined; version?: number | undefined; }"
+          "{ description: string; name: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; } & { deserializer?: string | undefined; id?: string | undefined; meta?: object | undefined; serializer?: string | undefined; version?: number | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_list_schema/index.ts",
         "deprecated": false,
@@ -2016,7 +2016,7 @@
         "label": "CreateListSchemaDecoded",
         "description": [],
         "signature": [
-          "{ type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; id: string | undefined; description: string; name: string; meta: object | undefined; serializer: string | undefined; deserializer: string | undefined; } & { version: number; }"
+          "{ type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; id: string | undefined; description: string; name: string; meta: object | undefined; serializer: string | undefined; deserializer: string | undefined; } & { version: number; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_list_schema/index.ts",
         "deprecated": false,
@@ -2310,7 +2310,7 @@
         "label": "EntriesArray",
         "description": [],
         "signature": [
-          "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]"
+          "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/entries/index.ts",
         "deprecated": false,
@@ -2324,7 +2324,7 @@
         "label": "EntriesArrayOrUndefined",
         "description": [],
         "signature": [
-          "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[] | undefined"
+          "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[] | undefined"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/entries/index.ts",
         "deprecated": false,
@@ -2338,7 +2338,7 @@
         "label": "Entry",
         "description": [],
         "signature": [
-          "{ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; }"
+          "{ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/entries/index.ts",
         "deprecated": false,
@@ -2366,7 +2366,7 @@
         "label": "EntryList",
         "description": [],
         "signature": [
-          "{ field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; }"
+          "{ field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/entries_list/index.ts",
         "deprecated": false,
@@ -2436,7 +2436,7 @@
         "label": "ExceptionListItemSchema",
         "description": [],
         "signature": [
-          "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
+          "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/exception_list_item_schema/index.ts",
         "deprecated": false,
@@ -2744,7 +2744,7 @@
         "label": "FoundExceptionListItemSchema",
         "description": [],
         "signature": [
-          "{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; }"
+          "{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/found_exception_list_item_schema/index.ts",
         "deprecated": false,
@@ -2772,7 +2772,7 @@
         "label": "FoundListItemSchema",
         "description": [],
         "signature": [
-          "{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]; page: number; per_page: number; total: number; }"
+          "{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]; page: number; per_page: number; total: number; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/found_list_item_schema/index.ts",
         "deprecated": false,
@@ -2786,7 +2786,7 @@
         "label": "FoundListSchema",
         "description": [],
         "signature": [
-          "{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }"
+          "{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/found_list_schema/index.ts",
         "deprecated": false,
@@ -2856,7 +2856,7 @@
         "label": "ImportListItemQuerySchema",
         "description": [],
         "signature": [
-          "{ deserializer: string | undefined; list_id: string | undefined; serializer: string | undefined; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\" | undefined; }"
+          "{ deserializer: string | undefined; list_id: string | undefined; serializer: string | undefined; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\" | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/import_list_item_query_schema/index.ts",
         "deprecated": false,
@@ -2870,7 +2870,7 @@
         "label": "ImportListItemQuerySchemaEncoded",
         "description": [],
         "signature": [
-          "{ deserializer?: string | undefined; list_id?: string | undefined; serializer?: string | undefined; type?: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\" | undefined; }"
+          "{ deserializer?: string | undefined; list_id?: string | undefined; serializer?: string | undefined; type?: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\" | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/import_list_item_query_schema/index.ts",
         "deprecated": false,
@@ -2982,7 +2982,7 @@
         "label": "ListArraySchema",
         "description": [],
         "signature": [
-          "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }[]"
+          "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }[]"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/list_schema/index.ts",
         "deprecated": false,
@@ -3024,7 +3024,7 @@
         "label": "ListItemArraySchema",
         "description": [],
         "signature": [
-          "{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]"
+          "{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/list_item_schema/index.ts",
         "deprecated": false,
@@ -3052,7 +3052,7 @@
         "label": "ListItemSchema",
         "description": [],
         "signature": [
-          "{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }"
+          "{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/list_item_schema/index.ts",
         "deprecated": false,
@@ -3080,7 +3080,7 @@
         "label": "ListSchema",
         "description": [],
         "signature": [
-          "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }"
+          "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/list_schema/index.ts",
         "deprecated": false,
@@ -3262,7 +3262,7 @@
         "label": "NonEmptyEntriesArray",
         "description": [],
         "signature": [
-          "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]"
+          "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/non_empty_entries_array/index.ts",
         "deprecated": false,
@@ -3276,7 +3276,7 @@
         "label": "NonEmptyEntriesArrayDecoded",
         "description": [],
         "signature": [
-          "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]"
+          "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/non_empty_entries_array/index.ts",
         "deprecated": false,
@@ -3598,7 +3598,7 @@
         "label": "SearchListItemArraySchema",
         "description": [],
         "signature": [
-          "{ items: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]; value: unknown; }[]"
+          "{ items: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]; value: unknown; }[]"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/search_list_item_schema/index.ts",
         "deprecated": false,
@@ -3612,7 +3612,7 @@
         "label": "SearchListItemSchema",
         "description": [],
         "signature": [
-          "{ items: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]; value: unknown; }"
+          "{ items: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]; value: unknown; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/search_list_item_schema/index.ts",
         "deprecated": false,
@@ -3752,7 +3752,7 @@
         "label": "Type",
         "description": [],
         "signature": [
-          "\"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\""
+          "\"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\""
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/type/index.ts",
         "deprecated": false,
@@ -3766,7 +3766,7 @@
         "label": "TypeOrUndefined",
         "description": [],
         "signature": [
-          "\"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\" | undefined"
+          "\"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\" | undefined"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/type/index.ts",
         "deprecated": false,
@@ -3822,7 +3822,7 @@
         "label": "UpdateEndpointListItemSchema",
         "description": [],
         "signature": [
-          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_endpoint_list_item_schema/index.ts",
         "deprecated": false,
@@ -3836,7 +3836,7 @@
         "label": "UpdateEndpointListItemSchemaDecoded",
         "description": [],
         "signature": [
-          "Pick<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; _version: string | undefined; comments: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id: string | undefined; item_id: string | undefined; meta: object | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"type\" | \"id\" | \"description\" | \"name\" | \"meta\" | \"_version\" | \"os_types\" | \"item_id\"> & { comments: ({ comment: string; } & { id?: string | undefined; })[]; tags: string[]; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }"
+          "Pick<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; _version: string | undefined; comments: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id: string | undefined; item_id: string | undefined; meta: object | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"type\" | \"id\" | \"description\" | \"name\" | \"meta\" | \"_version\" | \"os_types\" | \"item_id\"> & { comments: ({ comment: string; } & { id?: string | undefined; })[]; tags: string[]; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_endpoint_list_item_schema/index.ts",
         "deprecated": false,
@@ -3850,7 +3850,7 @@
         "label": "UpdateExceptionListItemSchema",
         "description": [],
         "signature": [
-          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_schema/index.ts",
         "deprecated": false,
@@ -3864,7 +3864,7 @@
         "label": "UpdateExceptionListItemSchemaDecoded",
         "description": [],
         "signature": [
-          "Pick<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; _version: string | undefined; comments: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id: string | undefined; item_id: string | undefined; meta: object | undefined; namespace_type: \"single\" | \"agnostic\" | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"type\" | \"id\" | \"description\" | \"name\" | \"meta\" | \"_version\" | \"item_id\"> & { comments: ({ comment: string; } & { id?: string | undefined; })[]; tags: string[]; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }"
+          "Pick<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; _version: string | undefined; comments: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id: string | undefined; item_id: string | undefined; meta: object | undefined; namespace_type: \"single\" | \"agnostic\" | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"type\" | \"id\" | \"description\" | \"name\" | \"meta\" | \"_version\" | \"item_id\"> & { comments: ({ comment: string; } & { id?: string | undefined; })[]; tags: string[]; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_schema/index.ts",
         "deprecated": false,
@@ -4341,7 +4341,7 @@
           "StringC",
           "; entries: ",
           "Type",
-          "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], unknown>; list_id: ",
+          "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], unknown>; list_id: ",
           "Type",
           "<string, string, unknown>; name: ",
           "StringC",
@@ -7077,7 +7077,7 @@
         ],
         "signature": [
           "Type",
-          "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], unknown>"
+          "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], unknown>"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/non_empty_entries_array/index.ts",
         "deprecated": false,
@@ -7902,7 +7902,7 @@
           "StringC",
           "; entries: ",
           "Type",
-          "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], unknown>; name: ",
+          "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], unknown>; name: ",
           "StringC",
           "; type: ",
           "KeyofC",
@@ -7955,7 +7955,7 @@
           "StringC",
           "; entries: ",
           "Type",
-          "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], unknown>; name: ",
+          "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], unknown>; name: ",
           "StringC",
           "; type: ",
           "KeyofC",
diff --git a/api_docs/kbn_securitysolution_list_api.json b/api_docs/kbn_securitysolution_list_api.json
index 7d6b00cbbc3289..2c930b13c33b3f 100644
--- a/api_docs/kbn_securitysolution_list_api.json
+++ b/api_docs/kbn_securitysolution_list_api.json
@@ -80,7 +80,7 @@
             "section": "def-common.AddExceptionListItemProps",
             "text": "AddExceptionListItemProps"
           },
-          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
         ],
         "path": "packages/kbn-securitysolution-list-api/src/api/index.ts",
         "deprecated": false,
@@ -248,7 +248,7 @@
             "section": "def-common.ApiCallByIdProps",
             "text": "ApiCallByIdProps"
           },
-          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
         ],
         "path": "packages/kbn-securitysolution-list-api/src/api/index.ts",
         "deprecated": false,
@@ -287,7 +287,7 @@
         "signature": [
           "({ deleteReferences, http, id, ignoreReferences, signal, }: ",
           "DeleteListParams",
-          ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }>"
+          ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }>"
         ],
         "path": "packages/kbn-securitysolution-list-api/src/list_api/index.ts",
         "deprecated": false,
@@ -453,7 +453,7 @@
             "section": "def-common.ApiCallByIdProps",
             "text": "ApiCallByIdProps"
           },
-          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
         ],
         "path": "packages/kbn-securitysolution-list-api/src/api/index.ts",
         "deprecated": false,
@@ -498,7 +498,7 @@
             "section": "def-common.ApiCallByListIdProps",
             "text": "ApiCallByListIdProps"
           },
-          ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; }>"
+          ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; }>"
         ],
         "path": "packages/kbn-securitysolution-list-api/src/api/index.ts",
         "deprecated": false,
@@ -582,7 +582,7 @@
         "signature": [
           "({ cursor, http, pageIndex, pageSize, signal, }: ",
           "FindListsParams",
-          ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }>"
+          ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }>"
         ],
         "path": "packages/kbn-securitysolution-list-api/src/list_api/index.ts",
         "deprecated": false,
@@ -615,7 +615,7 @@
         "signature": [
           "({ file, http, listId, type, signal, }: ",
           "ImportListParams",
-          ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }>"
+          ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }>"
         ],
         "path": "packages/kbn-securitysolution-list-api/src/list_api/index.ts",
         "deprecated": false,
@@ -785,7 +785,7 @@
             "section": "def-common.UpdateExceptionListItemProps",
             "text": "UpdateExceptionListItemProps"
           },
-          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
         ],
         "path": "packages/kbn-securitysolution-list-api/src/api/index.ts",
         "deprecated": false,
diff --git a/api_docs/kbn_securitysolution_list_hooks.json b/api_docs/kbn_securitysolution_list_hooks.json
index bc26e83c859ac6..a6dd6a78eefae2 100644
--- a/api_docs/kbn_securitysolution_list_hooks.json
+++ b/api_docs/kbn_securitysolution_list_hooks.json
@@ -29,7 +29,7 @@
           "\nThis adds an id to the incoming exception item entries as ReactJS prefers to have\nan id added to them for use as a stable id. Later if we decide to change the data\nmodel to have id's within the array then this code should be removed. If not, then\nthis code should stay as an adapter for ReactJS.\n\nThis does break the type system slightly as we are lying a bit to the type system as we return\nthe same exceptionItem as we have previously but are augmenting the arrays with an id which TypeScript\ndoesn't mind us doing here. However, downstream you will notice that you have an id when the type\ndoes not indicate it. In that case use (ExceptionItem & { id: string }) temporarily if you're using the id. If you're not,\nyou can ignore the id and just use the normal TypeScript with ReactJS.\n"
         ],
         "signature": [
-          "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
+          "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
         ],
         "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts",
         "deprecated": false,
@@ -44,7 +44,7 @@
               "The exceptionItem to add an id to the threat matches."
             ],
             "signature": [
-              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
+              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
             ],
             "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts",
             "deprecated": false,
@@ -66,7 +66,7 @@
           "\nThis removes an id from the exceptionItem entries as ReactJS prefers to have\nan id added to them for use as a stable id. Later if we decide to change the data\nmodel to have id's within the array then this code should be removed. If not, then\nthis code should stay as an adapter for ReactJS.\n"
         ],
         "signature": [
-          "<T extends { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; }>(exceptionItem: T) => T"
+          "<T extends { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; }>(exceptionItem: T) => T"
         ],
         "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts",
         "deprecated": false,
@@ -103,7 +103,7 @@
           "\nTransforms the output of rules to compensate for technical debt or UI concerns such as\nReactJS preferences for having ids within arrays if the data is not modeled that way.\n\nIf you add a new transform of the input called \"myNewTransform\" do it\nin the form of:\nflow(addIdToExceptionItemEntries, myNewTransform)(exceptionItem)\n"
         ],
         "signature": [
-          "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
+          "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
         ],
         "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts",
         "deprecated": false,
@@ -118,7 +118,7 @@
               "The exceptionItem to transform the output of"
             ],
             "signature": [
-              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
+              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
             ],
             "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts",
             "deprecated": false,
@@ -138,7 +138,7 @@
         "label": "transformNewItemOutput",
         "description": [],
         "signature": [
-          "(exceptionItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+          "(exceptionItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts",
         "deprecated": false,
@@ -151,7 +151,7 @@
             "label": "exceptionItem",
             "description": [],
             "signature": [
-              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
             ],
             "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts",
             "deprecated": false,
@@ -171,7 +171,7 @@
           "\nTransforms the output of exception items to compensate for technical debt or UI concerns such as\nReactJS preferences for having ids within arrays if the data is not modeled that way.\n\nIf you add a new transform of the output called \"myNewTransform\" do it\nin the form of:\nflow(removeIdFromExceptionItemsEntries, myNewTransform)(exceptionItem)\n"
         ],
         "signature": [
-          "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })"
+          "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })"
         ],
         "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts",
         "deprecated": false,
@@ -186,7 +186,7 @@
               "The exceptionItem to transform the output of"
             ],
             "signature": [
-              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })"
+              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })"
             ],
             "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts",
             "deprecated": false,
@@ -329,7 +329,7 @@
           },
           "<",
           "DeleteListParams",
-          ">], { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }>"
+          ">], { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }>"
         ],
         "path": "packages/kbn-securitysolution-list-hooks/src/use_delete_list/index.ts",
         "deprecated": false,
@@ -493,7 +493,7 @@
           },
           "<",
           "FindListsParams",
-          ">], { cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }>"
+          ">], { cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }>"
         ],
         "path": "packages/kbn-securitysolution-list-hooks/src/use_find_lists/index.ts",
         "deprecated": false,
@@ -521,7 +521,7 @@
           },
           "<",
           "ImportListParams",
-          ">], { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }>"
+          ">], { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }>"
         ],
         "path": "packages/kbn-securitysolution-list-hooks/src/use_import_list/index.ts",
         "deprecated": false,
@@ -713,7 +713,7 @@
             "label": "addExceptionListItem",
             "description": [],
             "signature": [
-              "(arg: { listItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }; }) => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+              "(arg: { listItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }; }) => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
             ],
             "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts",
             "deprecated": false,
@@ -736,7 +736,7 @@
                     "label": "listItem",
                     "description": [],
                     "signature": [
-                      "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+                      "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
                     ],
                     "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts",
                     "deprecated": false
@@ -754,7 +754,7 @@
             "label": "updateExceptionListItem",
             "description": [],
             "signature": [
-              "(arg: { listItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }; }) => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+              "(arg: { listItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }; }) => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
             ],
             "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts",
             "deprecated": false,
@@ -777,7 +777,7 @@
                     "label": "listItem",
                     "description": [],
                     "signature": [
-                      "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+                      "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
                     ],
                     "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts",
                     "deprecated": false
@@ -891,7 +891,7 @@
                 "section": "def-common.ApiCallMemoProps",
                 "text": "ApiCallMemoProps"
               },
-              " & { onSuccess: (arg: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => void; }) => Promise<void>"
+              " & { onSuccess: (arg: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => void; }) => Promise<void>"
             ],
             "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts",
             "deprecated": false,
@@ -911,7 +911,7 @@
                     "section": "def-common.ApiCallMemoProps",
                     "text": "ApiCallMemoProps"
                   },
-                  " & { onSuccess: (arg: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => void; }"
+                  " & { onSuccess: (arg: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => void; }"
                 ],
                 "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts",
                 "deprecated": false,
@@ -1116,7 +1116,7 @@
         "label": "ReturnExceptionListAndItems",
         "description": [],
         "signature": [
-          "[boolean, { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[], ",
+          "[boolean, { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[], ",
           {
             "pluginId": "@kbn/securitysolution-io-ts-list-types",
             "scope": "common",
@@ -1176,7 +1176,7 @@
         "label": "ReturnPersistExceptionItem",
         "description": [],
         "signature": [
-          "[PersistReturnExceptionItem, React.Dispatch<({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | null>]"
+          "[PersistReturnExceptionItem, React.Dispatch<({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | null>]"
         ],
         "path": "packages/kbn-securitysolution-list-hooks/src/use_persist_exception_item/index.ts",
         "deprecated": false,
diff --git a/api_docs/kbn_securitysolution_list_utils.json b/api_docs/kbn_securitysolution_list_utils.json
index 5b956218f5ac81..5177d53b2acfbd 100644
--- a/api_docs/kbn_securitysolution_list_utils.json
+++ b/api_docs/kbn_securitysolution_list_utils.json
@@ -27,7 +27,7 @@
         "label": "addIdToEntries",
         "description": [],
         "signature": [
-          "(entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]) => ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]"
+          "(entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]) => ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]"
         ],
         "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts",
         "deprecated": false,
@@ -40,7 +40,7 @@
             "label": "entries",
             "description": [],
             "signature": [
-              "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]"
+              "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]"
             ],
             "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts",
             "deprecated": false,
@@ -58,7 +58,7 @@
         "label": "buildExceptionFilter",
         "description": [],
         "signature": [
-          "({ lists, excludeExceptions, chunkSize, }: { lists: ({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]; excludeExceptions: boolean; chunkSize: number; }) => ",
+          "({ lists, excludeExceptions, chunkSize, }: { lists: ({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]; excludeExceptions: boolean; chunkSize: number; }) => ",
           {
             "pluginId": "@kbn/es-query",
             "scope": "common",
@@ -89,7 +89,7 @@
                 "label": "lists",
                 "description": [],
                 "signature": [
-                  "({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]"
+                  "({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]"
                 ],
                 "path": "packages/kbn-securitysolution-list-utils/src/build_exception_filter/index.ts",
                 "deprecated": false
@@ -696,7 +696,7 @@
             "section": "def-common.ExceptionsBuilderExceptionItem",
             "text": "ExceptionsBuilderExceptionItem"
           },
-          "[]) => ({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]"
+          "[]) => ({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]"
         ],
         "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts",
         "deprecated": false,
@@ -968,7 +968,7 @@
             "section": "def-common.FormattedBuilderEntry",
             "text": "FormattedBuilderEntry"
           },
-          ") => ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } & { id?: string | undefined; }) | ({ field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } & { id?: string | undefined; }) | ({ field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } & { id?: string | undefined; }) | ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } & { id?: string | undefined; }) | ({ field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } & { id?: string | undefined; })"
+          ") => ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } & { id?: string | undefined; }) | ({ field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } & { id?: string | undefined; }) | ({ field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } & { id?: string | undefined; }) | ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } & { id?: string | undefined; }) | ({ field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } & { id?: string | undefined; })"
         ],
         "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts",
         "deprecated": false,
@@ -1122,7 +1122,7 @@
             "section": "def-common.FormattedBuilderEntry",
             "text": "FormattedBuilderEntry"
           },
-          ", newField: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }) => { index: number; updatedEntry: ",
+          ", newField: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }) => { index: number; updatedEntry: ",
           {
             "pluginId": "@kbn/securitysolution-list-utils",
             "scope": "common",
@@ -1167,7 +1167,7 @@
               "- newly selected list"
             ],
             "signature": [
-              "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }"
+              "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }"
             ],
             "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts",
             "deprecated": false,
@@ -2635,7 +2635,7 @@
         "label": "hasLargeValueList",
         "description": [],
         "signature": [
-          "(entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]) => boolean"
+          "(entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]) => boolean"
         ],
         "path": "packages/kbn-securitysolution-list-utils/src/has_large_value_list/index.ts",
         "deprecated": false,
@@ -2648,7 +2648,7 @@
             "label": "entries",
             "description": [],
             "signature": [
-              "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]"
+              "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]"
             ],
             "path": "packages/kbn-securitysolution-list-utils/src/has_large_value_list/index.ts",
             "deprecated": false,
@@ -3355,7 +3355,7 @@
         "label": "BuilderEntry",
         "description": [],
         "signature": [
-          "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } & { id?: string | undefined; }) | ({ field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } & { id?: string | undefined; }) | ({ field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } & { id?: string | undefined; }) | ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } & { id?: string | undefined; }) | ({ field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } & { id?: string | undefined; }) | ",
+          "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } & { id?: string | undefined; }) | ({ field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } & { id?: string | undefined; }) | ({ field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } & { id?: string | undefined; }) | ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } & { id?: string | undefined; }) | ({ field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } & { id?: string | undefined; }) | ",
           {
             "pluginId": "@kbn/securitysolution-list-utils",
             "scope": "common",
@@ -3414,7 +3414,7 @@
         "label": "CreateExceptionListItemBuilderSchema",
         "description": [],
         "signature": [
-          "Pick<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }, \"type\" | \"description\" | \"name\" | \"tags\" | \"comments\" | \"list_id\" | \"namespace_type\" | \"os_types\" | \"item_id\"> & { meta: { temporaryUuid: string; }; entries: ",
+          "Pick<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }, \"type\" | \"description\" | \"name\" | \"tags\" | \"comments\" | \"list_id\" | \"namespace_type\" | \"os_types\" | \"item_id\"> & { meta: { temporaryUuid: string; }; entries: ",
           {
             "pluginId": "@kbn/securitysolution-list-utils",
             "scope": "common",
@@ -3548,7 +3548,7 @@
         "label": "ExceptionListItemBuilderSchema",
         "description": [],
         "signature": [
-          "Pick<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }, \"type\" | \"id\" | \"description\" | \"name\" | \"tags\" | \"meta\" | \"updated_at\" | \"comments\" | \"_version\" | \"created_at\" | \"created_by\" | \"updated_by\" | \"tie_breaker_id\" | \"list_id\" | \"namespace_type\" | \"os_types\" | \"item_id\"> & { entries: ",
+          "Pick<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }, \"type\" | \"id\" | \"description\" | \"name\" | \"tags\" | \"meta\" | \"updated_at\" | \"comments\" | \"_version\" | \"created_at\" | \"created_by\" | \"updated_by\" | \"tie_breaker_id\" | \"list_id\" | \"namespace_type\" | \"os_types\" | \"item_id\"> & { entries: ",
           {
             "pluginId": "@kbn/securitysolution-list-utils",
             "scope": "common",
diff --git a/api_docs/kbn_securitysolution_utils.json b/api_docs/kbn_securitysolution_utils.json
index fc0556f7926a09..61eda7861af569 100644
--- a/api_docs/kbn_securitysolution_utils.json
+++ b/api_docs/kbn_securitysolution_utils.json
@@ -76,6 +76,37 @@
         ],
         "returnComment": [],
         "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-utils",
+        "id": "def-server.transformDataToNdjson",
+        "type": "Function",
+        "tags": [],
+        "label": "transformDataToNdjson",
+        "description": [],
+        "signature": [
+          "(data: unknown[]) => string"
+        ],
+        "path": "packages/kbn-securitysolution-utils/src/transform_data_to_ndjson/index.ts",
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-utils",
+            "id": "def-server.transformDataToNdjson.$1",
+            "type": "Array",
+            "tags": [],
+            "label": "data",
+            "description": [],
+            "signature": [
+              "unknown[]"
+            ],
+            "path": "packages/kbn-securitysolution-utils/src/transform_data_to_ndjson/index.ts",
+            "deprecated": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
       }
     ],
     "interfaces": [],
diff --git a/api_docs/kbn_securitysolution_utils.mdx b/api_docs/kbn_securitysolution_utils.mdx
index 63039630e7c9a7..23f9c42bfb9c49 100644
--- a/api_docs/kbn_securitysolution_utils.mdx
+++ b/api_docs/kbn_securitysolution_utils.mdx
@@ -18,7 +18,7 @@ Contact [Owner missing] for questions regarding this plugin.
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 4 | 0 | 2 | 0 |
+| 6 | 0 | 4 | 0 |
 
 ## Server
 
diff --git a/api_docs/kibana_react.json b/api_docs/kibana_react.json
index 5d7a7241dd9564..be973dd7ceb10a 100644
--- a/api_docs/kibana_react.json
+++ b/api_docs/kibana_react.json
@@ -3416,7 +3416,7 @@
             "label": "color",
             "description": [],
             "signature": [
-              "\"warning\" | \"primary\" | \"success\" | \"danger\" | undefined"
+              "\"primary\" | \"success\" | \"warning\" | \"danger\" | undefined"
             ],
             "path": "src/plugins/kibana_react/public/notifications/types.ts",
             "deprecated": false
@@ -3807,7 +3807,7 @@
           "DisambiguateSet",
           "<LabelAsString, LabelAsNode> & ",
           "DisambiguateSet",
-          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"warning\" | \"primary\" | \"success\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
+          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"primary\" | \"success\" | \"warning\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
           "DisambiguateSet",
           "<",
           "PropsForAnchor",
@@ -3939,7 +3939,7 @@
           "DisambiguateSet",
           "<LabelAsString, LabelAsNode> & ",
           "DisambiguateSet",
-          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"warning\" | \"primary\" | \"success\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
+          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"primary\" | \"success\" | \"warning\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
           "DisambiguateSet",
           "<",
           "PropsForAnchor",
@@ -4071,7 +4071,7 @@
           "DisambiguateSet",
           "<LabelAsString, LabelAsNode> & ",
           "DisambiguateSet",
-          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"warning\" | \"primary\" | \"success\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
+          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"primary\" | \"success\" | \"warning\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
           "DisambiguateSet",
           "<",
           "PropsForAnchor",
@@ -4203,7 +4203,7 @@
           "DisambiguateSet",
           "<LabelAsString, LabelAsNode> & ",
           "DisambiguateSet",
-          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"warning\" | \"primary\" | \"success\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
+          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"primary\" | \"success\" | \"warning\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
           "DisambiguateSet",
           "<",
           "PropsForAnchor",
@@ -4349,7 +4349,7 @@
           "DisambiguateSet",
           "<LabelAsString, LabelAsNode> & ",
           "DisambiguateSet",
-          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"warning\" | \"primary\" | \"success\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
+          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"primary\" | \"success\" | \"warning\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
           "DisambiguateSet",
           "<",
           "PropsForAnchor",
@@ -4481,7 +4481,7 @@
           "DisambiguateSet",
           "<LabelAsString, LabelAsNode> & ",
           "DisambiguateSet",
-          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"warning\" | \"primary\" | \"success\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
+          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"primary\" | \"success\" | \"warning\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
           "DisambiguateSet",
           "<",
           "PropsForAnchor",
@@ -4613,7 +4613,7 @@
           "DisambiguateSet",
           "<LabelAsString, LabelAsNode> & ",
           "DisambiguateSet",
-          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"warning\" | \"primary\" | \"success\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
+          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"primary\" | \"success\" | \"warning\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
           "DisambiguateSet",
           "<",
           "PropsForAnchor",
@@ -4745,7 +4745,7 @@
           "DisambiguateSet",
           "<LabelAsString, LabelAsNode> & ",
           "DisambiguateSet",
-          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"warning\" | \"primary\" | \"success\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
+          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"primary\" | \"success\" | \"warning\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
           "DisambiguateSet",
           "<",
           "PropsForAnchor",
@@ -5064,7 +5064,7 @@
           "DisambiguateSet",
           "<LabelAsString, LabelAsNode> & ",
           "DisambiguateSet",
-          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"warning\" | \"primary\" | \"success\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
+          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"primary\" | \"success\" | \"warning\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
           "DisambiguateSet",
           "<",
           "PropsForAnchor",
@@ -5196,7 +5196,7 @@
           "DisambiguateSet",
           "<LabelAsString, LabelAsNode> & ",
           "DisambiguateSet",
-          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"warning\" | \"primary\" | \"success\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
+          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"primary\" | \"success\" | \"warning\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
           "DisambiguateSet",
           "<",
           "PropsForAnchor",
@@ -5328,7 +5328,7 @@
           "DisambiguateSet",
           "<LabelAsString, LabelAsNode> & ",
           "DisambiguateSet",
-          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"warning\" | \"primary\" | \"success\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
+          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"primary\" | \"success\" | \"warning\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
           "DisambiguateSet",
           "<",
           "PropsForAnchor",
@@ -5460,7 +5460,7 @@
           "DisambiguateSet",
           "<LabelAsString, LabelAsNode> & ",
           "DisambiguateSet",
-          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"warning\" | \"primary\" | \"success\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
+          "<{ tooltipContent: React.ReactNode; title?: string | undefined; }, { title: string; tooltipContent?: React.ReactNode; }> & { title: string; tooltipContent?: React.ReactNode; } & { label: React.ReactNode; }> | undefined; display?: \"primary\" | \"success\" | \"warning\" | \"danger\" | \"accent\" | \"transparent\" | \"plain\" | \"subdued\" | undefined; paddingSize?: \"none\" | \"m\" | \"s\" | \"l\" | undefined; selectable?: (",
           "DisambiguateSet",
           "<",
           "PropsForAnchor",
diff --git a/api_docs/kibana_utils.json b/api_docs/kibana_utils.json
index 744c735e94d686..71174e6eafe3f2 100644
--- a/api_docs/kibana_utils.json
+++ b/api_docs/kibana_utils.json
@@ -6895,7 +6895,7 @@
           "signature": [
             "(history: Pick<",
             "History",
-            "<any>, \"location\" | \"replace\">) => void"
+            "<any>, \"replace\" | \"location\">) => void"
           ],
           "path": "src/plugins/kibana_utils/public/plugin.ts",
           "deprecated": false,
@@ -6910,7 +6910,7 @@
               "signature": [
                 "Pick<",
                 "History",
-                "<any>, \"location\" | \"replace\">"
+                "<any>, \"replace\" | \"location\">"
               ],
               "path": "src/plugins/kibana_utils/public/plugin.ts",
               "deprecated": false,
diff --git a/api_docs/lens.json b/api_docs/lens.json
index 18f6f3320f624b..7dc468fcad234d 100644
--- a/api_docs/lens.json
+++ b/api_docs/lens.json
@@ -332,7 +332,7 @@
             "label": "operationType",
             "description": [],
             "signature": [
-              "\"range\" | \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"math\" | \"overall_sum\" | \"overall_min\" | \"overall_max\" | \"overall_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\" | \"formula\" | \"static_value\" | undefined"
+              "\"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"range\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"math\" | \"overall_sum\" | \"overall_min\" | \"overall_max\" | \"overall_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\" | \"formula\" | \"static_value\" | undefined"
             ],
             "path": "x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/column_types.ts",
             "deprecated": false
@@ -2290,7 +2290,7 @@
           "\nA union type of all available operation types. The operation type is a unique id of an operation.\nEach column is assigned to exactly one operation type."
         ],
         "signature": [
-          "\"range\" | \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"math\" | \"overall_sum\" | \"overall_min\" | \"overall_max\" | \"overall_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\" | \"formula\" | \"static_value\""
+          "\"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"range\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"math\" | \"overall_sum\" | \"overall_min\" | \"overall_max\" | \"overall_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\" | \"formula\" | \"static_value\""
         ],
         "path": "x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/index.ts",
         "deprecated": false,
@@ -2911,7 +2911,7 @@
             "label": "state",
             "description": [],
             "signature": [
-              "{ datasourceMetaData: { filterableIndexPatterns: { id: string; title: string; }[]; }; datasourceStates: { indexpattern: { currentIndexPatternId: string; layers: Record<string, { columns: Record<string, { operationType: \"range\" | \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\"; }>; }>; }; }; visualization: VisualizationState; query: ",
+              "{ datasourceMetaData: { filterableIndexPatterns: { id: string; title: string; }[]; }; datasourceStates: { indexpattern: { currentIndexPatternId: string; layers: Record<string, { columns: Record<string, { operationType: \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"range\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\"; }>; }>; }; }; visualization: VisualizationState; query: ",
               {
                 "pluginId": "@kbn/es-query",
                 "scope": "common",
@@ -3212,7 +3212,7 @@
             "section": "def-server.LensDocShapePost712",
             "text": "LensDocShapePost712"
           },
-          "<unknown>, \"title\" | \"expression\" | \"visualizationType\"> & { state: Pick<{ datasourceMetaData: { filterableIndexPatterns: { id: string; title: string; }[]; }; datasourceStates: { indexpattern: { currentIndexPatternId: string; layers: Record<string, { columns: Record<string, { operationType: \"range\" | \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\"; }>; }>; }; }; visualization: unknown; query: ",
+          "<unknown>, \"title\" | \"expression\" | \"visualizationType\"> & { state: Pick<{ datasourceMetaData: { filterableIndexPatterns: { id: string; title: string; }[]; }; datasourceStates: { indexpattern: { currentIndexPatternId: string; layers: Record<string, { columns: Record<string, { operationType: \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"range\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\"; }>; }>; }; }; visualization: unknown; query: ",
           {
             "pluginId": "@kbn/es-query",
             "scope": "common",
@@ -3228,7 +3228,7 @@
             "section": "def-common.Filter",
             "text": "Filter"
           },
-          "[]; }, \"filters\" | \"query\" | \"visualization\" | \"datasourceMetaData\"> & { datasourceStates: { indexpattern: Pick<{ currentIndexPatternId: string; layers: Record<string, { columns: Record<string, { operationType: \"range\" | \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\"; }>; }>; }, \"currentIndexPatternId\"> & { layers: Record<string, Pick<{ columns: Record<string, { operationType: \"range\" | \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\"; }>; }, never> & { columns: Record<string, { operationType: \"range\" | \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\"; } | { operationType: \"date_histogram\"; params: { interval: string; timeZone?: string | undefined; }; }>; }>; }; }; }; }"
+          "[]; }, \"filters\" | \"query\" | \"visualization\" | \"datasourceMetaData\"> & { datasourceStates: { indexpattern: Pick<{ currentIndexPatternId: string; layers: Record<string, { columns: Record<string, { operationType: \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"range\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\"; }>; }>; }, \"currentIndexPatternId\"> & { layers: Record<string, Pick<{ columns: Record<string, { operationType: \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"range\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\"; }>; }, never> & { columns: Record<string, { operationType: \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"range\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\"; } | { operationType: \"date_histogram\"; params: { interval: string; timeZone?: string | undefined; }; }>; }>; }; }; }; }"
         ],
         "path": "x-pack/plugins/lens/server/migrations/types.ts",
         "deprecated": false,
@@ -3250,7 +3250,7 @@
             "section": "def-server.LensDocShapePost712",
             "text": "LensDocShapePost712"
           },
-          "<unknown>, \"title\" | \"expression\" | \"visualizationType\"> & { state: Pick<{ datasourceMetaData: { filterableIndexPatterns: { id: string; title: string; }[]; }; datasourceStates: { indexpattern: { currentIndexPatternId: string; layers: Record<string, { columns: Record<string, { operationType: \"range\" | \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\"; }>; }>; }; }; visualization: unknown; query: ",
+          "<unknown>, \"title\" | \"expression\" | \"visualizationType\"> & { state: Pick<{ datasourceMetaData: { filterableIndexPatterns: { id: string; title: string; }[]; }; datasourceStates: { indexpattern: { currentIndexPatternId: string; layers: Record<string, { columns: Record<string, { operationType: \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"range\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\"; }>; }>; }; }; visualization: unknown; query: ",
           {
             "pluginId": "@kbn/es-query",
             "scope": "common",
@@ -3266,7 +3266,7 @@
             "section": "def-common.Filter",
             "text": "Filter"
           },
-          "[]; }, \"filters\" | \"query\" | \"visualization\" | \"datasourceMetaData\"> & { datasourceStates: { indexpattern: Pick<{ currentIndexPatternId: string; layers: Record<string, { columns: Record<string, { operationType: \"range\" | \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\"; }>; }>; }, \"currentIndexPatternId\"> & { layers: Record<string, Pick<{ columns: Record<string, { operationType: \"range\" | \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\"; }>; }, never> & { columns: Record<string, { operationType: \"range\" | \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\"; } | { operationType: \"date_histogram\"; params: { interval: string; }; }>; }>; }; }; }; }"
+          "[]; }, \"filters\" | \"query\" | \"visualization\" | \"datasourceMetaData\"> & { datasourceStates: { indexpattern: Pick<{ currentIndexPatternId: string; layers: Record<string, { columns: Record<string, { operationType: \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"range\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\"; }>; }>; }, \"currentIndexPatternId\"> & { layers: Record<string, Pick<{ columns: Record<string, { operationType: \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"range\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\"; }>; }, never> & { columns: Record<string, { operationType: \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"range\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\"; } | { operationType: \"date_histogram\"; params: { interval: string; }; }>; }>; }; }; }; }"
         ],
         "path": "x-pack/plugins/lens/server/migrations/types.ts",
         "deprecated": false,
@@ -3280,7 +3280,7 @@
         "label": "OperationTypePost712",
         "description": [],
         "signature": [
-          "\"range\" | \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\""
+          "\"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"range\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\""
         ],
         "path": "x-pack/plugins/lens/server/migrations/types.ts",
         "deprecated": false,
@@ -3294,7 +3294,7 @@
         "label": "OperationTypePre712",
         "description": [],
         "signature": [
-          "\"range\" | \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"percentile\" | \"terms\" | \"avg\" | \"median\" | \"cumulative_sum\" | \"derivative\" | \"moving_average\" | \"cardinality\" | \"counter_rate\" | \"last_value\""
+          "\"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"percentile\" | \"range\" | \"terms\" | \"avg\" | \"median\" | \"cumulative_sum\" | \"derivative\" | \"moving_average\" | \"cardinality\" | \"counter_rate\" | \"last_value\""
         ],
         "path": "x-pack/plugins/lens/server/migrations/types.ts",
         "deprecated": false,
@@ -4244,13 +4244,21 @@
         "signature": [
           "(mapping?: ",
           {
-            "pluginId": "expressions",
+            "pluginId": "fieldFormats",
             "scope": "common",
-            "docId": "kibExpressionsPluginApi",
+            "docId": "kibFieldFormatsPluginApi",
             "section": "def-common.SerializedFieldFormat",
             "text": "SerializedFieldFormat"
           },
-          "<Record<string, any>> | undefined) => ",
+          "<",
+          {
+            "pluginId": "fieldFormats",
+            "scope": "common",
+            "docId": "kibFieldFormatsPluginApi",
+            "section": "def-common.FieldFormatParams",
+            "text": "FieldFormatParams"
+          },
+          "> | undefined) => ",
           {
             "pluginId": "fieldFormats",
             "scope": "common",
@@ -4272,13 +4280,21 @@
             "description": [],
             "signature": [
               {
-                "pluginId": "expressions",
+                "pluginId": "fieldFormats",
                 "scope": "common",
-                "docId": "kibExpressionsPluginApi",
+                "docId": "kibFieldFormatsPluginApi",
                 "section": "def-common.SerializedFieldFormat",
                 "text": "SerializedFieldFormat"
               },
-              "<Record<string, any>> | undefined"
+              "<",
+              {
+                "pluginId": "fieldFormats",
+                "scope": "common",
+                "docId": "kibFieldFormatsPluginApi",
+                "section": "def-common.FieldFormatParams",
+                "text": "FieldFormatParams"
+              },
+              "> | undefined"
             ],
             "path": "x-pack/plugins/lens/common/types.ts",
             "deprecated": false
diff --git a/api_docs/lists.json b/api_docs/lists.json
index d6e2a97fa78abc..b3d498a4532d39 100644
--- a/api_docs/lists.json
+++ b/api_docs/lists.json
@@ -410,7 +410,7 @@
             "signature": [
               "({ itemId, id, namespaceType, }: ",
               "GetExceptionListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -480,7 +480,7 @@
             "signature": [
               "({ comments, description, entries, itemId, meta, name, osTypes, tags, type, }: ",
               "CreateEndpointListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -514,7 +514,7 @@
             "signature": [
               "({ _version, comments, description, entries, id, itemId, meta, name, osTypes, tags, type, }: ",
               "UpdateEndpointListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -548,7 +548,7 @@
             "signature": [
               "({ itemId, id, }: ",
               "GetEndpointListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -682,7 +682,7 @@
                 "section": "def-server.CreateExceptionListItemOptions",
                 "text": "CreateExceptionListItemOptions"
               },
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -726,7 +726,7 @@
                 "section": "def-server.UpdateExceptionListItemOptions",
                 "text": "UpdateExceptionListItemOptions"
               },
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -764,7 +764,7 @@
             "signature": [
               "({ id, itemId, namespaceType, }: ",
               "DeleteExceptionListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -830,7 +830,7 @@
             "signature": [
               "({ id, itemId, }: ",
               "DeleteEndpointListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -862,7 +862,7 @@
             "signature": [
               "({ listId, filter, perPage, page, sortField, sortOrder, namespaceType, }: ",
               "FindExceptionListItemOptions",
-              ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } | null>"
+              ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -894,7 +894,7 @@
             "signature": [
               "({ listId, filter, perPage, page, sortField, sortOrder, namespaceType, }: ",
               "FindExceptionListsItemOptions",
-              ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } | null>"
+              ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -926,7 +926,7 @@
             "signature": [
               "({ perPage, page, sortField, sortOrder, valueListId, }: ",
               "FindValueListExceptionListsItems",
-              ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } | null>"
+              ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -992,7 +992,7 @@
             "signature": [
               "({ filter, perPage, page, sortField, sortOrder, }: ",
               "FindEndpointListItemOptions",
-              ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } | null>"
+              ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -1097,7 +1097,7 @@
             "signature": [
               "({ id }: ",
               "GetListOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; } | null>"
+              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
             "deprecated": false,
@@ -1129,7 +1129,7 @@
             "signature": [
               "({ id, deserializer, immutable, serializer, name, description, type, meta, version, }: ",
               "CreateListOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }>"
+              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }>"
             ],
             "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
             "deprecated": false,
@@ -1161,7 +1161,7 @@
             "signature": [
               "({ id, deserializer, serializer, name, description, immutable, type, meta, version, }: ",
               "CreateListIfItDoesNotExistOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }>"
+              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }>"
             ],
             "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
             "deprecated": false,
@@ -1493,7 +1493,7 @@
             "signature": [
               "({ id }: ",
               "DeleteListItemOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; } | null>"
+              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
             "deprecated": false,
@@ -1525,7 +1525,7 @@
             "signature": [
               "({ listId, value, type, }: ",
               "DeleteListItemByValueOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]>"
+              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]>"
             ],
             "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
             "deprecated": false,
@@ -1557,7 +1557,7 @@
             "signature": [
               "({ id }: ",
               "DeleteListOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; } | null>"
+              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
             "deprecated": false,
@@ -1621,7 +1621,7 @@
             "signature": [
               "({ deserializer, serializer, type, listId, stream, meta, version, }: ",
               "ImportListItemsToStreamOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; } | null>"
+              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
             "deprecated": false,
@@ -1653,7 +1653,7 @@
             "signature": [
               "({ listId, value, type, }: ",
               "GetListItemByValueOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]>"
+              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]>"
             ],
             "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
             "deprecated": false,
@@ -1685,7 +1685,7 @@
             "signature": [
               "({ id, deserializer, serializer, listId, value, type, meta, }: ",
               "CreateListItemOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; } | null>"
+              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
             "deprecated": false,
@@ -1717,7 +1717,7 @@
             "signature": [
               "({ _version, id, value, meta, }: ",
               "UpdateListItemOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; } | null>"
+              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
             "deprecated": false,
@@ -1749,7 +1749,7 @@
             "signature": [
               "({ _version, id, name, description, meta, version, }: ",
               "UpdateListOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; } | null>"
+              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
             "deprecated": false,
@@ -1781,7 +1781,7 @@
             "signature": [
               "({ id }: ",
               "GetListItemOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; } | null>"
+              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
             "deprecated": false,
@@ -1813,7 +1813,7 @@
             "signature": [
               "({ type, listId, value, }: ",
               "GetListItemsByValueOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]>"
+              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]>"
             ],
             "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
             "deprecated": false,
@@ -1845,7 +1845,7 @@
             "signature": [
               "({ type, listId, value, }: ",
               "SearchListItemByValuesOptions",
-              ") => Promise<{ items: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]; value: unknown; }[]>"
+              ") => Promise<{ items: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]; value: unknown; }[]>"
             ],
             "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
             "deprecated": false,
@@ -1877,7 +1877,7 @@
             "signature": [
               "({ filter, currentIndexPosition, perPage, page, sortField, sortOrder, searchAfter, }: ",
               "FindListOptions",
-              ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }>"
+              ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }>"
             ],
             "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
             "deprecated": false,
@@ -1909,7 +1909,7 @@
             "signature": [
               "({ listId, filter, currentIndexPosition, perPage, page, sortField, sortOrder, searchAfter, }: ",
               "FindListItemOptions",
-              ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]; page: number; per_page: number; total: number; } | null>"
+              ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]; page: number; per_page: number; total: number; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
             "deprecated": false,
@@ -1968,7 +1968,7 @@
             "label": "entries",
             "description": [],
             "signature": [
-              "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]"
+              "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
             "deprecated": false
@@ -2182,7 +2182,7 @@
             "label": "entries",
             "description": [],
             "signature": [
-              "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]"
+              "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip_range\" | \"date_range\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"ip\" | \"long\" | \"double\" | \"text\" | \"date_nanos\" | \"shape\" | \"short\" | \"binary\" | \"float\" | \"half_float\" | \"integer\" | \"byte\" | \"long_range\" | \"integer_range\" | \"float_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
             "deprecated": false
@@ -2337,7 +2337,7 @@
               "section": "def-server.SavedObjectsClient",
               "text": "SavedObjectsClient"
             },
-            ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, user: string) => ",
+            ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, user: string) => ",
             {
               "pluginId": "lists",
               "scope": "server",
@@ -2358,25 +2358,7 @@
               "label": "savedObjectsClient",
               "description": [],
               "signature": [
-                "{ get: <T = unknown>(type: string, id: string, options?: ",
-                {
-                  "pluginId": "core",
-                  "scope": "server",
-                  "docId": "kibCoreSavedObjectsPluginApi",
-                  "section": "def-server.SavedObjectsBaseOptions",
-                  "text": "SavedObjectsBaseOptions"
-                },
-                ") => Promise<",
-                "SavedObject",
-                "<T>>; delete: (type: string, id: string, options?: ",
-                {
-                  "pluginId": "core",
-                  "scope": "server",
-                  "docId": "kibCoreSavedObjectsPluginApi",
-                  "section": "def-server.SavedObjectsDeleteOptions",
-                  "text": "SavedObjectsDeleteOptions"
-                },
-                ") => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: ",
+                "{ create: <T = unknown>(type: string, attributes: T, options?: ",
                 {
                   "pluginId": "core",
                   "scope": "server",
@@ -2434,7 +2416,15 @@
                   "section": "def-server.SavedObjectsCheckConflictsResponse",
                   "text": "SavedObjectsCheckConflictsResponse"
                 },
-                ">; find: <T = unknown, A = unknown>(options: ",
+                ">; delete: (type: string, id: string, options?: ",
+                {
+                  "pluginId": "core",
+                  "scope": "server",
+                  "docId": "kibCoreSavedObjectsPluginApi",
+                  "section": "def-server.SavedObjectsDeleteOptions",
+                  "text": "SavedObjectsDeleteOptions"
+                },
+                ") => Promise<{}>; find: <T = unknown, A = unknown>(options: ",
                 {
                   "pluginId": "core",
                   "scope": "server",
@@ -2498,6 +2488,16 @@
                   "section": "def-server.SavedObjectsBulkResolveResponse",
                   "text": "SavedObjectsBulkResolveResponse"
                 },
+                "<T>>; get: <T = unknown>(type: string, id: string, options?: ",
+                {
+                  "pluginId": "core",
+                  "scope": "server",
+                  "docId": "kibCoreSavedObjectsPluginApi",
+                  "section": "def-server.SavedObjectsBaseOptions",
+                  "text": "SavedObjectsBaseOptions"
+                },
+                ") => Promise<",
+                "SavedObject",
                 "<T>>; resolve: <T = unknown>(type: string, id: string, options?: ",
                 {
                   "pluginId": "core",
@@ -2738,7 +2738,7 @@
               "signature": [
                 "Pick<",
                 "KibanaClient",
-                ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
+                ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
                 "TransportRequestParams",
                 ", options?: ",
                 "TransportRequestOptions",
diff --git a/api_docs/maps_ems.json b/api_docs/maps_ems.json
index 7d2d8d9eefddca..dd5f8d905952d0 100644
--- a/api_docs/maps_ems.json
+++ b/api_docs/maps_ems.json
@@ -908,7 +908,7 @@
         "label": "DEFAULT_EMS_LANDING_PAGE_URL",
         "description": [],
         "signature": [
-          "\"https://maps.elastic.co/v7.15\""
+          "\"https://maps.elastic.co/v7.16\""
         ],
         "path": "src/plugins/maps_ems/common/index.ts",
         "deprecated": false,
diff --git a/api_docs/metrics_entities.json b/api_docs/metrics_entities.json
index 6b7d685b469397..601c41a2822571 100644
--- a/api_docs/metrics_entities.json
+++ b/api_docs/metrics_entities.json
@@ -58,7 +58,7 @@
               "signature": [
                 "Pick<",
                 "KibanaClient",
-                ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
+                ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
                 "TransportRequestParams",
                 ", options?: ",
                 "TransportRequestOptions",
diff --git a/api_docs/ml.json b/api_docs/ml.json
index 102e433e4600ee..d5f9d552690c15 100644
--- a/api_docs/ml.json
+++ b/api_docs/ml.json
@@ -1055,7 +1055,7 @@
               },
               "<",
               "MlAnomalyDetectionAlertParams",
-              ">, \"enabled\" | \"id\" | \"name\" | \"tags\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">[] | undefined"
+              ">, \"id\" | \"name\" | \"tags\" | \"enabled\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">[] | undefined"
             ],
             "path": "x-pack/plugins/ml/common/types/anomaly_detection_jobs/summary_job.ts",
             "deprecated": false
@@ -2890,7 +2890,7 @@
               },
               "<",
               "MlAnomalyDetectionAlertParams",
-              ">, \"enabled\" | \"id\" | \"name\" | \"tags\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">[] | undefined"
+              ">, \"id\" | \"name\" | \"tags\" | \"enabled\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">[] | undefined"
             ],
             "path": "x-pack/plugins/ml/common/types/anomaly_detection_jobs/summary_job.ts",
             "deprecated": false
@@ -3434,7 +3434,7 @@
           "section": "def-server.SavedObjectsClient",
           "text": "SavedObjectsClient"
         },
-        ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, request: ",
+        ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, request: ",
         {
           "pluginId": "core",
           "scope": "server",
diff --git a/api_docs/monitoring.json b/api_docs/monitoring.json
index ddeba9737dc2d9..0de686a2108ebd 100644
--- a/api_docs/monitoring.json
+++ b/api_docs/monitoring.json
@@ -149,7 +149,7 @@
         "signature": [
           "{ ui: { elasticsearch: ",
           "MonitoringElasticsearchConfig",
-          "; enabled: boolean; container: Readonly<{} & { logstash: Readonly<{} & { enabled: boolean; }>; apm: Readonly<{} & { enabled: boolean; }>; elasticsearch: Readonly<{} & { enabled: boolean; }>; }>; logs: Readonly<{} & { index: string; }>; metricbeat: Readonly<{} & { index: string; }>; debug_mode: boolean; debug_log_path: string; ccs: Readonly<{} & { enabled: boolean; }>; max_bucket_size: number; min_interval_seconds: number; show_license_expiration: boolean; render_react_app: boolean; }; enabled: boolean; kibana: Readonly<{} & { collection: Readonly<{} & { enabled: boolean; interval: number; }>; }>; licensing: Readonly<{} & { api_polling_frequency: moment.Duration; }>; agent: Readonly<{} & { interval: string; }>; cluster_alerts: Readonly<{} & { enabled: boolean; allowedSpaces: string[]; email_notifications: Readonly<{} & { enabled: boolean; email_address: string; }>; }>; tests: Readonly<{} & { cloud_detector: Readonly<{} & { enabled: boolean; }>; }>; }"
+          "; enabled: boolean; container: Readonly<{} & { logstash: Readonly<{} & { enabled: boolean; }>; apm: Readonly<{} & { enabled: boolean; }>; elasticsearch: Readonly<{} & { enabled: boolean; }>; }>; logs: Readonly<{} & { index: string; }>; metricbeat: Readonly<{} & { index: string; }>; debug_mode: boolean; debug_log_path: string; ccs: Readonly<{} & { enabled: boolean; }>; max_bucket_size: number; min_interval_seconds: number; show_license_expiration: boolean; render_react_app: boolean; }; tests: Readonly<{} & { cloud_detector: Readonly<{} & { enabled: boolean; }>; }>; enabled: boolean; kibana: Readonly<{} & { collection: Readonly<{} & { interval: number; enabled: boolean; }>; }>; licensing: Readonly<{} & { api_polling_frequency: moment.Duration; }>; agent: Readonly<{} & { interval: string; }>; cluster_alerts: Readonly<{} & { enabled: boolean; allowedSpaces: string[]; email_notifications: Readonly<{} & { enabled: boolean; email_address: string; }>; }>; }"
         ],
         "path": "x-pack/plugins/monitoring/server/config.ts",
         "deprecated": false,
diff --git a/api_docs/observability.json b/api_docs/observability.json
index aa66c500c05e5b..3889631a20bec5 100644
--- a/api_docs/observability.json
+++ b/api_docs/observability.json
@@ -438,7 +438,7 @@
         "label": "LazyAlertsFlyout",
         "description": [],
         "signature": [
-          "React.ExoticComponent<Pick<AlertsFlyoutProps, \"children\" | \"type\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"key\" | \"id\" | \"title\" | \"security\" | \"size\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"paddingSize\" | \"data-test-subj\" | \"alert\" | \"onClose\" | \"css\" | \"as\" | \"ownFocus\" | \"alerts\" | \"maxWidth\" | \"hideCloseButton\" | \"closeButtonAriaLabel\" | \"closeButtonProps\" | \"closeButtonPosition\" | \"maskProps\" | \"outsideClickCloses\" | \"side\" | \"pushMinBreakpoint\" | \"isInApp\" | \"observabilityRuleTypeRegistry\" | \"selectedAlertId\"> & { ref?: React.RefObject<HTMLDivElement> | ((instance: HTMLDivElement | null) => void) | null | undefined; }> & { readonly _result: ({ alert, alerts, isInApp, observabilityRuleTypeRegistry, onClose, selectedAlertId, }: AlertsFlyoutProps) => JSX.Element | null; }"
+          "React.ExoticComponent<Pick<AlertsFlyoutProps, \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"key\" | \"type\" | \"id\" | \"title\" | \"security\" | \"size\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"paddingSize\" | \"data-test-subj\" | \"alert\" | \"onClose\" | \"css\" | \"as\" | \"ownFocus\" | \"alerts\" | \"maxWidth\" | \"hideCloseButton\" | \"closeButtonAriaLabel\" | \"closeButtonProps\" | \"closeButtonPosition\" | \"maskProps\" | \"outsideClickCloses\" | \"side\" | \"pushMinBreakpoint\" | \"isInApp\" | \"observabilityRuleTypeRegistry\" | \"selectedAlertId\"> & { ref?: React.RefObject<HTMLDivElement> | ((instance: HTMLDivElement | null) => void) | null | undefined; }> & { readonly _result: ({ alert, alerts, isInApp, observabilityRuleTypeRegistry, onClose, selectedAlertId, }: AlertsFlyoutProps) => JSX.Element | null; }"
         ],
         "path": "x-pack/plugins/observability/public/index.ts",
         "deprecated": false,
@@ -1029,7 +1029,7 @@
         "label": "useUiTracker",
         "description": [],
         "signature": [
-          "({\n  app: defaultApp,\n}: { app?: \"fleet\" | \"apm\" | \"infra_metrics\" | \"infra_logs\" | \"uptime\" | \"synthetics\" | \"observability-overview\" | \"stack_monitoring\" | \"ux\" | undefined; }) => ({ app, metric, metricType }: ",
+          "({\n  app: defaultApp,\n}: { app?: \"fleet\" | \"apm\" | \"synthetics\" | \"infra_metrics\" | \"infra_logs\" | \"uptime\" | \"observability-overview\" | \"stack_monitoring\" | \"ux\" | undefined; }) => ({ app, metric, metricType }: ",
           {
             "pluginId": "observability",
             "scope": "public",
@@ -1060,7 +1060,7 @@
                 "label": "app",
                 "description": [],
                 "signature": [
-                  "\"fleet\" | \"apm\" | \"infra_metrics\" | \"infra_logs\" | \"uptime\" | \"synthetics\" | \"observability-overview\" | \"stack_monitoring\" | \"ux\" | undefined"
+                  "\"fleet\" | \"apm\" | \"synthetics\" | \"infra_metrics\" | \"infra_logs\" | \"uptime\" | \"observability-overview\" | \"stack_monitoring\" | \"ux\" | undefined"
                 ],
                 "path": "x-pack/plugins/observability/public/hooks/use_track_metric.tsx",
                 "deprecated": false
@@ -2517,7 +2517,7 @@
             "label": "operationType",
             "description": [],
             "signature": [
-              "\"range\" | \"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"math\" | \"overall_sum\" | \"overall_min\" | \"overall_max\" | \"overall_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\" | \"formula\" | \"static_value\" | undefined"
+              "\"filters\" | \"max\" | \"min\" | \"count\" | \"date_histogram\" | \"sum\" | \"average\" | \"percentile\" | \"range\" | \"terms\" | \"median\" | \"cumulative_sum\" | \"moving_average\" | \"math\" | \"overall_sum\" | \"overall_min\" | \"overall_max\" | \"overall_average\" | \"counter_rate\" | \"differences\" | \"unique_count\" | \"last_value\" | \"formula\" | \"static_value\" | undefined"
             ],
             "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/types.ts",
             "deprecated": false
@@ -2530,7 +2530,7 @@
             "label": "dataType",
             "description": [],
             "signature": [
-              "\"mobile\" | \"apm\" | \"infra_metrics\" | \"infra_logs\" | \"synthetics\" | \"ux\""
+              "\"mobile\" | \"apm\" | \"synthetics\" | \"infra_metrics\" | \"infra_logs\" | \"ux\""
             ],
             "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/types.ts",
             "deprecated": false
@@ -3233,7 +3233,7 @@
         "label": "ObservabilityFetchDataPlugins",
         "description": [],
         "signature": [
-          "\"apm\" | \"infra_metrics\" | \"infra_logs\" | \"synthetics\" | \"ux\""
+          "\"apm\" | \"synthetics\" | \"infra_metrics\" | \"infra_logs\" | \"ux\""
         ],
         "path": "x-pack/plugins/observability/public/typings/fetch_overview_data/index.ts",
         "deprecated": false,
@@ -3316,27 +3316,27 @@
           "DisambiguateSet",
           "<(",
           "DisambiguateSet",
-          "<React.ButtonHTMLAttributes<HTMLButtonElement>, Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"type\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">> & Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"type\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">) | (",
+          "<React.ButtonHTMLAttributes<HTMLButtonElement>, Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"type\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">> & Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"type\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">) | (",
           "DisambiguateSet",
-          "<Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"type\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">, React.ButtonHTMLAttributes<HTMLButtonElement>> & React.ButtonHTMLAttributes<HTMLButtonElement>), React.HTMLAttributes<HTMLSpanElement>> & React.HTMLAttributes<HTMLSpanElement>) | (",
+          "<Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"type\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">, React.ButtonHTMLAttributes<HTMLButtonElement>> & React.ButtonHTMLAttributes<HTMLButtonElement>), React.HTMLAttributes<HTMLSpanElement>> & React.HTMLAttributes<HTMLSpanElement>) | (",
           "DisambiguateSet",
           "<React.HTMLAttributes<HTMLSpanElement>, (",
           "DisambiguateSet",
-          "<React.ButtonHTMLAttributes<HTMLButtonElement>, Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"type\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">> & Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"type\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">) | (",
+          "<React.ButtonHTMLAttributes<HTMLButtonElement>, Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"type\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">> & Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"type\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">) | (",
           "DisambiguateSet",
-          "<Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"type\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">, React.ButtonHTMLAttributes<HTMLButtonElement>> & React.ButtonHTMLAttributes<HTMLButtonElement>)> & ",
+          "<Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"type\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">, React.ButtonHTMLAttributes<HTMLButtonElement>> & React.ButtonHTMLAttributes<HTMLButtonElement>)> & ",
           "DisambiguateSet",
-          "<React.ButtonHTMLAttributes<HTMLButtonElement>, Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"type\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">> & Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"type\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">) | (",
+          "<React.ButtonHTMLAttributes<HTMLButtonElement>, Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"type\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">> & Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"type\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">) | (",
           "DisambiguateSet",
           "<React.HTMLAttributes<HTMLSpanElement>, (",
           "DisambiguateSet",
-          "<React.ButtonHTMLAttributes<HTMLButtonElement>, Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"type\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">> & Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"type\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">) | (",
+          "<React.ButtonHTMLAttributes<HTMLButtonElement>, Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"type\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">> & Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"type\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">) | (",
           "DisambiguateSet",
-          "<Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"type\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">, React.ButtonHTMLAttributes<HTMLButtonElement>> & React.ButtonHTMLAttributes<HTMLButtonElement>)> & ",
+          "<Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"type\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">, React.ButtonHTMLAttributes<HTMLButtonElement>> & React.ButtonHTMLAttributes<HTMLButtonElement>)> & ",
           "DisambiguateSet",
-          "<Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"type\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">, React.ButtonHTMLAttributes<HTMLButtonElement>> & React.ButtonHTMLAttributes<HTMLButtonElement>), \"children\" | \"type\" | \"onChange\" | \"onKeyDown\" | \"id\" | \"title\" | \"security\" | \"name\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"autoFocus\" | \"disabled\" | \"form\" | \"formAction\" | \"formEncType\" | \"formMethod\" | \"formNoValidate\" | \"formTarget\" | \"value\" | \"media\" | \"download\" | \"ping\" | \"hrefLang\" | \"referrerPolicy\"> & { size?: \"m\" | \"s\" | \"l\" | \"xs\" | undefined; color?: \"text\" | \"primary\" | \"inherit\" | \"ghost\" | \"subdued\" | undefined; label: React.ReactNode; isActive?: boolean | undefined; isDisabled?: boolean | undefined; href?: string | undefined; target?: string | undefined; rel?: string | undefined; iconType?: string | React.ComponentClass<{}, any> | React.FunctionComponent<{}> | undefined; iconProps?: Pick<",
+          "<Pick<React.AnchorHTMLAttributes<HTMLAnchorElement>, \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"type\" | \"id\" | \"title\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"media\" | \"target\" | \"download\" | \"ping\" | \"hrefLang\" | \"rel\" | \"referrerPolicy\">, React.ButtonHTMLAttributes<HTMLButtonElement>> & React.ButtonHTMLAttributes<HTMLButtonElement>), \"children\" | \"onChange\" | \"onKeyDown\" | \"type\" | \"id\" | \"title\" | \"security\" | \"name\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"autoFocus\" | \"disabled\" | \"form\" | \"formAction\" | \"formEncType\" | \"formMethod\" | \"formNoValidate\" | \"formTarget\" | \"value\" | \"media\" | \"download\" | \"ping\" | \"hrefLang\" | \"referrerPolicy\"> & { size?: \"m\" | \"s\" | \"l\" | \"xs\" | undefined; color?: \"text\" | \"primary\" | \"inherit\" | \"ghost\" | \"subdued\" | undefined; label: React.ReactNode; isActive?: boolean | undefined; isDisabled?: boolean | undefined; href?: string | undefined; target?: string | undefined; rel?: string | undefined; iconType?: string | React.ComponentClass<{}, any> | React.FunctionComponent<{}> | undefined; iconProps?: Pick<",
           "EuiIconProps",
-          ", \"string\" | \"children\" | \"from\" | \"origin\" | \"cursor\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"y\" | \"d\" | \"x\" | \"id\" | \"title\" | \"operator\" | \"name\" | \"version\" | \"filter\" | \"size\" | \"format\" | \"order\" | \"className\" | \"lang\" | \"style\" | \"tabIndex\" | \"role\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"data-test-subj\" | \"height\" | \"max\" | \"media\" | \"method\" | \"min\" | \"target\" | \"width\" | \"crossOrigin\" | \"accentHeight\" | \"accumulate\" | \"additive\" | \"alignmentBaseline\" | \"allowReorder\" | \"alphabetic\" | \"amplitude\" | \"arabicForm\" | \"ascent\" | \"attributeName\" | \"attributeType\" | \"autoReverse\" | \"azimuth\" | \"baseFrequency\" | \"baselineShift\" | \"baseProfile\" | \"bbox\" | \"begin\" | \"bias\" | \"by\" | \"calcMode\" | \"capHeight\" | \"clip\" | \"clipPath\" | \"clipPathUnits\" | \"clipRule\" | \"colorInterpolation\" | \"colorInterpolationFilters\" | \"colorProfile\" | \"colorRendering\" | \"contentScriptType\" | \"contentStyleType\" | \"cx\" | \"cy\" | \"decelerate\" | \"descent\" | \"diffuseConstant\" | \"direction\" | \"display\" | \"divisor\" | \"dominantBaseline\" | \"dur\" | \"dx\" | \"dy\" | \"edgeMode\" | \"elevation\" | \"enableBackground\" | \"end\" | \"exponent\" | \"externalResourcesRequired\" | \"fill\" | \"fillOpacity\" | \"fillRule\" | \"filterRes\" | \"filterUnits\" | \"floodColor\" | \"floodOpacity\" | \"focusable\" | \"fontFamily\" | \"fontSize\" | \"fontSizeAdjust\" | \"fontStretch\" | \"fontStyle\" | \"fontVariant\" | \"fontWeight\" | \"fx\" | \"fy\" | \"g1\" | \"g2\" | \"glyphName\" | \"glyphOrientationHorizontal\" | \"glyphOrientationVertical\" | \"glyphRef\" | \"gradientTransform\" | \"gradientUnits\" | \"hanging\" | \"horizAdvX\" | \"horizOriginX\" | \"href\" | \"ideographic\" | \"imageRendering\" | \"in2\" | \"in\" | \"intercept\" | \"k1\" | \"k2\" | \"k3\" | \"k4\" | \"k\" | \"kernelMatrix\" | \"kernelUnitLength\" | \"kerning\" | \"keyPoints\" | \"keySplines\" | \"keyTimes\" | \"lengthAdjust\" | \"letterSpacing\" | \"lightingColor\" | \"limitingConeAngle\" | \"local\" | \"markerEnd\" | \"markerHeight\" | \"markerMid\" | \"markerStart\" | \"markerUnits\" | \"markerWidth\" | \"mask\" | \"maskContentUnits\" | \"maskUnits\" | \"mathematical\" | \"mode\" | \"numOctaves\" | \"offset\" | \"opacity\" | \"orient\" | \"orientation\" | \"overflow\" | \"overlinePosition\" | \"overlineThickness\" | \"paintOrder\" | \"panose1\" | \"path\" | \"pathLength\" | \"patternContentUnits\" | \"patternTransform\" | \"patternUnits\" | \"pointerEvents\" | \"points\" | \"pointsAtX\" | \"pointsAtY\" | \"pointsAtZ\" | \"preserveAlpha\" | \"preserveAspectRatio\" | \"primitiveUnits\" | \"r\" | \"radius\" | \"refX\" | \"refY\" | \"renderingIntent\" | \"repeatCount\" | \"repeatDur\" | \"requiredExtensions\" | \"requiredFeatures\" | \"restart\" | \"result\" | \"rotate\" | \"rx\" | \"ry\" | \"scale\" | \"seed\" | \"shapeRendering\" | \"slope\" | \"spacing\" | \"specularConstant\" | \"specularExponent\" | \"speed\" | \"spreadMethod\" | \"startOffset\" | \"stdDeviation\" | \"stemh\" | \"stemv\" | \"stitchTiles\" | \"stopColor\" | \"stopOpacity\" | \"strikethroughPosition\" | \"strikethroughThickness\" | \"stroke\" | \"strokeDasharray\" | \"strokeDashoffset\" | \"strokeLinecap\" | \"strokeLinejoin\" | \"strokeMiterlimit\" | \"strokeOpacity\" | \"strokeWidth\" | \"surfaceScale\" | \"systemLanguage\" | \"tableValues\" | \"targetX\" | \"targetY\" | \"textAnchor\" | \"textDecoration\" | \"textLength\" | \"textRendering\" | \"to\" | \"transform\" | \"u1\" | \"u2\" | \"underlinePosition\" | \"underlineThickness\" | \"unicode\" | \"unicodeBidi\" | \"unicodeRange\" | \"unitsPerEm\" | \"vAlphabetic\" | \"values\" | \"vectorEffect\" | \"vertAdvY\" | \"vertOriginX\" | \"vertOriginY\" | \"vHanging\" | \"vIdeographic\" | \"viewBox\" | \"viewTarget\" | \"visibility\" | \"vMathematical\" | \"widths\" | \"wordSpacing\" | \"writingMode\" | \"x1\" | \"x2\" | \"xChannelSelector\" | \"xHeight\" | \"xlinkActuate\" | \"xlinkArcrole\" | \"xlinkHref\" | \"xlinkRole\" | \"xlinkShow\" | \"xlinkTitle\" | \"xlinkType\" | \"xmlBase\" | \"xmlLang\" | \"xmlns\" | \"xmlnsXlink\" | \"xmlSpace\" | \"y1\" | \"y2\" | \"yChannelSelector\" | \"z\" | \"zoomAndPan\" | \"titleId\" | \"onIconLoad\"> | undefined; icon?: React.ReactElement<any, string | ((props: any) => React.ReactElement<any, string | any | (new (props: any) => React.Component<any, any, any>)> | null) | (new (props: any) => React.Component<any, any, any>)> | undefined; showToolTip?: boolean | undefined; extraAction?: ({ type?: \"reset\" | \"button\" | \"submit\" | undefined; } & ",
+          ", \"string\" | \"children\" | \"cursor\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"y\" | \"d\" | \"x\" | \"id\" | \"title\" | \"operator\" | \"name\" | \"version\" | \"filter\" | \"from\" | \"size\" | \"format\" | \"order\" | \"className\" | \"lang\" | \"style\" | \"tabIndex\" | \"role\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"data-test-subj\" | \"height\" | \"max\" | \"media\" | \"method\" | \"min\" | \"target\" | \"width\" | \"crossOrigin\" | \"accentHeight\" | \"accumulate\" | \"additive\" | \"alignmentBaseline\" | \"allowReorder\" | \"alphabetic\" | \"amplitude\" | \"arabicForm\" | \"ascent\" | \"attributeName\" | \"attributeType\" | \"autoReverse\" | \"azimuth\" | \"baseFrequency\" | \"baselineShift\" | \"baseProfile\" | \"bbox\" | \"begin\" | \"bias\" | \"by\" | \"calcMode\" | \"capHeight\" | \"clip\" | \"clipPath\" | \"clipPathUnits\" | \"clipRule\" | \"colorInterpolation\" | \"colorInterpolationFilters\" | \"colorProfile\" | \"colorRendering\" | \"contentScriptType\" | \"contentStyleType\" | \"cx\" | \"cy\" | \"decelerate\" | \"descent\" | \"diffuseConstant\" | \"direction\" | \"display\" | \"divisor\" | \"dominantBaseline\" | \"dur\" | \"dx\" | \"dy\" | \"edgeMode\" | \"elevation\" | \"enableBackground\" | \"end\" | \"exponent\" | \"externalResourcesRequired\" | \"fill\" | \"fillOpacity\" | \"fillRule\" | \"filterRes\" | \"filterUnits\" | \"floodColor\" | \"floodOpacity\" | \"focusable\" | \"fontFamily\" | \"fontSize\" | \"fontSizeAdjust\" | \"fontStretch\" | \"fontStyle\" | \"fontVariant\" | \"fontWeight\" | \"fx\" | \"fy\" | \"g1\" | \"g2\" | \"glyphName\" | \"glyphOrientationHorizontal\" | \"glyphOrientationVertical\" | \"glyphRef\" | \"gradientTransform\" | \"gradientUnits\" | \"hanging\" | \"horizAdvX\" | \"horizOriginX\" | \"href\" | \"ideographic\" | \"imageRendering\" | \"in2\" | \"in\" | \"intercept\" | \"k1\" | \"k2\" | \"k3\" | \"k4\" | \"k\" | \"kernelMatrix\" | \"kernelUnitLength\" | \"kerning\" | \"keyPoints\" | \"keySplines\" | \"keyTimes\" | \"lengthAdjust\" | \"letterSpacing\" | \"lightingColor\" | \"limitingConeAngle\" | \"local\" | \"markerEnd\" | \"markerHeight\" | \"markerMid\" | \"markerStart\" | \"markerUnits\" | \"markerWidth\" | \"mask\" | \"maskContentUnits\" | \"maskUnits\" | \"mathematical\" | \"mode\" | \"numOctaves\" | \"offset\" | \"opacity\" | \"orient\" | \"orientation\" | \"origin\" | \"overflow\" | \"overlinePosition\" | \"overlineThickness\" | \"paintOrder\" | \"panose1\" | \"path\" | \"pathLength\" | \"patternContentUnits\" | \"patternTransform\" | \"patternUnits\" | \"pointerEvents\" | \"points\" | \"pointsAtX\" | \"pointsAtY\" | \"pointsAtZ\" | \"preserveAlpha\" | \"preserveAspectRatio\" | \"primitiveUnits\" | \"r\" | \"radius\" | \"refX\" | \"refY\" | \"renderingIntent\" | \"repeatCount\" | \"repeatDur\" | \"requiredExtensions\" | \"requiredFeatures\" | \"restart\" | \"result\" | \"rotate\" | \"rx\" | \"ry\" | \"scale\" | \"seed\" | \"shapeRendering\" | \"slope\" | \"spacing\" | \"specularConstant\" | \"specularExponent\" | \"speed\" | \"spreadMethod\" | \"startOffset\" | \"stdDeviation\" | \"stemh\" | \"stemv\" | \"stitchTiles\" | \"stopColor\" | \"stopOpacity\" | \"strikethroughPosition\" | \"strikethroughThickness\" | \"stroke\" | \"strokeDasharray\" | \"strokeDashoffset\" | \"strokeLinecap\" | \"strokeLinejoin\" | \"strokeMiterlimit\" | \"strokeOpacity\" | \"strokeWidth\" | \"surfaceScale\" | \"systemLanguage\" | \"tableValues\" | \"targetX\" | \"targetY\" | \"textAnchor\" | \"textDecoration\" | \"textLength\" | \"textRendering\" | \"to\" | \"transform\" | \"u1\" | \"u2\" | \"underlinePosition\" | \"underlineThickness\" | \"unicode\" | \"unicodeBidi\" | \"unicodeRange\" | \"unitsPerEm\" | \"vAlphabetic\" | \"values\" | \"vectorEffect\" | \"vertAdvY\" | \"vertOriginX\" | \"vertOriginY\" | \"vHanging\" | \"vIdeographic\" | \"viewBox\" | \"viewTarget\" | \"visibility\" | \"vMathematical\" | \"widths\" | \"wordSpacing\" | \"writingMode\" | \"x1\" | \"x2\" | \"xChannelSelector\" | \"xHeight\" | \"xlinkActuate\" | \"xlinkArcrole\" | \"xlinkHref\" | \"xlinkRole\" | \"xlinkShow\" | \"xlinkTitle\" | \"xlinkType\" | \"xmlBase\" | \"xmlLang\" | \"xmlns\" | \"xmlnsXlink\" | \"xmlSpace\" | \"y1\" | \"y2\" | \"yChannelSelector\" | \"z\" | \"zoomAndPan\" | \"titleId\" | \"onIconLoad\"> | undefined; icon?: React.ReactElement<any, string | ((props: any) => React.ReactElement<any, string | any | (new (props: any) => React.Component<any, any, any>)> | null) | (new (props: any) => React.Component<any, any, any>)> | undefined; showToolTip?: boolean | undefined; extraAction?: ({ type?: \"reset\" | \"button\" | \"submit\" | undefined; } & ",
           "EuiButtonIconProps",
           " & { onClick?: ((event: React.MouseEvent<HTMLButtonElement, MouseEvent>) => void) | undefined; } & React.ButtonHTMLAttributes<HTMLButtonElement> & { buttonRef?: ((instance: HTMLButtonElement | null) => void) | React.RefObject<HTMLButtonElement> | null | undefined; } & { alwaysShow?: boolean | undefined; }) | undefined; onClick?: ((event: React.MouseEvent<HTMLButtonElement, MouseEvent>) => void) | undefined; wrapText?: boolean | undefined; buttonRef?: ((instance: HTMLButtonElement | null) => void) | React.RefObject<HTMLButtonElement> | null | undefined; }"
         ],
@@ -3420,7 +3420,7 @@
       "label": "ObservabilityPublicSetup",
       "description": [],
       "signature": [
-        "{ dashboard: { register: <T extends \"apm\" | \"infra_metrics\" | \"infra_logs\" | \"synthetics\" | \"ux\">({ appName, fetchData, hasData, }: { appName: T; } & ",
+        "{ dashboard: { register: <T extends \"apm\" | \"synthetics\" | \"infra_metrics\" | \"infra_logs\" | \"ux\">({ appName, fetchData, hasData, }: { appName: T; } & ",
         {
           "pluginId": "observability",
           "scope": "public",
@@ -3683,7 +3683,7 @@
                 "signature": [
                   "Pick<",
                   "KibanaClient",
-                  ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
+                  ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
                   "TransportRequestParams",
                   ", options?: ",
                   "TransportRequestOptions",
diff --git a/api_docs/plugin_directory.mdx b/api_docs/plugin_directory.mdx
index 6380831a8c6c37..19e3bc08a53615 100644
--- a/api_docs/plugin_directory.mdx
+++ b/api_docs/plugin_directory.mdx
@@ -12,13 +12,13 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 
 | Count | Plugins or Packages with a <br /> public API | Number of teams | 
 |--------------|----------|------------------------|
-| 202 | 158 | 32 |
+| 200 | 157 | 32 |
 
 ### Public API health stats
 
 | API Count | Any Count | Missing comments | Missing exports | 
 |--------------|----------|-----------------|--------|
-| 24409 | 277 | 19821 | 1585 |
+| 24459 | 276 | 19826 | 1583 |
 
 ## Plugin Directory
 
@@ -26,27 +26,26 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 |--------------|----------------|-----------|--------------|----------|---------------|--------|
 | <DocLink id="kibActionsPluginApi" text="actions"/> | [Kibana Alerting](https://github.com/orgs/elastic/teams/kibana-alerting-services) | - | 125 | 0 | 125 | 8 |
 | <DocLink id="kibAdvancedSettingsPluginApi" text="advancedSettings"/> | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-vis-editors) | - | 23 | 0 | 22 | 1 |
-| <DocLink id="kibAlertingPluginApi" text="alerting"/> | [Kibana Alerting](https://github.com/orgs/elastic/teams/kibana-alerting-services) | - | 249 | 0 | 241 | 17 |
-| <DocLink id="kibApmPluginApi" text="apm"/> | [APM UI](https://github.com/orgs/elastic/teams/apm-ui) | The user interface for Elastic APM | 42 | 0 | 42 | 37 |
-| <DocLink id="kibApmOssPluginApi" text="apmOss"/> | [APM UI](https://github.com/orgs/elastic/teams/apm-ui) | - | 6 | 0 | 6 | 0 |
+| <DocLink id="kibAlertingPluginApi" text="alerting"/> | [Kibana Alerting](https://github.com/orgs/elastic/teams/kibana-alerting-services) | - | 257 | 0 | 249 | 17 |
+| <DocLink id="kibApmPluginApi" text="apm"/> | [APM UI](https://github.com/orgs/elastic/teams/apm-ui) | The user interface for Elastic APM | 39 | 0 | 39 | 37 |
 | <DocLink id="kibBannersPluginApi" text="banners"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 9 | 0 | 9 | 0 |
-| <DocLink id="kibBfetchPluginApi" text="bfetch"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Considering using bfetch capabilities when fetching large amounts of data. This services supports batching HTTP requests and streaming responses back. | 77 | 1 | 66 | 2 |
+| <DocLink id="kibBfetchPluginApi" text="bfetch"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Considering using bfetch capabilities when fetching large amounts of data. This services supports batching HTTP requests and streaming responses back. | 76 | 1 | 67 | 2 |
 | <DocLink id="kibCanvasPluginApi" text="canvas"/> | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds Canvas application to Kibana | 9 | 0 | 8 | 3 |
-| <DocLink id="kibCasesPluginApi" text="cases"/> | [Security Solution Threat Hunting](https://github.com/orgs/elastic/teams/security-threat-hunting) | The Case management system in Kibana | 475 | 0 | 431 | 14 |
+| <DocLink id="kibCasesPluginApi" text="cases"/> | [Security Solution Threat Hunting](https://github.com/orgs/elastic/teams/security-threat-hunting) | The Case management system in Kibana | 476 | 0 | 432 | 14 |
 | <DocLink id="kibChartsPluginApi" text="charts"/> | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-vis-editors) | - | 285 | 4 | 253 | 3 |
 | <DocLink id="kibCloudPluginApi" text="cloud"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 22 | 0 | 22 | 0 |
 | <DocLink id="kibConsolePluginApi" text="console"/> | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 9 | 0 | 9 | 1 |
-| <DocLink id="kibCorePluginApi" text="core"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 2300 | 27 | 1019 | 29 |
+| <DocLink id="kibCorePluginApi" text="core"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 2298 | 27 | 1018 | 29 |
 | crossClusterReplication | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 0 | 0 | 0 | 0 |
-| <DocLink id="kibCustomIntegrationsPluginApi" text="customIntegrations"/> | [Fleet](https://github.com/orgs/elastic/teams/fleet) | Add custom data integrations so they can be displayed in the Fleet integrations app | 85 | 1 | 78 | 1 |
+| <DocLink id="kibCustomIntegrationsPluginApi" text="customIntegrations"/> | [Fleet](https://github.com/orgs/elastic/teams/fleet) | Add custom data integrations so they can be displayed in the Fleet integrations app | 91 | 1 | 75 | 1 |
 | <DocLink id="kibDashboardPluginApi" text="dashboard"/> | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds the Dashboard app to Kibana | 145 | 1 | 132 | 10 |
 | <DocLink id="kibDashboardEnhancedPluginApi" text="dashboardEnhanced"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | - | 51 | 0 | 50 | 0 |
-| <DocLink id="kibDataPluginApi" text="data"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Data services are useful for searching and querying data from Elasticsearch. Helpful utilities include: a re-usable react query bar, KQL autocomplete, async search, Data Views (Index Patterns) and field formatters. | 3192 | 43 | 2807 | 48 |
+| <DocLink id="kibDataPluginApi" text="data"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Data services are useful for searching and querying data from Elasticsearch. Helpful utilities include: a re-usable react query bar, KQL autocomplete, async search, Data Views (Index Patterns) and field formatters. | 3193 | 43 | 2807 | 48 |
 | <DocLink id="kibDataEnhancedPluginApi" text="dataEnhanced"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Enhanced data plugin. (See src/plugins/data.) Enhances the main data plugin with a search session management UI. Includes a reusable search session indicator component to use in other applications. Exposes routes for managing search sessions. Includes a service that monitors, updates, and cleans up search session saved objects. | 16 | 0 | 16 | 2 |
-| <DocLink id="kibDataViewsPluginApi" text="dataViews"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Data services are useful for searching and querying data from Elasticsearch. Helpful utilities include: a re-usable react query bar, KQL autocomplete, async search, Data Views (Index Patterns) and field formatters. | 681 | 6 | 541 | 5 |
+| <DocLink id="kibDataViewsPluginApi" text="dataViews"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Data services are useful for searching and querying data from Elasticsearch. Helpful utilities include: a re-usable react query bar, KQL autocomplete, async search, Data Views (Index Patterns) and field formatters. | 683 | 6 | 541 | 5 |
 | <DocLink id="kibDataVisualizerPluginApi" text="dataVisualizer"/> | [Machine Learning UI](https://github.com/orgs/elastic/teams/ml-ui) | The Data Visualizer tools help you understand your data, by analyzing the metrics and fields in a log file or an existing Elasticsearch index. | 80 | 5 | 80 | 0 |
 | <DocLink id="kibDevToolsPluginApi" text="devTools"/> | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 10 | 0 | 8 | 2 |
-| <DocLink id="kibDiscoverPluginApi" text="discover"/> | [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | This plugin contains the Discover application and the saved search embeddable. | 82 | 0 | 56 | 6 |
+| <DocLink id="kibDiscoverPluginApi" text="discover"/> | [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | This plugin contains the Discover application and the saved search embeddable. | 103 | 0 | 77 | 7 |
 | <DocLink id="kibDiscoverEnhancedPluginApi" text="discoverEnhanced"/> | [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | - | 37 | 0 | 35 | 2 |
 | <DocLink id="kibEmbeddablePluginApi" text="embeddable"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Adds embeddables service to Kibana | 469 | 5 | 393 | 3 |
 | <DocLink id="kibEmbeddableEnhancedPluginApi" text="embeddableEnhanced"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Extends embeddable plugin with more functionality | 14 | 0 | 14 | 0 |
@@ -62,11 +61,11 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 | <DocLink id="kibExpressionRevealImagePluginApi" text="expressionRevealImage"/> | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds 'revealImage' function and renderer to expressions | 12 | 0 | 12 | 3 |
 | <DocLink id="kibExpressionShapePluginApi" text="expressionShape"/> | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds 'shape' function and renderer to expressions | 143 | 0 | 143 | 0 |
 | <DocLink id="kibExpressionTagcloudPluginApi" text="expressionTagcloud"/> | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-vis-editors) | Expression Tagcloud plugin adds a `tagcloud` renderer and function to the expression plugin. The renderer will display the `Wordcloud` chart. | 5 | 0 | 5 | 0 |
-| <DocLink id="kibExpressionsPluginApi" text="expressions"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Adds expression runtime to Kibana | 2095 | 27 | 1646 | 4 |
+| <DocLink id="kibExpressionsPluginApi" text="expressions"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Adds expression runtime to Kibana | 2086 | 27 | 1640 | 4 |
 | <DocLink id="kibFeaturesPluginApi" text="features"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 216 | 0 | 98 | 2 |
 | <DocLink id="kibFieldFormatsPluginApi" text="fieldFormats"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Index pattern fields and ambiguous values formatters | 288 | 7 | 250 | 3 |
 | <DocLink id="kibFileUploadPluginApi" text="fileUpload"/> | [Machine Learning UI](https://github.com/orgs/elastic/teams/ml-ui) | The file upload plugin contains components and services for uploading a file, analyzing its data, and then importing the data into an Elasticsearch index. Supported file types include CSV, TSV, newline-delimited JSON and GeoJSON. | 129 | 4 | 129 | 1 |
-| <DocLink id="kibFleetPluginApi" text="fleet"/> | [Fleet](https://github.com/orgs/elastic/teams/fleet) | - | 1207 | 15 | 1107 | 10 |
+| <DocLink id="kibFleetPluginApi" text="fleet"/> | [Fleet](https://github.com/orgs/elastic/teams/fleet) | - | 1210 | 15 | 1110 | 10 |
 | <DocLink id="kibGlobalSearchPluginApi" text="globalSearch"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 68 | 0 | 14 | 5 |
 | globalSearchBar | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 0 | 0 | 0 | 0 |
 | globalSearchProviders | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 0 | 0 | 0 | 0 |
@@ -105,11 +104,11 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 | <DocLink id="kibObservabilityPluginApi" text="observability"/> | [Observability UI](https://github.com/orgs/elastic/teams/observability-ui) | - | 258 | 1 | 257 | 12 |
 | <DocLink id="kibOsqueryPluginApi" text="osquery"/> | [Security asset management](https://github.com/orgs/elastic/teams/security-asset-management) | - | 11 | 0 | 11 | 0 |
 | painlessLab | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 0 | 0 | 0 | 0 |
-| <DocLink id="kibPresentationUtilPluginApi" text="presentationUtil"/> | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | The Presentation Utility Plugin is a set of common, shared components and toolkits for solutions within the Presentation space, (e.g. Dashboards, Canvas). | 178 | 3 | 151 | 5 |
+| <DocLink id="kibPresentationUtilPluginApi" text="presentationUtil"/> | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | The Presentation Utility Plugin is a set of common, shared components and toolkits for solutions within the Presentation space, (e.g. Dashboards, Canvas). | 178 | 3 | 151 | 6 |
 | <DocLink id="kibRemoteClustersPluginApi" text="remoteClusters"/> | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 4 | 0 | 4 | 0 |
 | <DocLink id="kibReportingPluginApi" text="reporting"/> | [Kibana Reporting Services](https://github.com/orgs/elastic/teams/kibana-reporting-services) | Reporting Services enables applications to feature reports that the user can automate with Watcher and download later. | 135 | 0 | 134 | 12 |
 | <DocLink id="kibRollupPluginApi" text="rollup"/> | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 20 | 0 | 20 | 0 |
-| <DocLink id="kibRuleRegistryPluginApi" text="ruleRegistry"/> | [RAC](https://github.com/orgs/elastic/teams/rac) | - | 132 | 0 | 109 | 7 |
+| <DocLink id="kibRuleRegistryPluginApi" text="ruleRegistry"/> | [RAC](https://github.com/orgs/elastic/teams/rac) | - | 136 | 0 | 113 | 7 |
 | <DocLink id="kibRuntimeFieldsPluginApi" text="runtimeFields"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | - | 24 | 0 | 19 | 2 |
 | <DocLink id="kibSavedObjectsPluginApi" text="savedObjects"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 221 | 3 | 207 | 4 |
 | <DocLink id="kibSavedObjectsManagementPluginApi" text="savedObjectsManagement"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 103 | 0 | 90 | 0 |
@@ -131,7 +130,7 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 | <DocLink id="kibTimelinesPluginApi" text="timelines"/> | [Security solution](https://github.com/orgs/elastic/teams/security-solution) | - | 968 | 6 | 847 | 25 |
 | <DocLink id="kibTransformPluginApi" text="transform"/> | [Machine Learning UI](https://github.com/orgs/elastic/teams/ml-ui) | This plugin provides access to the transforms features provided by Elastic. Transforms enable you to convert existing Elasticsearch indices into summarized indices, which provide opportunities for new insights and analytics. | 4 | 0 | 4 | 1 |
 | translations | [Kibana Localization](https://github.com/orgs/elastic/teams/kibana-localization) | - | 0 | 0 | 0 | 0 |
-| <DocLink id="kibTriggersActionsUiPluginApi" text="triggersActionsUi"/> | [Kibana Alerting](https://github.com/orgs/elastic/teams/kibana-alerting-services) | - | 239 | 1 | 230 | 18 |
+| <DocLink id="kibTriggersActionsUiPluginApi" text="triggersActionsUi"/> | [Kibana Alerting](https://github.com/orgs/elastic/teams/kibana-alerting-services) | - | 238 | 1 | 229 | 18 |
 | <DocLink id="kibUiActionsPluginApi" text="uiActions"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Adds UI Actions service to Kibana | 127 | 0 | 88 | 11 |
 | <DocLink id="kibUiActionsEnhancedPluginApi" text="uiActionsEnhanced"/> | [Kibana App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Extends UI Actions plugin with more functionality | 203 | 2 | 145 | 9 |
 | upgradeAssistant | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 0 | 0 | 0 | 0 |
@@ -158,7 +157,7 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 
 | Package name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  | Maintaining team | Description | API Cnt | Any Cnt | Missing<br />comments | Missing<br />exports | 
 |--------------|----------------|-----------|--------------|----------|---------------|--------|
-| <DocLink id="kibElasticApmGeneratorPluginApi" text="@elastic/apm-generator"/> | [Owner missing] | Elastic APM trace data generator | 15 | 0 | 15 | 2 |
+| <DocLink id="kibElasticApmGeneratorPluginApi" text="@elastic/apm-generator"/> | [Owner missing] | Elastic APM trace data generator | 17 | 0 | 17 | 2 |
 | <DocLink id="kibElasticDatemathPluginApi" text="@elastic/datemath"/> | [Owner missing] | elasticsearch datemath parser, used in kibana | 44 | 0 | 43 | 0 |
 | <DocLink id="kibKbnAcePluginApi" text="@kbn/ace"/> | [Owner missing] | - | 11 | 5 | 11 | 0 |
 | <DocLink id="kibKbnAlertsPluginApi" text="@kbn/alerts"/> | [Owner missing] | Alerts components and hooks | 9 | 1 | 9 | 0 |
@@ -169,7 +168,7 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 | <DocLink id="kibKbnConfigPluginApi" text="@kbn/config"/> | [Owner missing] | - | 66 | 0 | 46 | 1 |
 | <DocLink id="kibKbnConfigSchemaPluginApi" text="@kbn/config-schema"/> | [Owner missing] | - | 109 | 3 | 107 | 18 |
 | <DocLink id="kibKbnCryptoPluginApi" text="@kbn/crypto"/> | [Owner missing] | - | 13 | 0 | 7 | 0 |
-| <DocLink id="kibKbnDevUtilsPluginApi" text="@kbn/dev-utils"/> | [Owner missing] | - | 258 | 7 | 231 | 4 |
+| <DocLink id="kibKbnDevUtilsPluginApi" text="@kbn/dev-utils"/> | [Owner missing] | - | 280 | 6 | 214 | 0 |
 | <DocLink id="kibKbnDocsUtilsPluginApi" text="@kbn/docs-utils"/> | [Owner missing] | - | 1 | 0 | 1 | 0 |
 | <DocLink id="kibKbnEsArchiverPluginApi" text="@kbn/es-archiver"/> | [Owner missing] | - | 25 | 0 | 12 | 1 |
 | <DocLink id="kibKbnEsQueryPluginApi" text="@kbn/es-query"/> | [Owner missing] | - | 205 | 2 | 153 | 14 |
@@ -196,7 +195,7 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 | <DocLink id="kibKbnSecuritysolutionListHooksPluginApi" text="@kbn/securitysolution-list-hooks"/> | [Owner missing] | Security solution list ReactJS hooks | 56 | 0 | 44 | 0 |
 | <DocLink id="kibKbnSecuritysolutionListUtilsPluginApi" text="@kbn/securitysolution-list-utils"/> | [Owner missing] | security solution list utilities | 222 | 0 | 177 | 0 |
 | <DocLink id="kibKbnSecuritysolutionTGridPluginApi" text="@kbn/securitysolution-t-grid"/> | [Owner missing] | security solution t-grid packages will allow sharing components between timelines and security_solution plugin until we transfer all functionality to timelines plugin | 120 | 0 | 116 | 0 |
-| <DocLink id="kibKbnSecuritysolutionUtilsPluginApi" text="@kbn/securitysolution-utils"/> | [Owner missing] | security solution utilities to use across plugins such lists, security_solution, cases, etc... | 4 | 0 | 2 | 0 |
+| <DocLink id="kibKbnSecuritysolutionUtilsPluginApi" text="@kbn/securitysolution-utils"/> | [Owner missing] | security solution utilities to use across plugins such lists, security_solution, cases, etc... | 6 | 0 | 4 | 0 |
 | <DocLink id="kibKbnServerHttpToolsPluginApi" text="@kbn/server-http-tools"/> | [Owner missing] | - | 53 | 0 | 50 | 1 |
 | <DocLink id="kibKbnServerRouteRepositoryPluginApi" text="@kbn/server-route-repository"/> | [Owner missing] | - | 28 | 0 | 27 | 1 |
 | <DocLink id="kibKbnStdPluginApi" text="@kbn/std"/> | [Owner missing] | - | 96 | 1 | 63 | 2 |
diff --git a/api_docs/presentation_util.json b/api_docs/presentation_util.json
index ecec195628cf62..50a4540b3af409 100644
--- a/api_docs/presentation_util.json
+++ b/api_docs/presentation_util.json
@@ -1238,7 +1238,7 @@
         "label": "SolutionToolbarPopover",
         "description": [],
         "signature": [
-          "({ label, iconType, primary, iconSide, ...popover }: ",
+          "({ label, iconType, primary, iconSide, children, ...popover }: ",
           "Props",
           ") => JSX.Element"
         ],
@@ -1250,7 +1250,7 @@
             "id": "def-public.SolutionToolbarPopover.$1",
             "type": "CompoundType",
             "tags": [],
-            "label": "{\n  label,\n  iconType,\n  primary,\n  iconSide,\n  ...popover\n}",
+            "label": "{\n  label,\n  iconType,\n  primary,\n  iconSide,\n  children,\n  ...popover\n}",
             "description": [],
             "signature": [
               "Props"
@@ -1870,19 +1870,6 @@
             "deprecated": false,
             "children": [],
             "returnComment": []
-          },
-          {
-            "parentPluginId": "presentationUtil",
-            "id": "def-public.QuickButtonProps.isDarkModeEnabled",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "isDarkModeEnabled",
-            "description": [],
-            "signature": [
-              "boolean | undefined"
-            ],
-            "path": "src/plugins/presentation_util/public/components/solution_toolbar/items/quick_group.tsx",
-            "deprecated": false
           }
         ],
         "initialIsOpen": false
@@ -2402,6 +2389,19 @@
           ],
           "path": "src/plugins/presentation_util/public/types.ts",
           "deprecated": false
+        },
+        {
+          "parentPluginId": "presentationUtil",
+          "id": "def-public.PresentationUtilPluginStart.controlsService",
+          "type": "Object",
+          "tags": [],
+          "label": "controlsService",
+          "description": [],
+          "signature": [
+            "PresentationControlsService"
+          ],
+          "path": "src/plugins/presentation_util/public/types.ts",
+          "deprecated": false
         }
       ],
       "lifecycle": "start",
diff --git a/api_docs/presentation_util.mdx b/api_docs/presentation_util.mdx
index 4c31547582b174..9ff91703a09166 100644
--- a/api_docs/presentation_util.mdx
+++ b/api_docs/presentation_util.mdx
@@ -18,7 +18,7 @@ Contact [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-prese
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 178 | 3 | 151 | 5 |
+| 178 | 3 | 151 | 6 |
 
 ## Client
 
diff --git a/api_docs/reporting.json b/api_docs/reporting.json
index 8843a7ed21b923..4296dfad34b3f2 100644
--- a/api_docs/reporting.json
+++ b/api_docs/reporting.json
@@ -925,7 +925,7 @@
                     "section": "def-server.PluginInitializerContext",
                     "text": "PluginInitializerContext"
                   },
-                  "<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { browser: Readonly<{} & { type: string; chromium: Readonly<{ inspect?: boolean | undefined; disableSandbox?: boolean | undefined; } & { proxy: Readonly<{ server?: string | undefined; bypass?: string[] | undefined; } & { enabled: boolean; }>; }>; autoDownload: boolean; }>; zoom: number; timeouts: Readonly<{} & { openUrl: number | moment.Duration; waitForElements: number | moment.Duration; renderComplete: number | moment.Duration; }>; networkPolicy: Readonly<{} & { enabled: boolean; rules: Readonly<{ host?: string | undefined; protocol?: string | undefined; } & { allow: boolean; }>[]; }>; viewport: Readonly<{} & { height: number; width: number; }>; loadDelay: number | moment.Duration; maxAttempts: number; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; kibanaServer: Readonly<{ hostname?: string | undefined; port?: number | undefined; protocol?: string | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { size: number; duration: string; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+                  "<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { browser: Readonly<{} & { type: string; chromium: Readonly<{ inspect?: boolean | undefined; disableSandbox?: boolean | undefined; } & { proxy: Readonly<{ server?: string | undefined; bypass?: string[] | undefined; } & { enabled: boolean; }>; }>; autoDownload: boolean; }>; zoom: number; timeouts: Readonly<{} & { openUrl: number | moment.Duration; waitForElements: number | moment.Duration; renderComplete: number | moment.Duration; }>; networkPolicy: Readonly<{} & { enabled: boolean; rules: Readonly<{ host?: string | undefined; protocol?: string | undefined; } & { allow: boolean; }>[]; }>; loadDelay: number | moment.Duration; maxAttempts: number; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; kibanaServer: Readonly<{ hostname?: string | undefined; port?: number | undefined; protocol?: string | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { size: number; duration: string; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
                   {
                     "pluginId": "@kbn/config-schema",
                     "scope": "server",
@@ -1323,7 +1323,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => Promise<",
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => Promise<",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -1352,7 +1352,7 @@
                     "section": "def-server.SavedObjectsClient",
                     "text": "SavedObjectsClient"
                   },
-                  ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+                  ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
                 ],
                 "path": "x-pack/plugins/reporting/server/core.ts",
                 "deprecated": false,
@@ -1771,7 +1771,7 @@
                     "section": "def-server.PluginInitializerContext",
                     "text": "PluginInitializerContext"
                   },
-                  "<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { browser: Readonly<{} & { type: string; chromium: Readonly<{ inspect?: boolean | undefined; disableSandbox?: boolean | undefined; } & { proxy: Readonly<{ server?: string | undefined; bypass?: string[] | undefined; } & { enabled: boolean; }>; }>; autoDownload: boolean; }>; zoom: number; timeouts: Readonly<{} & { openUrl: number | moment.Duration; waitForElements: number | moment.Duration; renderComplete: number | moment.Duration; }>; networkPolicy: Readonly<{} & { enabled: boolean; rules: Readonly<{ host?: string | undefined; protocol?: string | undefined; } & { allow: boolean; }>[]; }>; viewport: Readonly<{} & { height: number; width: number; }>; loadDelay: number | moment.Duration; maxAttempts: number; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; kibanaServer: Readonly<{ hostname?: string | undefined; port?: number | undefined; protocol?: string | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { size: number; duration: string; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+                  "<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { browser: Readonly<{} & { type: string; chromium: Readonly<{ inspect?: boolean | undefined; disableSandbox?: boolean | undefined; } & { proxy: Readonly<{ server?: string | undefined; bypass?: string[] | undefined; } & { enabled: boolean; }>; }>; autoDownload: boolean; }>; zoom: number; timeouts: Readonly<{} & { openUrl: number | moment.Duration; waitForElements: number | moment.Duration; renderComplete: number | moment.Duration; }>; networkPolicy: Readonly<{} & { enabled: boolean; rules: Readonly<{ host?: string | undefined; protocol?: string | undefined; } & { allow: boolean; }>[]; }>; loadDelay: number | moment.Duration; maxAttempts: number; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; kibanaServer: Readonly<{ hostname?: string | undefined; port?: number | undefined; protocol?: string | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { size: number; duration: string; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
                   {
                     "pluginId": "@kbn/config-schema",
                     "scope": "server",
@@ -1968,7 +1968,7 @@
             "section": "def-server.ReportingConfig",
             "text": "ReportingConfig"
           },
-          " extends Config<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { browser: Readonly<{} & { type: string; chromium: Readonly<{ inspect?: boolean | undefined; disableSandbox?: boolean | undefined; } & { proxy: Readonly<{ server?: string | undefined; bypass?: string[] | undefined; } & { enabled: boolean; }>; }>; autoDownload: boolean; }>; zoom: number; timeouts: Readonly<{} & { openUrl: number | moment.Duration; waitForElements: number | moment.Duration; renderComplete: number | moment.Duration; }>; networkPolicy: Readonly<{} & { enabled: boolean; rules: Readonly<{ host?: string | undefined; protocol?: string | undefined; } & { allow: boolean; }>[]; }>; viewport: Readonly<{} & { height: number; width: number; }>; loadDelay: number | moment.Duration; maxAttempts: number; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; kibanaServer: Readonly<{ hostname?: string | undefined; port?: number | undefined; protocol?: string | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { size: number; duration: string; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+          " extends Config<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { browser: Readonly<{} & { type: string; chromium: Readonly<{ inspect?: boolean | undefined; disableSandbox?: boolean | undefined; } & { proxy: Readonly<{ server?: string | undefined; bypass?: string[] | undefined; } & { enabled: boolean; }>; }>; autoDownload: boolean; }>; zoom: number; timeouts: Readonly<{} & { openUrl: number | moment.Duration; waitForElements: number | moment.Duration; renderComplete: number | moment.Duration; }>; networkPolicy: Readonly<{} & { enabled: boolean; rules: Readonly<{ host?: string | undefined; protocol?: string | undefined; } & { allow: boolean; }>[]; }>; loadDelay: number | moment.Duration; maxAttempts: number; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; kibanaServer: Readonly<{ hostname?: string | undefined; port?: number | undefined; protocol?: string | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { size: number; duration: string; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
           {
             "pluginId": "@kbn/config-schema",
             "scope": "server",
@@ -2187,7 +2187,7 @@
               "TaskScheduling",
               ", \"schedule\" | \"runNow\" | \"ephemeralRunNow\" | \"ensureScheduled\"> & Pick<",
               "TaskStore",
-              ", \"remove\" | \"get\" | \"fetch\"> & { removeIfExists: (id: string) => Promise<void>; } & { supportsEphemeralTasks: () => boolean; }"
+              ", \"remove\" | \"fetch\" | \"get\"> & { removeIfExists: (id: string) => Promise<void>; } & { supportsEphemeralTasks: () => boolean; }"
             ],
             "path": "x-pack/plugins/reporting/server/types.ts",
             "deprecated": false
diff --git a/api_docs/rule_registry.json b/api_docs/rule_registry.json
index 2d9e79f727c0e7..89c359461c72f5 100644
--- a/api_docs/rule_registry.json
+++ b/api_docs/rule_registry.json
@@ -878,6 +878,87 @@
           }
         ],
         "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "ruleRegistry",
+        "id": "def-server.RuleDataWriterInitializationError",
+        "type": "Class",
+        "tags": [],
+        "label": "RuleDataWriterInitializationError",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "ruleRegistry",
+            "scope": "server",
+            "docId": "kibRuleRegistryPluginApi",
+            "section": "def-server.RuleDataWriterInitializationError",
+            "text": "RuleDataWriterInitializationError"
+          },
+          " extends Error"
+        ],
+        "path": "x-pack/plugins/rule_registry/server/rule_data_plugin_service/errors.ts",
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "ruleRegistry",
+            "id": "def-server.RuleDataWriterInitializationError.Unnamed",
+            "type": "Function",
+            "tags": [],
+            "label": "Constructor",
+            "description": [],
+            "signature": [
+              "any"
+            ],
+            "path": "x-pack/plugins/rule_registry/server/rule_data_plugin_service/errors.ts",
+            "deprecated": false,
+            "children": [
+              {
+                "parentPluginId": "ruleRegistry",
+                "id": "def-server.RuleDataWriterInitializationError.Unnamed.$1",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "resourceType",
+                "description": [],
+                "signature": [
+                  "\"index\" | \"namespace\""
+                ],
+                "path": "x-pack/plugins/rule_registry/server/rule_data_plugin_service/errors.ts",
+                "deprecated": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "ruleRegistry",
+                "id": "def-server.RuleDataWriterInitializationError.Unnamed.$2",
+                "type": "string",
+                "tags": [],
+                "label": "registrationContext",
+                "description": [],
+                "signature": [
+                  "string"
+                ],
+                "path": "x-pack/plugins/rule_registry/server/rule_data_plugin_service/errors.ts",
+                "deprecated": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "ruleRegistry",
+                "id": "def-server.RuleDataWriterInitializationError.Unnamed.$3",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "error",
+                "description": [],
+                "signature": [
+                  "string | Error"
+                ],
+                "path": "x-pack/plugins/rule_registry/server/rule_data_plugin_service/errors.ts",
+                "deprecated": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          }
+        ],
+        "initialIsOpen": false
       }
     ],
     "functions": [
@@ -1085,10 +1166,10 @@
       },
       {
         "parentPluginId": "ruleRegistry",
-        "id": "def-server.createPersistenceRuleTypeFactory",
+        "id": "def-server.createPersistenceRuleTypeWrapper",
         "type": "Function",
         "tags": [],
-        "label": "createPersistenceRuleTypeFactory",
+        "label": "createPersistenceRuleTypeWrapper",
         "description": [],
         "signature": [
           "({ logger, ruleDataClient }: { ruleDataClient: ",
@@ -1107,23 +1188,15 @@
             "section": "def-server.Logger",
             "text": "Logger"
           },
-          "; }) => <TState extends Record<string, unknown>, TParams extends Record<string, unknown>, TServices extends ",
+          "; }) => <TParams extends Record<string, unknown>, TState extends Record<string, unknown>, TInstanceContext extends { [x: string]: unknown; } = {}, TActionGroupIds extends string = never>(type: ",
           {
             "pluginId": "ruleRegistry",
             "scope": "server",
             "docId": "kibRuleRegistryPluginApi",
-            "section": "def-server.PersistenceServices",
-            "text": "PersistenceServices"
+            "section": "def-server.PersistenceAlertType",
+            "text": "PersistenceAlertType"
           },
-          "<TAlertInstanceContext>, TAlertInstanceContext extends { [x: string]: unknown; } = {}>(type: ",
-          {
-            "pluginId": "ruleRegistry",
-            "scope": "server",
-            "docId": "kibRuleRegistryPluginApi",
-            "section": "def-server.AlertTypeWithExecutor",
-            "text": "AlertTypeWithExecutor"
-          },
-          "<TState, TParams, TAlertInstanceContext, TServices>) => { executor: (options: ",
+          "<TParams, TState, TInstanceContext, TActionGroupIds>) => { executor: (options: ",
           {
             "pluginId": "alerting",
             "scope": "server",
@@ -1131,7 +1204,15 @@
             "section": "def-server.AlertExecutorOptions",
             "text": "AlertExecutorOptions"
           },
-          "<TParams, TState, { [x: string]: unknown; }, TAlertInstanceContext, never> & { services: TServices; }) => Promise<void | TState>; id: string; name: string; validate?: { params?: ",
+          "<TParams, TState, { [x: string]: unknown; }, TInstanceContext, ",
+          {
+            "pluginId": "alerting",
+            "scope": "common",
+            "docId": "kibAlertingPluginApi",
+            "section": "def-common.WithoutReservedActionGroups",
+            "text": "WithoutReservedActionGroups"
+          },
+          "<TActionGroupIds, never>>) => Promise<void | TState>; id: string; name: string; validate?: { params?: ",
           "AlertTypeParamsValidator",
           "<TParams> | undefined; } | undefined; actionGroups: ",
           {
@@ -1141,7 +1222,7 @@
             "section": "def-common.ActionGroup",
             "text": "ActionGroup"
           },
-          "<string>[]; defaultActionGroupId: string; recoveryActionGroup?: ",
+          "<TActionGroupIds>[]; defaultActionGroupId: TActionGroupIds; recoveryActionGroup?: ",
           {
             "pluginId": "alerting",
             "scope": "common",
@@ -1149,7 +1230,7 @@
             "section": "def-common.ActionGroup",
             "text": "ActionGroup"
           },
-          "<string> | undefined; producer: string; actionVariables?: { context?: ",
+          "<never> | undefined; producer: string; actionVariables?: { context?: ",
           {
             "pluginId": "alerting",
             "scope": "common",
@@ -1183,14 +1264,14 @@
           },
           "<TParams>; injectReferences: (params: TParams, references: ",
           "SavedObjectReference",
-          "[]) => TParams; } | undefined; isExportable: boolean; ruleTaskTimeout?: string | undefined; }"
+          "[]) => TParams; } | undefined; isExportable: boolean; defaultScheduleInterval?: string | undefined; minimumScheduleInterval?: string | undefined; ruleTaskTimeout?: string | undefined; }"
         ],
-        "path": "x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_factory.ts",
+        "path": "x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_wrapper.ts",
         "deprecated": false,
         "children": [
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-server.createPersistenceRuleTypeFactory.$1",
+            "id": "def-server.createPersistenceRuleTypeWrapper.$1",
             "type": "Object",
             "tags": [],
             "label": "{ logger, ruleDataClient }",
@@ -1214,7 +1295,7 @@
               },
               "; }"
             ],
-            "path": "x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_factory.ts",
+            "path": "x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_wrapper.ts",
             "deprecated": false,
             "isRequired": true
           }
@@ -1725,7 +1806,7 @@
               "ApiResponse",
               "<",
               "BulkResponse",
-              ", unknown>>"
+              ", unknown> | undefined>"
             ],
             "path": "x-pack/plugins/rule_registry/server/rule_data_client/types.ts",
             "deprecated": false,
@@ -1812,16 +1893,6 @@
         "tags": [],
         "label": "PersistenceServices",
         "description": [],
-        "signature": [
-          {
-            "pluginId": "ruleRegistry",
-            "scope": "server",
-            "docId": "kibRuleRegistryPluginApi",
-            "section": "def-server.PersistenceServices",
-            "text": "PersistenceServices"
-          },
-          "<TAlertInstanceContext>"
-        ],
         "path": "x-pack/plugins/rule_registry/server/utils/persistence_types.ts",
         "deprecated": false,
         "children": [
@@ -1839,7 +1910,7 @@
               "ApiResponse",
               "<",
               "BulkResponse",
-              ", unknown>>"
+              ", unknown> | undefined>"
             ],
             "path": "x-pack/plugins/rule_registry/server/utils/persistence_types.ts",
             "deprecated": false,
@@ -1945,7 +2016,7 @@
             "section": "def-server.AlertType",
             "text": "AlertType"
           },
-          "<TParams, TParams, TState, { [x: string]: unknown; }, TAlertInstanceContext, string, string>, \"id\" | \"name\" | \"validate\" | \"actionGroups\" | \"defaultActionGroupId\" | \"recoveryActionGroup\" | \"producer\" | \"actionVariables\" | \"minimumLicenseRequired\" | \"useSavedObjectReferences\" | \"isExportable\" | \"ruleTaskTimeout\"> & { executor: ",
+          "<TParams, TParams, TState, { [x: string]: unknown; }, TAlertInstanceContext, string, string>, \"id\" | \"name\" | \"validate\" | \"actionGroups\" | \"defaultActionGroupId\" | \"recoveryActionGroup\" | \"producer\" | \"actionVariables\" | \"minimumLicenseRequired\" | \"useSavedObjectReferences\" | \"isExportable\" | \"defaultScheduleInterval\" | \"minimumScheduleInterval\" | \"ruleTaskTimeout\"> & { executor: ",
           "AlertTypeExecutor",
           "<TState, TParams, TAlertInstanceContext, TServices>; }"
         ],
@@ -1955,10 +2026,10 @@
       },
       {
         "parentPluginId": "ruleRegistry",
-        "id": "def-server.CreatePersistenceRuleTypeFactory",
+        "id": "def-server.CreatePersistenceRuleTypeWrapper",
         "type": "Type",
         "tags": [],
-        "label": "CreatePersistenceRuleTypeFactory",
+        "label": "CreatePersistenceRuleTypeWrapper",
         "description": [],
         "signature": [
           "(options: { ruleDataClient: ",
@@ -1977,31 +2048,23 @@
             "section": "def-server.Logger",
             "text": "Logger"
           },
-          "; }) => <TState extends Record<string, unknown>, TParams extends Record<string, unknown>, TServices extends ",
-          {
-            "pluginId": "ruleRegistry",
-            "scope": "server",
-            "docId": "kibRuleRegistryPluginApi",
-            "section": "def-server.PersistenceServices",
-            "text": "PersistenceServices"
-          },
-          "<TAlertInstanceContext>, TAlertInstanceContext extends { [x: string]: unknown; } = {}>(type: ",
+          "; }) => <TParams extends Record<string, unknown>, TState extends Record<string, unknown>, TInstanceContext extends { [x: string]: unknown; } = {}, TActionGroupIds extends string = never>(type: ",
           {
             "pluginId": "ruleRegistry",
             "scope": "server",
             "docId": "kibRuleRegistryPluginApi",
-            "section": "def-server.AlertTypeWithExecutor",
-            "text": "AlertTypeWithExecutor"
+            "section": "def-server.PersistenceAlertType",
+            "text": "PersistenceAlertType"
           },
-          "<TState, TParams, TAlertInstanceContext, TServices>) => ",
+          "<TParams, TState, TInstanceContext, TActionGroupIds>) => ",
           {
-            "pluginId": "ruleRegistry",
+            "pluginId": "alerting",
             "scope": "server",
-            "docId": "kibRuleRegistryPluginApi",
-            "section": "def-server.AlertTypeWithExecutor",
-            "text": "AlertTypeWithExecutor"
+            "docId": "kibAlertingPluginApi",
+            "section": "def-server.AlertType",
+            "text": "AlertType"
           },
-          "<TState, TParams, TAlertInstanceContext, TServices>"
+          "<TParams, TParams, TState, { [x: string]: unknown; }, TInstanceContext, TActionGroupIds, never>"
         ],
         "path": "x-pack/plugins/rule_registry/server/utils/persistence_types.ts",
         "deprecated": false,
@@ -2009,7 +2072,7 @@
         "children": [
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-server.CreatePersistenceRuleTypeFactory.$1",
+            "id": "def-server.CreatePersistenceRuleTypeWrapper.$1",
             "type": "Object",
             "tags": [],
             "label": "options",
@@ -2209,38 +2272,6 @@
         "deprecated": false,
         "initialIsOpen": false
       },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-server.PersistenceAlertQueryService",
-        "type": "Type",
-        "tags": [],
-        "label": "PersistenceAlertQueryService",
-        "description": [],
-        "signature": [
-          "(query: ",
-          "SearchRequest",
-          ") => Promise<Record<string, unknown>[]>"
-        ],
-        "path": "x-pack/plugins/rule_registry/server/utils/persistence_types.ts",
-        "deprecated": false,
-        "returnComment": [],
-        "children": [
-          {
-            "parentPluginId": "ruleRegistry",
-            "id": "def-server.PersistenceAlertQueryService.$1",
-            "type": "Object",
-            "tags": [],
-            "label": "query",
-            "description": [],
-            "signature": [
-              "SearchRequest"
-            ],
-            "path": "x-pack/plugins/rule_registry/server/utils/persistence_types.ts",
-            "deprecated": false
-          }
-        ],
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "ruleRegistry",
         "id": "def-server.PersistenceAlertService",
@@ -2255,7 +2286,7 @@
           "ApiResponse",
           "<",
           "BulkResponse",
-          ", unknown>>"
+          ", unknown> | undefined>"
         ],
         "path": "x-pack/plugins/rule_registry/server/utils/persistence_types.ts",
         "deprecated": false,
@@ -2290,6 +2321,52 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "ruleRegistry",
+        "id": "def-server.PersistenceAlertType",
+        "type": "Type",
+        "tags": [],
+        "label": "PersistenceAlertType",
+        "description": [],
+        "signature": [
+          "Pick<",
+          {
+            "pluginId": "alerting",
+            "scope": "server",
+            "docId": "kibAlertingPluginApi",
+            "section": "def-server.AlertType",
+            "text": "AlertType"
+          },
+          "<TParams, TParams, TState, { [x: string]: unknown; }, TInstanceContext, TActionGroupIds, never>, \"id\" | \"name\" | \"validate\" | \"actionGroups\" | \"defaultActionGroupId\" | \"recoveryActionGroup\" | \"producer\" | \"actionVariables\" | \"minimumLicenseRequired\" | \"useSavedObjectReferences\" | \"isExportable\" | \"defaultScheduleInterval\" | \"minimumScheduleInterval\" | \"ruleTaskTimeout\"> & { executor: (options: ",
+          {
+            "pluginId": "alerting",
+            "scope": "server",
+            "docId": "kibAlertingPluginApi",
+            "section": "def-server.AlertExecutorOptions",
+            "text": "AlertExecutorOptions"
+          },
+          "<TParams, TState, { [x: string]: unknown; }, TInstanceContext, ",
+          {
+            "pluginId": "alerting",
+            "scope": "common",
+            "docId": "kibAlertingPluginApi",
+            "section": "def-common.WithoutReservedActionGroups",
+            "text": "WithoutReservedActionGroups"
+          },
+          "<TActionGroupIds, never>> & { services: ",
+          {
+            "pluginId": "ruleRegistry",
+            "scope": "server",
+            "docId": "kibRuleRegistryPluginApi",
+            "section": "def-server.PersistenceServices",
+            "text": "PersistenceServices"
+          },
+          "; }) => Promise<void | TState>; }"
+        ],
+        "path": "x-pack/plugins/rule_registry/server/utils/persistence_types.ts",
+        "deprecated": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "ruleRegistry",
         "id": "def-server.RuleRegistryPluginConfig",
diff --git a/api_docs/rule_registry.mdx b/api_docs/rule_registry.mdx
index 5bd8aeff7d1b28..7e05924fca263d 100644
--- a/api_docs/rule_registry.mdx
+++ b/api_docs/rule_registry.mdx
@@ -18,7 +18,7 @@ Contact [RAC](https://github.com/orgs/elastic/teams/rac) for questions regarding
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 132 | 0 | 109 | 7 |
+| 136 | 0 | 113 | 7 |
 
 ## Server
 
diff --git a/api_docs/runtime_fields.json b/api_docs/runtime_fields.json
index 83618b64aca360..e89ac786227789 100644
--- a/api_docs/runtime_fields.json
+++ b/api_docs/runtime_fields.json
@@ -330,7 +330,7 @@
             "label": "type",
             "description": [],
             "signature": [
-              "\"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"long\" | \"double\""
+              "\"boolean\" | \"keyword\" | \"date\" | \"ip\" | \"long\" | \"double\""
             ],
             "path": "x-pack/plugins/runtime_fields/public/types.ts",
             "deprecated": false
@@ -363,7 +363,7 @@
         "description": [],
         "signature": [
           "ComboBoxOption",
-          "<\"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"long\" | \"double\">[]"
+          "<\"boolean\" | \"keyword\" | \"date\" | \"ip\" | \"long\" | \"double\">[]"
         ],
         "path": "x-pack/plugins/runtime_fields/public/constants.ts",
         "deprecated": false,
@@ -377,7 +377,7 @@
         "label": "RuntimeType",
         "description": [],
         "signature": [
-          "\"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"long\" | \"double\""
+          "\"boolean\" | \"keyword\" | \"date\" | \"ip\" | \"long\" | \"double\""
         ],
         "path": "x-pack/plugins/runtime_fields/public/types.ts",
         "deprecated": false,
diff --git a/api_docs/saved_objects.json b/api_docs/saved_objects.json
index af63ad120a8c08..9cb53a0ada85b5 100644
--- a/api_docs/saved_objects.json
+++ b/api_docs/saved_objects.json
@@ -562,11 +562,11 @@
         "references": [
           {
             "plugin": "discover",
-            "path": "src/plugins/discover/public/saved_searches/saved_searches.ts"
+            "path": "src/plugins/discover/public/saved_searches/legacy/saved_searches.ts"
           },
           {
             "plugin": "discover",
-            "path": "src/plugins/discover/public/saved_searches/saved_searches.ts"
+            "path": "src/plugins/discover/public/saved_searches/legacy/saved_searches.ts"
           },
           {
             "plugin": "discover",
@@ -596,14 +596,6 @@
             "plugin": "visualizations",
             "path": "src/plugins/visualizations/public/saved_visualizations/saved_visualizations.ts"
           },
-          {
-            "plugin": "visualizations",
-            "path": "src/plugins/visualizations/public/services.ts"
-          },
-          {
-            "plugin": "visualizations",
-            "path": "src/plugins/visualizations/public/services.ts"
-          },
           {
             "plugin": "dashboard",
             "path": "src/plugins/dashboard/public/services/saved_objects.ts"
@@ -734,7 +726,7 @@
                     "section": "def-public.SavedObjectsClient",
                     "text": "SavedObjectsClient"
                   },
-                  ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"bulkUpdate\">"
+                  ", \"create\" | \"bulkCreate\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"bulkUpdate\">"
                 ],
                 "path": "src/plugins/saved_objects/public/saved_object/saved_object_loader.ts",
                 "deprecated": false,
@@ -1487,7 +1479,7 @@
             "section": "def-public.SavedObjectsClient",
             "text": "SavedObjectsClient"
           },
-          ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"bulkUpdate\">; overlays: ",
+          ", \"create\" | \"bulkCreate\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"bulkUpdate\">; overlays: ",
           {
             "pluginId": "core",
             "scope": "public",
@@ -1613,17 +1605,7 @@
                 "label": "savedObjectsClient",
                 "description": [],
                 "signature": [
-                  "{ get: <T = unknown>(type: string, id: string) => Promise<",
-                  {
-                    "pluginId": "core",
-                    "scope": "public",
-                    "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-public.SimpleSavedObject",
-                    "text": "SimpleSavedObject"
-                  },
-                  "<T>>; delete: (type: string, id: string, options?: ",
-                  "SavedObjectsDeleteOptions",
-                  " | undefined) => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: ",
+                  "{ create: <T = unknown>(type: string, attributes: T, options?: ",
                   {
                     "pluginId": "core",
                     "scope": "public",
@@ -1663,7 +1645,9 @@
                     "section": "def-public.SavedObjectsBatchResponse",
                     "text": "SavedObjectsBatchResponse"
                   },
-                  "<unknown>>; find: <T = unknown, A = unknown>(options: Pick<",
+                  "<unknown>>; delete: (type: string, id: string, options?: ",
+                  "SavedObjectsDeleteOptions",
+                  " | undefined) => Promise<{}>; find: <T = unknown, A = unknown>(options: Pick<",
                   {
                     "pluginId": "core",
                     "scope": "server",
@@ -1695,7 +1679,15 @@
                     "section": "def-public.ResolvedSimpleSavedObject",
                     "text": "ResolvedSimpleSavedObject"
                   },
-                  "<T>[]; }>; resolve: <T = unknown>(type: string, id: string) => Promise<",
+                  "<T>[]; }>; get: <T = unknown>(type: string, id: string) => Promise<",
+                  {
+                    "pluginId": "core",
+                    "scope": "public",
+                    "docId": "kibCoreSavedObjectsPluginApi",
+                    "section": "def-public.SimpleSavedObject",
+                    "text": "SimpleSavedObject"
+                  },
+                  "<T>>; resolve: <T = unknown>(type: string, id: string) => Promise<",
                   {
                     "pluginId": "core",
                     "scope": "public",
@@ -2094,29 +2086,17 @@
         "path": "src/plugins/saved_objects/public/types.ts",
         "deprecated": true,
         "references": [
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/main/discover_main_route.tsx"
-          },
           {
             "plugin": "savedObjectsTaggingOss",
             "path": "src/plugins/saved_objects_tagging_oss/public/api.ts"
           },
           {
             "plugin": "discover",
-            "path": "src/plugins/discover/public/saved_searches/_saved_search.ts"
+            "path": "src/plugins/discover/public/saved_searches/legacy/_saved_search.ts"
           },
           {
             "plugin": "discover",
-            "path": "src/plugins/discover/public/saved_searches/_saved_search.ts"
-          },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/main/discover_main_route.tsx"
-          },
-          {
-            "plugin": "discover",
-            "path": "src/plugins/discover/public/application/apps/main/discover_main_route.tsx"
+            "path": "src/plugins/discover/public/saved_searches/legacy/_saved_search.ts"
           },
           {
             "plugin": "visualizations",
@@ -2181,98 +2161,6 @@
           {
             "plugin": "dashboard",
             "path": "src/plugins/dashboard/public/application/actions/clone_panel_action.tsx"
-          },
-          {
-            "plugin": "visualize",
-            "path": "src/plugins/visualize/public/application/types.ts"
-          },
-          {
-            "plugin": "visualize",
-            "path": "src/plugins/visualize/public/application/types.ts"
-          },
-          {
-            "plugin": "visualize",
-            "path": "src/plugins/visualize/public/application/types.ts"
-          },
-          {
-            "plugin": "visualize",
-            "path": "src/plugins/visualize/public/application/types.ts"
-          },
-          {
-            "plugin": "visualize",
-            "path": "src/plugins/visualize/public/application/utils/get_visualization_instance.ts"
-          },
-          {
-            "plugin": "visualize",
-            "path": "src/plugins/visualize/public/application/utils/get_visualization_instance.ts"
-          },
-          {
-            "plugin": "visDefaultEditor",
-            "path": "src/plugins/vis_default_editor/public/components/sidebar/sidebar_title.tsx"
-          },
-          {
-            "plugin": "visDefaultEditor",
-            "path": "src/plugins/vis_default_editor/public/components/sidebar/sidebar_title.tsx"
-          },
-          {
-            "plugin": "visDefaultEditor",
-            "path": "src/plugins/vis_default_editor/public/components/sidebar/sidebar_title.tsx"
-          },
-          {
-            "plugin": "visDefaultEditor",
-            "path": "src/plugins/vis_default_editor/public/components/sidebar/sidebar.tsx"
-          },
-          {
-            "plugin": "visDefaultEditor",
-            "path": "src/plugins/vis_default_editor/public/components/sidebar/sidebar.tsx"
-          },
-          {
-            "plugin": "visualize",
-            "path": "src/plugins/visualize/target/types/public/application/types.d.ts"
-          },
-          {
-            "plugin": "visualize",
-            "path": "src/plugins/visualize/target/types/public/application/types.d.ts"
-          },
-          {
-            "plugin": "visualize",
-            "path": "src/plugins/visualize/target/types/public/application/types.d.ts"
-          },
-          {
-            "plugin": "visualize",
-            "path": "src/plugins/visualize/target/types/public/application/types.d.ts"
-          },
-          {
-            "plugin": "visDefaultEditor",
-            "path": "src/plugins/vis_default_editor/target/types/public/components/sidebar/sidebar.d.ts"
-          },
-          {
-            "plugin": "visDefaultEditor",
-            "path": "src/plugins/vis_default_editor/target/types/public/components/sidebar/sidebar.d.ts"
-          },
-          {
-            "plugin": "visDefaultEditor",
-            "path": "src/plugins/vis_default_editor/target/types/public/components/sidebar/sidebar_title.d.ts"
-          },
-          {
-            "plugin": "visDefaultEditor",
-            "path": "src/plugins/vis_default_editor/target/types/public/components/sidebar/sidebar_title.d.ts"
-          },
-          {
-            "plugin": "visDefaultEditor",
-            "path": "src/plugins/vis_default_editor/target/types/public/components/sidebar/sidebar_title.d.ts"
-          },
-          {
-            "plugin": "visualize",
-            "path": "src/plugins/visualize/target/types/public/application/utils/get_visualization_instance.d.ts"
-          },
-          {
-            "plugin": "visualize",
-            "path": "src/plugins/visualize/target/types/public/application/utils/get_visualization_instance.d.ts"
-          },
-          {
-            "plugin": "visualize",
-            "path": "src/plugins/visualize/target/types/public/application/utils/get_visualization_instance.d.ts"
           }
         ],
         "children": [
@@ -3819,7 +3707,7 @@
           "references": [
             {
               "plugin": "discover",
-              "path": "src/plugins/discover/public/saved_searches/_saved_search.ts"
+              "path": "src/plugins/discover/public/saved_searches/legacy/_saved_search.ts"
             },
             {
               "plugin": "visualizations",
diff --git a/api_docs/saved_objects_management.json b/api_docs/saved_objects_management.json
index e06c7faada71fd..72f9ca569cc59e 100644
--- a/api_docs/saved_objects_management.json
+++ b/api_docs/saved_objects_management.json
@@ -819,7 +819,7 @@
             "label": "euiColumn",
             "description": [],
             "signature": [
-              "{ children?: React.ReactNode; headers?: string | undefined; onClick?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onChange?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; color?: string | undefined; onKeyDown?: ((event: React.KeyboardEvent<HTMLTableDataCellElement>) => void) | undefined; id?: string | undefined; title?: string | undefined; description?: string | undefined; security?: string | undefined; name: React.ReactNode; field: string; defaultChecked?: boolean | undefined; defaultValue?: string | number | string[] | undefined; suppressContentEditableWarning?: boolean | undefined; suppressHydrationWarning?: boolean | undefined; accessKey?: string | undefined; className?: string | undefined; contentEditable?: boolean | \"true\" | \"false\" | \"inherit\" | undefined; contextMenu?: string | undefined; dir?: string | undefined; draggable?: boolean | \"true\" | \"false\" | undefined; hidden?: boolean | undefined; lang?: string | undefined; placeholder?: string | undefined; slot?: string | undefined; spellCheck?: boolean | \"true\" | \"false\" | undefined; style?: React.CSSProperties | undefined; tabIndex?: number | undefined; translate?: \"yes\" | \"no\" | undefined; radioGroup?: string | undefined; role?: string | undefined; about?: string | undefined; datatype?: string | undefined; inlist?: any; prefix?: string | undefined; property?: string | undefined; resource?: string | undefined; typeof?: string | undefined; vocab?: string | undefined; autoCapitalize?: string | undefined; autoCorrect?: string | undefined; autoSave?: string | undefined; itemProp?: string | undefined; itemScope?: boolean | undefined; itemType?: string | undefined; itemID?: string | undefined; itemRef?: string | undefined; results?: number | undefined; unselectable?: \"on\" | \"off\" | undefined; inputMode?: \"none\" | \"search\" | \"email\" | \"text\" | \"tel\" | \"url\" | \"numeric\" | \"decimal\" | undefined; is?: string | undefined; 'aria-activedescendant'?: string | undefined; 'aria-atomic'?: boolean | \"true\" | \"false\" | undefined; 'aria-autocomplete'?: \"none\" | \"list\" | \"inline\" | \"both\" | undefined; 'aria-busy'?: boolean | \"true\" | \"false\" | undefined; 'aria-checked'?: boolean | \"mixed\" | \"true\" | \"false\" | undefined; 'aria-colcount'?: number | undefined; 'aria-colindex'?: number | undefined; 'aria-colspan'?: number | undefined; 'aria-controls'?: string | undefined; 'aria-current'?: boolean | \"date\" | \"location\" | \"page\" | \"time\" | \"true\" | \"false\" | \"step\" | undefined; 'aria-describedby'?: string | undefined; 'aria-details'?: string | undefined; 'aria-disabled'?: boolean | \"true\" | \"false\" | undefined; 'aria-dropeffect'?: \"none\" | \"copy\" | \"link\" | \"execute\" | \"move\" | \"popup\" | undefined; 'aria-errormessage'?: string | undefined; 'aria-expanded'?: boolean | \"true\" | \"false\" | undefined; 'aria-flowto'?: string | undefined; 'aria-grabbed'?: boolean | \"true\" | \"false\" | undefined; 'aria-haspopup'?: boolean | \"grid\" | \"menu\" | \"true\" | \"false\" | \"listbox\" | \"tree\" | \"dialog\" | undefined; 'aria-hidden'?: boolean | \"true\" | \"false\" | undefined; 'aria-invalid'?: boolean | \"true\" | \"false\" | \"grammar\" | \"spelling\" | undefined; 'aria-keyshortcuts'?: string | undefined; 'aria-label'?: string | undefined; 'aria-labelledby'?: string | undefined; 'aria-level'?: number | undefined; 'aria-live'?: \"off\" | \"assertive\" | \"polite\" | undefined; 'aria-modal'?: boolean | \"true\" | \"false\" | undefined; 'aria-multiline'?: boolean | \"true\" | \"false\" | undefined; 'aria-multiselectable'?: boolean | \"true\" | \"false\" | undefined; 'aria-orientation'?: \"horizontal\" | \"vertical\" | undefined; 'aria-owns'?: string | undefined; 'aria-placeholder'?: string | undefined; 'aria-posinset'?: number | undefined; 'aria-pressed'?: boolean | \"mixed\" | \"true\" | \"false\" | undefined; 'aria-readonly'?: boolean | \"true\" | \"false\" | undefined; 'aria-relevant'?: \"all\" | \"text\" | \"additions\" | \"additions text\" | \"removals\" | undefined; 'aria-required'?: boolean | \"true\" | \"false\" | undefined; 'aria-roledescription'?: string | undefined; 'aria-rowcount'?: number | undefined; 'aria-rowindex'?: number | undefined; 'aria-rowspan'?: number | undefined; 'aria-selected'?: boolean | \"true\" | \"false\" | undefined; 'aria-setsize'?: number | undefined; 'aria-sort'?: \"none\" | \"ascending\" | \"descending\" | \"other\" | undefined; 'aria-valuemax'?: number | undefined; 'aria-valuemin'?: number | undefined; 'aria-valuenow'?: number | undefined; 'aria-valuetext'?: string | undefined; dangerouslySetInnerHTML?: { __html: string; } | undefined; onCopy?: ((event: React.ClipboardEvent<HTMLTableDataCellElement>) => void) | undefined; onCopyCapture?: ((event: React.ClipboardEvent<HTMLTableDataCellElement>) => void) | undefined; onCut?: ((event: React.ClipboardEvent<HTMLTableDataCellElement>) => void) | undefined; onCutCapture?: ((event: React.ClipboardEvent<HTMLTableDataCellElement>) => void) | undefined; onPaste?: ((event: React.ClipboardEvent<HTMLTableDataCellElement>) => void) | undefined; onPasteCapture?: ((event: React.ClipboardEvent<HTMLTableDataCellElement>) => void) | undefined; onCompositionEnd?: ((event: React.CompositionEvent<HTMLTableDataCellElement>) => void) | undefined; onCompositionEndCapture?: ((event: React.CompositionEvent<HTMLTableDataCellElement>) => void) | undefined; onCompositionStart?: ((event: React.CompositionEvent<HTMLTableDataCellElement>) => void) | undefined; onCompositionStartCapture?: ((event: React.CompositionEvent<HTMLTableDataCellElement>) => void) | undefined; onCompositionUpdate?: ((event: React.CompositionEvent<HTMLTableDataCellElement>) => void) | undefined; onCompositionUpdateCapture?: ((event: React.CompositionEvent<HTMLTableDataCellElement>) => void) | undefined; onFocus?: ((event: React.FocusEvent<HTMLTableDataCellElement>) => void) | undefined; onFocusCapture?: ((event: React.FocusEvent<HTMLTableDataCellElement>) => void) | undefined; onBlur?: ((event: React.FocusEvent<HTMLTableDataCellElement>) => void) | undefined; onBlurCapture?: ((event: React.FocusEvent<HTMLTableDataCellElement>) => void) | undefined; onChangeCapture?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onBeforeInput?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onBeforeInputCapture?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onInput?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onInputCapture?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onReset?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onResetCapture?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onSubmit?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onSubmitCapture?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onInvalid?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onInvalidCapture?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onLoad?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onLoadCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onError?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onErrorCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onKeyDownCapture?: ((event: React.KeyboardEvent<HTMLTableDataCellElement>) => void) | undefined; onKeyPress?: ((event: React.KeyboardEvent<HTMLTableDataCellElement>) => void) | undefined; onKeyPressCapture?: ((event: React.KeyboardEvent<HTMLTableDataCellElement>) => void) | undefined; onKeyUp?: ((event: React.KeyboardEvent<HTMLTableDataCellElement>) => void) | undefined; onKeyUpCapture?: ((event: React.KeyboardEvent<HTMLTableDataCellElement>) => void) | undefined; onAbort?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onAbortCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onCanPlay?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onCanPlayCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onCanPlayThrough?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onCanPlayThroughCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onDurationChange?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onDurationChangeCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onEmptied?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onEmptiedCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onEncrypted?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onEncryptedCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onEnded?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onEndedCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onLoadedData?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onLoadedDataCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onLoadedMetadata?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onLoadedMetadataCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onLoadStart?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onLoadStartCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onPause?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onPauseCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onPlay?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onPlayCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onPlaying?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onPlayingCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onProgress?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onProgressCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onRateChange?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onRateChangeCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onSeeked?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onSeekedCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onSeeking?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onSeekingCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onStalled?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onStalledCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onSuspend?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onSuspendCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onTimeUpdate?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onTimeUpdateCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onVolumeChange?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onVolumeChangeCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onWaiting?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onWaitingCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onAuxClick?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onAuxClickCapture?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onClickCapture?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onContextMenu?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onContextMenuCapture?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onDoubleClick?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onDoubleClickCapture?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onDrag?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragCapture?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragEnd?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragEndCapture?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragEnter?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragEnterCapture?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragExit?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragExitCapture?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragLeave?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragLeaveCapture?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragOver?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragOverCapture?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragStart?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragStartCapture?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDrop?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDropCapture?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onMouseDown?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseDownCapture?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseEnter?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseLeave?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseMove?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseMoveCapture?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseOut?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseOutCapture?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseOver?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseOverCapture?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseUp?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseUpCapture?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onSelect?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onSelectCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onTouchCancel?: ((event: React.TouchEvent<HTMLTableDataCellElement>) => void) | undefined; onTouchCancelCapture?: ((event: React.TouchEvent<HTMLTableDataCellElement>) => void) | undefined; onTouchEnd?: ((event: React.TouchEvent<HTMLTableDataCellElement>) => void) | undefined; onTouchEndCapture?: ((event: React.TouchEvent<HTMLTableDataCellElement>) => void) | undefined; onTouchMove?: ((event: React.TouchEvent<HTMLTableDataCellElement>) => void) | undefined; onTouchMoveCapture?: ((event: React.TouchEvent<HTMLTableDataCellElement>) => void) | undefined; onTouchStart?: ((event: React.TouchEvent<HTMLTableDataCellElement>) => void) | undefined; onTouchStartCapture?: ((event: React.TouchEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerDown?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerDownCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerMove?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerMoveCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerUp?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerUpCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerCancel?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerCancelCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerEnter?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerEnterCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerLeave?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerLeaveCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerOver?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerOverCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerOut?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerOutCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onGotPointerCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onGotPointerCaptureCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onLostPointerCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onLostPointerCaptureCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onScroll?: ((event: React.UIEvent<HTMLTableDataCellElement, UIEvent>) => void) | undefined; onScrollCapture?: ((event: React.UIEvent<HTMLTableDataCellElement, UIEvent>) => void) | undefined; onWheel?: ((event: React.WheelEvent<HTMLTableDataCellElement>) => void) | undefined; onWheelCapture?: ((event: React.WheelEvent<HTMLTableDataCellElement>) => void) | undefined; onAnimationStart?: ((event: React.AnimationEvent<HTMLTableDataCellElement>) => void) | undefined; onAnimationStartCapture?: ((event: React.AnimationEvent<HTMLTableDataCellElement>) => void) | undefined; onAnimationEnd?: ((event: React.AnimationEvent<HTMLTableDataCellElement>) => void) | undefined; onAnimationEndCapture?: ((event: React.AnimationEvent<HTMLTableDataCellElement>) => void) | undefined; onAnimationIteration?: ((event: React.AnimationEvent<HTMLTableDataCellElement>) => void) | undefined; onAnimationIterationCapture?: ((event: React.AnimationEvent<HTMLTableDataCellElement>) => void) | undefined; onTransitionEnd?: ((event: React.TransitionEvent<HTMLTableDataCellElement>) => void) | undefined; onTransitionEndCapture?: ((event: React.TransitionEvent<HTMLTableDataCellElement>) => void) | undefined; 'data-test-subj'?: string | undefined; width?: string | undefined; readOnly?: boolean | undefined; render?: ((value: any, record: ",
+              "{ children?: React.ReactNode; onClick?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onChange?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; color?: string | undefined; onKeyDown?: ((event: React.KeyboardEvent<HTMLTableDataCellElement>) => void) | undefined; id?: string | undefined; title?: string | undefined; description?: string | undefined; security?: string | undefined; name: React.ReactNode; field: string; defaultChecked?: boolean | undefined; defaultValue?: string | number | string[] | undefined; suppressContentEditableWarning?: boolean | undefined; suppressHydrationWarning?: boolean | undefined; accessKey?: string | undefined; className?: string | undefined; contentEditable?: boolean | \"true\" | \"false\" | \"inherit\" | undefined; contextMenu?: string | undefined; dir?: string | undefined; draggable?: boolean | \"true\" | \"false\" | undefined; hidden?: boolean | undefined; lang?: string | undefined; placeholder?: string | undefined; slot?: string | undefined; spellCheck?: boolean | \"true\" | \"false\" | undefined; style?: React.CSSProperties | undefined; tabIndex?: number | undefined; translate?: \"yes\" | \"no\" | undefined; radioGroup?: string | undefined; role?: string | undefined; about?: string | undefined; datatype?: string | undefined; inlist?: any; prefix?: string | undefined; property?: string | undefined; resource?: string | undefined; typeof?: string | undefined; vocab?: string | undefined; autoCapitalize?: string | undefined; autoCorrect?: string | undefined; autoSave?: string | undefined; itemProp?: string | undefined; itemScope?: boolean | undefined; itemType?: string | undefined; itemID?: string | undefined; itemRef?: string | undefined; results?: number | undefined; unselectable?: \"on\" | \"off\" | undefined; inputMode?: \"none\" | \"search\" | \"email\" | \"text\" | \"tel\" | \"url\" | \"numeric\" | \"decimal\" | undefined; is?: string | undefined; 'aria-activedescendant'?: string | undefined; 'aria-atomic'?: boolean | \"true\" | \"false\" | undefined; 'aria-autocomplete'?: \"none\" | \"list\" | \"inline\" | \"both\" | undefined; 'aria-busy'?: boolean | \"true\" | \"false\" | undefined; 'aria-checked'?: boolean | \"mixed\" | \"true\" | \"false\" | undefined; 'aria-colcount'?: number | undefined; 'aria-colindex'?: number | undefined; 'aria-colspan'?: number | undefined; 'aria-controls'?: string | undefined; 'aria-current'?: boolean | \"date\" | \"page\" | \"time\" | \"true\" | \"false\" | \"step\" | \"location\" | undefined; 'aria-describedby'?: string | undefined; 'aria-details'?: string | undefined; 'aria-disabled'?: boolean | \"true\" | \"false\" | undefined; 'aria-dropeffect'?: \"none\" | \"copy\" | \"link\" | \"execute\" | \"move\" | \"popup\" | undefined; 'aria-errormessage'?: string | undefined; 'aria-expanded'?: boolean | \"true\" | \"false\" | undefined; 'aria-flowto'?: string | undefined; 'aria-grabbed'?: boolean | \"true\" | \"false\" | undefined; 'aria-haspopup'?: boolean | \"grid\" | \"menu\" | \"true\" | \"false\" | \"listbox\" | \"tree\" | \"dialog\" | undefined; 'aria-hidden'?: boolean | \"true\" | \"false\" | undefined; 'aria-invalid'?: boolean | \"true\" | \"false\" | \"grammar\" | \"spelling\" | undefined; 'aria-keyshortcuts'?: string | undefined; 'aria-label'?: string | undefined; 'aria-labelledby'?: string | undefined; 'aria-level'?: number | undefined; 'aria-live'?: \"off\" | \"assertive\" | \"polite\" | undefined; 'aria-modal'?: boolean | \"true\" | \"false\" | undefined; 'aria-multiline'?: boolean | \"true\" | \"false\" | undefined; 'aria-multiselectable'?: boolean | \"true\" | \"false\" | undefined; 'aria-orientation'?: \"horizontal\" | \"vertical\" | undefined; 'aria-owns'?: string | undefined; 'aria-placeholder'?: string | undefined; 'aria-posinset'?: number | undefined; 'aria-pressed'?: boolean | \"mixed\" | \"true\" | \"false\" | undefined; 'aria-readonly'?: boolean | \"true\" | \"false\" | undefined; 'aria-relevant'?: \"all\" | \"text\" | \"additions\" | \"additions text\" | \"removals\" | undefined; 'aria-required'?: boolean | \"true\" | \"false\" | undefined; 'aria-roledescription'?: string | undefined; 'aria-rowcount'?: number | undefined; 'aria-rowindex'?: number | undefined; 'aria-rowspan'?: number | undefined; 'aria-selected'?: boolean | \"true\" | \"false\" | undefined; 'aria-setsize'?: number | undefined; 'aria-sort'?: \"none\" | \"other\" | \"ascending\" | \"descending\" | undefined; 'aria-valuemax'?: number | undefined; 'aria-valuemin'?: number | undefined; 'aria-valuenow'?: number | undefined; 'aria-valuetext'?: string | undefined; dangerouslySetInnerHTML?: { __html: string; } | undefined; onCopy?: ((event: React.ClipboardEvent<HTMLTableDataCellElement>) => void) | undefined; onCopyCapture?: ((event: React.ClipboardEvent<HTMLTableDataCellElement>) => void) | undefined; onCut?: ((event: React.ClipboardEvent<HTMLTableDataCellElement>) => void) | undefined; onCutCapture?: ((event: React.ClipboardEvent<HTMLTableDataCellElement>) => void) | undefined; onPaste?: ((event: React.ClipboardEvent<HTMLTableDataCellElement>) => void) | undefined; onPasteCapture?: ((event: React.ClipboardEvent<HTMLTableDataCellElement>) => void) | undefined; onCompositionEnd?: ((event: React.CompositionEvent<HTMLTableDataCellElement>) => void) | undefined; onCompositionEndCapture?: ((event: React.CompositionEvent<HTMLTableDataCellElement>) => void) | undefined; onCompositionStart?: ((event: React.CompositionEvent<HTMLTableDataCellElement>) => void) | undefined; onCompositionStartCapture?: ((event: React.CompositionEvent<HTMLTableDataCellElement>) => void) | undefined; onCompositionUpdate?: ((event: React.CompositionEvent<HTMLTableDataCellElement>) => void) | undefined; onCompositionUpdateCapture?: ((event: React.CompositionEvent<HTMLTableDataCellElement>) => void) | undefined; onFocus?: ((event: React.FocusEvent<HTMLTableDataCellElement>) => void) | undefined; onFocusCapture?: ((event: React.FocusEvent<HTMLTableDataCellElement>) => void) | undefined; onBlur?: ((event: React.FocusEvent<HTMLTableDataCellElement>) => void) | undefined; onBlurCapture?: ((event: React.FocusEvent<HTMLTableDataCellElement>) => void) | undefined; onChangeCapture?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onBeforeInput?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onBeforeInputCapture?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onInput?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onInputCapture?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onReset?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onResetCapture?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onSubmit?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onSubmitCapture?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onInvalid?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onInvalidCapture?: ((event: React.FormEvent<HTMLTableDataCellElement>) => void) | undefined; onLoad?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onLoadCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onError?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onErrorCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onKeyDownCapture?: ((event: React.KeyboardEvent<HTMLTableDataCellElement>) => void) | undefined; onKeyPress?: ((event: React.KeyboardEvent<HTMLTableDataCellElement>) => void) | undefined; onKeyPressCapture?: ((event: React.KeyboardEvent<HTMLTableDataCellElement>) => void) | undefined; onKeyUp?: ((event: React.KeyboardEvent<HTMLTableDataCellElement>) => void) | undefined; onKeyUpCapture?: ((event: React.KeyboardEvent<HTMLTableDataCellElement>) => void) | undefined; onAbort?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onAbortCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onCanPlay?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onCanPlayCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onCanPlayThrough?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onCanPlayThroughCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onDurationChange?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onDurationChangeCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onEmptied?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onEmptiedCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onEncrypted?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onEncryptedCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onEnded?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onEndedCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onLoadedData?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onLoadedDataCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onLoadedMetadata?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onLoadedMetadataCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onLoadStart?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onLoadStartCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onPause?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onPauseCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onPlay?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onPlayCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onPlaying?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onPlayingCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onProgress?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onProgressCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onRateChange?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onRateChangeCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onSeeked?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onSeekedCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onSeeking?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onSeekingCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onStalled?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onStalledCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onSuspend?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onSuspendCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onTimeUpdate?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onTimeUpdateCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onVolumeChange?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onVolumeChangeCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onWaiting?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onWaitingCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onAuxClick?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onAuxClickCapture?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onClickCapture?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onContextMenu?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onContextMenuCapture?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onDoubleClick?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onDoubleClickCapture?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onDrag?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragCapture?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragEnd?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragEndCapture?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragEnter?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragEnterCapture?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragExit?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragExitCapture?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragLeave?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragLeaveCapture?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragOver?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragOverCapture?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragStart?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDragStartCapture?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDrop?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onDropCapture?: ((event: React.DragEvent<HTMLTableDataCellElement>) => void) | undefined; onMouseDown?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseDownCapture?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseEnter?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseLeave?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseMove?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseMoveCapture?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseOut?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseOutCapture?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseOver?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseOverCapture?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseUp?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onMouseUpCapture?: ((event: React.MouseEvent<HTMLTableDataCellElement, MouseEvent>) => void) | undefined; onSelect?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onSelectCapture?: ((event: React.SyntheticEvent<HTMLTableDataCellElement, Event>) => void) | undefined; onTouchCancel?: ((event: React.TouchEvent<HTMLTableDataCellElement>) => void) | undefined; onTouchCancelCapture?: ((event: React.TouchEvent<HTMLTableDataCellElement>) => void) | undefined; onTouchEnd?: ((event: React.TouchEvent<HTMLTableDataCellElement>) => void) | undefined; onTouchEndCapture?: ((event: React.TouchEvent<HTMLTableDataCellElement>) => void) | undefined; onTouchMove?: ((event: React.TouchEvent<HTMLTableDataCellElement>) => void) | undefined; onTouchMoveCapture?: ((event: React.TouchEvent<HTMLTableDataCellElement>) => void) | undefined; onTouchStart?: ((event: React.TouchEvent<HTMLTableDataCellElement>) => void) | undefined; onTouchStartCapture?: ((event: React.TouchEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerDown?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerDownCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerMove?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerMoveCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerUp?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerUpCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerCancel?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerCancelCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerEnter?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerEnterCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerLeave?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerLeaveCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerOver?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerOverCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerOut?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onPointerOutCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onGotPointerCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onGotPointerCaptureCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onLostPointerCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onLostPointerCaptureCapture?: ((event: React.PointerEvent<HTMLTableDataCellElement>) => void) | undefined; onScroll?: ((event: React.UIEvent<HTMLTableDataCellElement, UIEvent>) => void) | undefined; onScrollCapture?: ((event: React.UIEvent<HTMLTableDataCellElement, UIEvent>) => void) | undefined; onWheel?: ((event: React.WheelEvent<HTMLTableDataCellElement>) => void) | undefined; onWheelCapture?: ((event: React.WheelEvent<HTMLTableDataCellElement>) => void) | undefined; onAnimationStart?: ((event: React.AnimationEvent<HTMLTableDataCellElement>) => void) | undefined; onAnimationStartCapture?: ((event: React.AnimationEvent<HTMLTableDataCellElement>) => void) | undefined; onAnimationEnd?: ((event: React.AnimationEvent<HTMLTableDataCellElement>) => void) | undefined; onAnimationEndCapture?: ((event: React.AnimationEvent<HTMLTableDataCellElement>) => void) | undefined; onAnimationIteration?: ((event: React.AnimationEvent<HTMLTableDataCellElement>) => void) | undefined; onAnimationIterationCapture?: ((event: React.AnimationEvent<HTMLTableDataCellElement>) => void) | undefined; onTransitionEnd?: ((event: React.TransitionEvent<HTMLTableDataCellElement>) => void) | undefined; onTransitionEndCapture?: ((event: React.TransitionEvent<HTMLTableDataCellElement>) => void) | undefined; 'data-test-subj'?: string | undefined; width?: string | undefined; readOnly?: boolean | undefined; render?: ((value: any, record: ",
               {
                 "pluginId": "savedObjectsManagement",
                 "scope": "public",
@@ -837,7 +837,7 @@
                 "section": "def-public.SavedObjectsManagementRecord",
                 "text": "SavedObjectsManagementRecord"
               },
-              ">) => React.ReactNode) | undefined; colSpan?: number | undefined; rowSpan?: number | undefined; scope?: string | undefined; valign?: \"top\" | \"bottom\" | \"baseline\" | \"middle\" | undefined; dataType?: \"string\" | \"number\" | \"boolean\" | \"date\" | \"auto\" | undefined; isExpander?: boolean | undefined; textOnly?: boolean | undefined; truncateText?: boolean | undefined; isMobileHeader?: boolean | undefined; mobileOptions?: { show?: boolean | undefined; only?: boolean | undefined; render?: ((item: ",
+              ">) => React.ReactNode) | undefined; colSpan?: number | undefined; headers?: string | undefined; rowSpan?: number | undefined; scope?: string | undefined; valign?: \"top\" | \"bottom\" | \"baseline\" | \"middle\" | undefined; dataType?: \"string\" | \"number\" | \"boolean\" | \"date\" | \"auto\" | undefined; isExpander?: boolean | undefined; textOnly?: boolean | undefined; truncateText?: boolean | undefined; isMobileHeader?: boolean | undefined; mobileOptions?: { show?: boolean | undefined; only?: boolean | undefined; render?: ((item: ",
               {
                 "pluginId": "savedObjectsManagement",
                 "scope": "public",
diff --git a/api_docs/security_solution.json b/api_docs/security_solution.json
index ebff5a94fbe2c7..b16ae8334f1b00 100644
--- a/api_docs/security_solution.json
+++ b/api_docs/security_solution.json
@@ -3162,7 +3162,7 @@
                 "section": "def-common.DataProvider",
                 "text": "DataProvider"
               },
-              ", \"type\" | \"enabled\" | \"id\" | \"name\" | \"excluded\" | \"kqlQuery\" | \"queryMatch\">[]"
+              ", \"type\" | \"id\" | \"name\" | \"enabled\" | \"excluded\" | \"kqlQuery\" | \"queryMatch\">[]"
             ],
             "path": "x-pack/plugins/timelines/common/types/timeline/data_provider/index.ts",
             "deprecated": false
@@ -10228,7 +10228,7 @@
             "section": "def-common.RequestBasicOptions",
             "text": "RequestBasicOptions"
           },
-          ", \"id\" | \"params\" | \"defaultIndex\" | \"filterQuery\" | \"docValueFields\" | \"factoryQueryType\" | \"indexType\">"
+          ", \"id\" | \"defaultIndex\" | \"params\" | \"filterQuery\" | \"docValueFields\" | \"factoryQueryType\" | \"indexType\">"
         ],
         "path": "x-pack/plugins/security_solution/common/search_strategy/security_solution/network/details/index.ts",
         "deprecated": false,
@@ -15658,7 +15658,7 @@
             "section": "def-common.TimelineEventsAllRequestOptions",
             "text": "TimelineEventsAllRequestOptions"
           },
-          ", \"id\" | \"sort\" | \"fields\" | \"timerange\" | \"language\" | \"defaultIndex\" | \"pagination\" | \"filterQuery\" | \"docValueFields\" | \"factoryQueryType\" | \"indexType\" | \"entityType\" | \"fieldRequested\" | \"excludeEcsData\" | \"authFilter\">"
+          ", \"id\" | \"sort\" | \"fields\" | \"defaultIndex\" | \"timerange\" | \"language\" | \"pagination\" | \"filterQuery\" | \"docValueFields\" | \"factoryQueryType\" | \"indexType\" | \"entityType\" | \"fieldRequested\" | \"excludeEcsData\" | \"authFilter\">"
         ],
         "path": "x-pack/plugins/timelines/common/search_strategy/timeline/events/eql/index.ts",
         "deprecated": false,
@@ -16280,7 +16280,7 @@
             "section": "def-common.TimelineRequestBasicOptions",
             "text": "TimelineRequestBasicOptions"
           },
-          ", \"id\" | \"params\" | \"defaultIndex\" | \"docValueFields\" | \"factoryQueryType\" | \"indexType\" | \"entityType\">"
+          ", \"id\" | \"defaultIndex\" | \"params\" | \"docValueFields\" | \"factoryQueryType\" | \"indexType\" | \"entityType\">"
         ],
         "path": "x-pack/plugins/timelines/common/search_strategy/timeline/events/last_event_time/index.ts",
         "deprecated": false,
@@ -19509,7 +19509,7 @@
             "section": "def-common.DataProviderType",
             "text": "DataProviderType"
           },
-          " | undefined; enabled: boolean; id: string; name: string; excluded: boolean; kqlQuery: string; queryMatch: ",
+          " | undefined; id: string; name: string; enabled: boolean; excluded: boolean; kqlQuery: string; queryMatch: ",
           {
             "pluginId": "timelines",
             "scope": "common",
@@ -19961,7 +19961,7 @@
             "section": "def-common.HostsKpiAuthenticationsStrategyResponse",
             "text": "HostsKpiAuthenticationsStrategyResponse"
           },
-          ", \"warning\" | \"id\" | \"inspect\" | \"total\" | \"authenticationsSuccess\" | \"authenticationsSuccessHistogram\" | \"authenticationsFailure\" | \"authenticationsFailureHistogram\" | \"loaded\" | \"isRunning\" | \"isPartial\" | \"isRestored\"> | Pick<",
+          ", \"id\" | \"inspect\" | \"warning\" | \"total\" | \"authenticationsSuccess\" | \"authenticationsSuccessHistogram\" | \"authenticationsFailure\" | \"authenticationsFailureHistogram\" | \"loaded\" | \"isRunning\" | \"isPartial\" | \"isRestored\"> | Pick<",
           {
             "pluginId": "securitySolution",
             "scope": "common",
@@ -19969,7 +19969,7 @@
             "section": "def-common.HostsKpiHostsStrategyResponse",
             "text": "HostsKpiHostsStrategyResponse"
           },
-          ", \"warning\" | \"id\" | \"inspect\" | \"total\" | \"hosts\" | \"loaded\" | \"isRunning\" | \"isPartial\" | \"isRestored\" | \"hostsHistogram\"> | Pick<",
+          ", \"id\" | \"inspect\" | \"warning\" | \"total\" | \"hosts\" | \"loaded\" | \"isRunning\" | \"isPartial\" | \"isRestored\" | \"hostsHistogram\"> | Pick<",
           {
             "pluginId": "securitySolution",
             "scope": "common",
@@ -19977,7 +19977,7 @@
             "section": "def-common.HostsKpiUniqueIpsStrategyResponse",
             "text": "HostsKpiUniqueIpsStrategyResponse"
           },
-          ", \"warning\" | \"id\" | \"inspect\" | \"total\" | \"loaded\" | \"isRunning\" | \"isPartial\" | \"isRestored\" | \"uniqueSourceIps\" | \"uniqueSourceIpsHistogram\" | \"uniqueDestinationIps\" | \"uniqueDestinationIpsHistogram\">"
+          ", \"id\" | \"inspect\" | \"warning\" | \"total\" | \"loaded\" | \"isRunning\" | \"isPartial\" | \"isRestored\" | \"uniqueSourceIps\" | \"uniqueSourceIpsHistogram\" | \"uniqueDestinationIps\" | \"uniqueDestinationIpsHistogram\">"
         ],
         "path": "x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/kpi/index.ts",
         "deprecated": false,
@@ -20486,7 +20486,7 @@
             "section": "def-common.NetworkKpiDnsStrategyResponse",
             "text": "NetworkKpiDnsStrategyResponse"
           },
-          ", \"warning\" | \"id\" | \"inspect\" | \"total\" | \"loaded\" | \"isRunning\" | \"isPartial\" | \"isRestored\" | \"dnsQueries\"> | Pick<",
+          ", \"id\" | \"inspect\" | \"warning\" | \"total\" | \"loaded\" | \"isRunning\" | \"isPartial\" | \"isRestored\" | \"dnsQueries\"> | Pick<",
           {
             "pluginId": "securitySolution",
             "scope": "common",
@@ -20494,7 +20494,7 @@
             "section": "def-common.NetworkKpiNetworkEventsStrategyResponse",
             "text": "NetworkKpiNetworkEventsStrategyResponse"
           },
-          ", \"warning\" | \"id\" | \"inspect\" | \"total\" | \"loaded\" | \"isRunning\" | \"isPartial\" | \"isRestored\" | \"networkEvents\"> | Pick<",
+          ", \"id\" | \"inspect\" | \"warning\" | \"total\" | \"loaded\" | \"isRunning\" | \"isPartial\" | \"isRestored\" | \"networkEvents\"> | Pick<",
           {
             "pluginId": "securitySolution",
             "scope": "common",
@@ -20502,7 +20502,7 @@
             "section": "def-common.NetworkKpiTlsHandshakesStrategyResponse",
             "text": "NetworkKpiTlsHandshakesStrategyResponse"
           },
-          ", \"warning\" | \"id\" | \"inspect\" | \"total\" | \"loaded\" | \"isRunning\" | \"isPartial\" | \"isRestored\" | \"tlsHandshakes\"> | Pick<",
+          ", \"id\" | \"inspect\" | \"warning\" | \"total\" | \"loaded\" | \"isRunning\" | \"isPartial\" | \"isRestored\" | \"tlsHandshakes\"> | Pick<",
           {
             "pluginId": "securitySolution",
             "scope": "common",
@@ -20510,7 +20510,7 @@
             "section": "def-common.NetworkKpiUniqueFlowsStrategyResponse",
             "text": "NetworkKpiUniqueFlowsStrategyResponse"
           },
-          ", \"warning\" | \"id\" | \"inspect\" | \"total\" | \"loaded\" | \"isRunning\" | \"isPartial\" | \"isRestored\" | \"uniqueFlowId\"> | Pick<",
+          ", \"id\" | \"inspect\" | \"warning\" | \"total\" | \"loaded\" | \"isRunning\" | \"isPartial\" | \"isRestored\" | \"uniqueFlowId\"> | Pick<",
           {
             "pluginId": "securitySolution",
             "scope": "common",
@@ -20518,7 +20518,7 @@
             "section": "def-common.NetworkKpiUniquePrivateIpsStrategyResponse",
             "text": "NetworkKpiUniquePrivateIpsStrategyResponse"
           },
-          ", \"warning\" | \"id\" | \"inspect\" | \"total\" | \"loaded\" | \"isRunning\" | \"isPartial\" | \"isRestored\" | \"uniqueSourcePrivateIps\" | \"uniqueSourcePrivateIpsHistogram\" | \"uniqueDestinationPrivateIps\" | \"uniqueDestinationPrivateIpsHistogram\">"
+          ", \"id\" | \"inspect\" | \"warning\" | \"total\" | \"loaded\" | \"isRunning\" | \"isPartial\" | \"isRestored\" | \"uniqueSourcePrivateIps\" | \"uniqueSourcePrivateIpsHistogram\" | \"uniqueDestinationPrivateIps\" | \"uniqueDestinationPrivateIpsHistogram\">"
         ],
         "path": "x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/index.ts",
         "deprecated": false,
diff --git a/api_docs/spaces.json b/api_docs/spaces.json
index b391ca6ea0dbb0..fc7550b607c660 100644
--- a/api_docs/spaces.json
+++ b/api_docs/spaces.json
@@ -3185,7 +3185,7 @@
             "section": "def-server.SavedObjectsRepository",
             "text": "SavedObjectsRepository"
           },
-          ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">"
+          ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">"
         ],
         "path": "x-pack/plugins/spaces/server/spaces_client/spaces_client_service.ts",
         "deprecated": false,
diff --git a/api_docs/task_manager.json b/api_docs/task_manager.json
index 4b7f6dc95e7403..4542cdc6fe3f14 100644
--- a/api_docs/task_manager.json
+++ b/api_docs/task_manager.json
@@ -1245,7 +1245,7 @@
         "TaskScheduling",
         ", \"schedule\" | \"runNow\" | \"ephemeralRunNow\" | \"ensureScheduled\"> & Pick<",
         "TaskStore",
-        ", \"remove\" | \"get\" | \"fetch\"> & { removeIfExists: (id: string) => Promise<void>; } & { supportsEphemeralTasks: () => boolean; }"
+        ", \"remove\" | \"fetch\" | \"get\"> & { removeIfExists: (id: string) => Promise<void>; } & { supportsEphemeralTasks: () => boolean; }"
       ],
       "path": "x-pack/plugins/task_manager/server/plugin.ts",
       "deprecated": false,
diff --git a/api_docs/telemetry_collection_manager.json b/api_docs/telemetry_collection_manager.json
index 39189b20705aef..7b8178d4499b7b 100644
--- a/api_docs/telemetry_collection_manager.json
+++ b/api_docs/telemetry_collection_manager.json
@@ -74,7 +74,7 @@
             "signature": [
               "Pick<",
               "KibanaClient",
-              ", \"get\" | \"delete\" | \"monitoring\" | \"security\" | \"create\" | \"index\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
+              ", \"monitoring\" | \"security\" | \"create\" | \"index\" | \"delete\" | \"get\" | \"update\" | \"closePointInTime\" | \"search\" | \"transform\" | \"eql\" | \"helpers\" | \"emit\" | \"on\" | \"once\" | \"off\" | \"asyncSearch\" | \"autoscaling\" | \"bulk\" | \"cat\" | \"ccr\" | \"clearScroll\" | \"cluster\" | \"count\" | \"danglingIndices\" | \"dataFrameTransformDeprecated\" | \"deleteByQuery\" | \"deleteByQueryRethrottle\" | \"deleteScript\" | \"enrich\" | \"exists\" | \"existsSource\" | \"explain\" | \"features\" | \"fieldCaps\" | \"fleet\" | \"getScript\" | \"getScriptContext\" | \"getScriptLanguages\" | \"getSource\" | \"graph\" | \"ilm\" | \"indices\" | \"info\" | \"ingest\" | \"license\" | \"logstash\" | \"mget\" | \"migration\" | \"ml\" | \"msearch\" | \"msearchTemplate\" | \"mtermvectors\" | \"nodes\" | \"openPointInTime\" | \"ping\" | \"putScript\" | \"rankEval\" | \"reindex\" | \"reindexRethrottle\" | \"renderSearchTemplate\" | \"rollup\" | \"scriptsPainlessExecute\" | \"scroll\" | \"searchShards\" | \"searchTemplate\" | \"searchableSnapshots\" | \"shutdown\" | \"slm\" | \"snapshot\" | \"sql\" | \"ssl\" | \"tasks\" | \"termsEnum\" | \"termvectors\" | \"textStructure\" | \"updateByQuery\" | \"updateByQueryRethrottle\" | \"watcher\" | \"xpack\"> & { transport: { request(params: ",
               "TransportRequestParams",
               ", options?: ",
               "TransportRequestOptions",
@@ -95,25 +95,7 @@
             "label": "soClient",
             "description": [],
             "signature": [
-              "{ get: <T = unknown>(type: string, id: string, options?: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsBaseOptions",
-                "text": "SavedObjectsBaseOptions"
-              },
-              ") => Promise<",
-              "SavedObject",
-              "<T>>; delete: (type: string, id: string, options?: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsDeleteOptions",
-                "text": "SavedObjectsDeleteOptions"
-              },
-              ") => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: ",
+              "{ create: <T = unknown>(type: string, attributes: T, options?: ",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -171,7 +153,15 @@
                 "section": "def-server.SavedObjectsCheckConflictsResponse",
                 "text": "SavedObjectsCheckConflictsResponse"
               },
-              ">; find: <T = unknown, A = unknown>(options: ",
+              ">; delete: (type: string, id: string, options?: ",
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCoreSavedObjectsPluginApi",
+                "section": "def-server.SavedObjectsDeleteOptions",
+                "text": "SavedObjectsDeleteOptions"
+              },
+              ") => Promise<{}>; find: <T = unknown, A = unknown>(options: ",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -235,6 +225,16 @@
                 "section": "def-server.SavedObjectsBulkResolveResponse",
                 "text": "SavedObjectsBulkResolveResponse"
               },
+              "<T>>; get: <T = unknown>(type: string, id: string, options?: ",
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCoreSavedObjectsPluginApi",
+                "section": "def-server.SavedObjectsBaseOptions",
+                "text": "SavedObjectsBaseOptions"
+              },
+              ") => Promise<",
+              "SavedObject",
               "<T>>; resolve: <T = unknown>(type: string, id: string, options?: ",
               {
                 "pluginId": "core",
diff --git a/api_docs/timelines.json b/api_docs/timelines.json
index 416f623520394b..f9ae6f615d1a77 100644
--- a/api_docs/timelines.json
+++ b/api_docs/timelines.json
@@ -6361,7 +6361,7 @@
                 "section": "def-common.DataProvider",
                 "text": "DataProvider"
               },
-              ", \"type\" | \"enabled\" | \"id\" | \"name\" | \"excluded\" | \"kqlQuery\" | \"queryMatch\">[]"
+              ", \"type\" | \"id\" | \"name\" | \"enabled\" | \"excluded\" | \"kqlQuery\" | \"queryMatch\">[]"
             ],
             "path": "x-pack/plugins/timelines/common/types/timeline/data_provider/index.ts",
             "deprecated": false
@@ -9924,7 +9924,7 @@
             "section": "def-common.TimelineEventsAllRequestOptions",
             "text": "TimelineEventsAllRequestOptions"
           },
-          ", \"id\" | \"sort\" | \"fields\" | \"timerange\" | \"language\" | \"defaultIndex\" | \"pagination\" | \"filterQuery\" | \"docValueFields\" | \"factoryQueryType\" | \"indexType\" | \"entityType\" | \"fieldRequested\" | \"excludeEcsData\" | \"authFilter\">"
+          ", \"id\" | \"sort\" | \"fields\" | \"defaultIndex\" | \"timerange\" | \"language\" | \"pagination\" | \"filterQuery\" | \"docValueFields\" | \"factoryQueryType\" | \"indexType\" | \"entityType\" | \"fieldRequested\" | \"excludeEcsData\" | \"authFilter\">"
         ],
         "path": "x-pack/plugins/timelines/common/search_strategy/timeline/events/eql/index.ts",
         "deprecated": false,
@@ -10546,7 +10546,7 @@
             "section": "def-common.TimelineRequestBasicOptions",
             "text": "TimelineRequestBasicOptions"
           },
-          ", \"id\" | \"params\" | \"defaultIndex\" | \"docValueFields\" | \"factoryQueryType\" | \"indexType\" | \"entityType\">"
+          ", \"id\" | \"defaultIndex\" | \"params\" | \"docValueFields\" | \"factoryQueryType\" | \"indexType\" | \"entityType\">"
         ],
         "path": "x-pack/plugins/timelines/common/search_strategy/timeline/events/last_event_time/index.ts",
         "deprecated": false,
@@ -12807,7 +12807,7 @@
             "section": "def-common.DataProviderType",
             "text": "DataProviderType"
           },
-          " | undefined; enabled: boolean; id: string; name: string; excluded: boolean; kqlQuery: string; queryMatch: ",
+          " | undefined; id: string; name: string; enabled: boolean; excluded: boolean; kqlQuery: string; queryMatch: ",
           {
             "pluginId": "timelines",
             "scope": "common",
diff --git a/api_docs/triggers_actions_ui.json b/api_docs/triggers_actions_ui.json
index b7e953917aaad9..3b5de759e97ee9 100644
--- a/api_docs/triggers_actions_ui.json
+++ b/api_docs/triggers_actions_ui.json
@@ -1353,7 +1353,7 @@
             "label": "setAlertProperty",
             "description": [],
             "signature": [
-              "<Prop extends \"enabled\" | \"id\" | \"name\" | \"tags\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">(key: Prop, value: Pick<",
+              "<Prop extends \"id\" | \"name\" | \"tags\" | \"enabled\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">(key: Prop, value: Pick<",
               {
                 "pluginId": "alerting",
                 "scope": "common",
@@ -1361,7 +1361,7 @@
                 "section": "def-common.Alert",
                 "text": "Alert"
               },
-              "<Params>, \"enabled\" | \"id\" | \"name\" | \"tags\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">[Prop] | null) => void"
+              "<Params>, \"id\" | \"name\" | \"tags\" | \"enabled\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">[Prop] | null) => void"
             ],
             "path": "x-pack/plugins/triggers_actions_ui/public/types.ts",
             "deprecated": false,
@@ -1396,7 +1396,7 @@
                     "section": "def-common.Alert",
                     "text": "Alert"
                   },
-                  "<Params>, \"enabled\" | \"id\" | \"name\" | \"tags\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">[Prop] | null"
+                  "<Params>, \"id\" | \"name\" | \"tags\" | \"enabled\" | \"params\" | \"actions\" | \"throttle\" | \"alertTypeId\" | \"consumer\" | \"schedule\" | \"scheduledTaskId\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"apiKeyOwner\" | \"notifyWhen\" | \"muteAll\" | \"mutedInstanceIds\" | \"executionStatus\">[Prop] | null"
                 ],
                 "path": "x-pack/plugins/triggers_actions_ui/public/types.ts",
                 "deprecated": false,
@@ -2115,7 +2115,7 @@
         "label": "Alert",
         "description": [],
         "signature": [
-          "{ enabled: boolean; id: string; name: string; tags: string[]; params: Record<string, unknown>; actions: ",
+          "{ id: string; name: string; tags: string[]; enabled: boolean; params: Record<string, unknown>; actions: ",
           {
             "pluginId": "alerting",
             "scope": "common",
@@ -2187,20 +2187,6 @@
         "deprecated": false,
         "initialIsOpen": false
       },
-      {
-        "parentPluginId": "triggersActionsUi",
-        "id": "def-public.DEFAULT_HIDDEN_ONLY_ON_ALERTS_ACTION_TYPES",
-        "type": "Array",
-        "tags": [],
-        "label": "DEFAULT_HIDDEN_ONLY_ON_ALERTS_ACTION_TYPES",
-        "description": [],
-        "signature": [
-          "string[]"
-        ],
-        "path": "x-pack/plugins/triggers_actions_ui/public/common/constants/index.ts",
-        "deprecated": false,
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "triggersActionsUi",
         "id": "def-public.RuleTypeRegistryContract",
@@ -3216,7 +3202,7 @@
           "signature": [
             "(props: Pick<",
             "AlertAddProps",
-            "<Record<string, any>>, \"onClose\" | \"metadata\" | \"onSave\" | \"alertTypeId\" | \"consumer\" | \"canChangeTrigger\" | \"initialValues\" | \"reloadAlerts\">) => React.ReactElement<",
+            "<Record<string, any>>, \"onClose\" | \"metadata\" | \"onSave\" | \"alertTypeId\" | \"consumer\" | \"canChangeTrigger\" | \"initialValues\" | \"reloadAlerts\" | \"ruleTypeIndex\">) => React.ReactElement<",
             "AlertAddProps",
             "<Record<string, any>>, string | ((props: any) => React.ReactElement<any, string | any | (new (props: any) => React.Component<any, any, any>)> | null) | (new (props: any) => React.Component<any, any, any>)>"
           ],
@@ -3233,7 +3219,7 @@
               "signature": [
                 "Pick<",
                 "AlertAddProps",
-                "<Record<string, any>>, \"onClose\" | \"metadata\" | \"onSave\" | \"alertTypeId\" | \"consumer\" | \"canChangeTrigger\" | \"initialValues\" | \"reloadAlerts\">"
+                "<Record<string, any>>, \"onClose\" | \"metadata\" | \"onSave\" | \"alertTypeId\" | \"consumer\" | \"canChangeTrigger\" | \"initialValues\" | \"reloadAlerts\" | \"ruleTypeIndex\">"
               ],
               "path": "x-pack/plugins/triggers_actions_ui/public/plugin.ts",
               "deprecated": false,
@@ -3252,7 +3238,7 @@
           "signature": [
             "(props: Pick<",
             "AlertEditProps",
-            "<Record<string, any>>, \"onClose\" | \"metadata\" | \"onSave\" | \"reloadAlerts\" | \"initialAlert\">) => React.ReactElement<",
+            "<Record<string, any>>, \"onClose\" | \"metadata\" | \"onSave\" | \"reloadAlerts\" | \"initialAlert\" | \"ruleType\">) => React.ReactElement<",
             "AlertEditProps",
             "<Record<string, any>>, string | ((props: any) => React.ReactElement<any, string | any | (new (props: any) => React.Component<any, any, any>)> | null) | (new (props: any) => React.Component<any, any, any>)>"
           ],
@@ -3269,7 +3255,7 @@
               "signature": [
                 "Pick<",
                 "AlertEditProps",
-                "<Record<string, any>>, \"onClose\" | \"metadata\" | \"onSave\" | \"reloadAlerts\" | \"initialAlert\">"
+                "<Record<string, any>>, \"onClose\" | \"metadata\" | \"onSave\" | \"reloadAlerts\" | \"initialAlert\" | \"ruleType\">"
               ],
               "path": "x-pack/plugins/triggers_actions_ui/public/plugin.ts",
               "deprecated": false,
diff --git a/api_docs/triggers_actions_ui.mdx b/api_docs/triggers_actions_ui.mdx
index 0b6139e8ae9dbc..e626b244322462 100644
--- a/api_docs/triggers_actions_ui.mdx
+++ b/api_docs/triggers_actions_ui.mdx
@@ -18,7 +18,7 @@ Contact [Kibana Alerting](https://github.com/orgs/elastic/teams/kibana-alerting-
 
 | Public API count  | Any count | Items lacking comments | Missing exports | 
 |-------------------|-----------|------------------------|-----------------|
-| 239 | 1 | 230 | 18 |
+| 238 | 1 | 229 | 18 |
 
 ## Client
 
diff --git a/api_docs/usage_collection.json b/api_docs/usage_collection.json
index d091924dd664f3..c7fb02b1dc3786 100644
--- a/api_docs/usage_collection.json
+++ b/api_docs/usage_collection.json
@@ -461,7 +461,7 @@
                     "section": "def-server.SavedObjectsClient",
                     "text": "SavedObjectsClient"
                   },
-                  ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; } & (WithKibanaRequest extends true ? { kibanaRequest?: ",
+                  ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; } & (WithKibanaRequest extends true ? { kibanaRequest?: ",
                   {
                     "pluginId": "core",
                     "scope": "server",
@@ -701,7 +701,7 @@
           "\nPossible type values in the schema"
         ],
         "signature": [
-          "\"boolean\" | \"date\" | \"keyword\" | \"long\" | \"double\" | \"text\" | \"short\" | \"float\" | \"integer\" | \"byte\""
+          "\"boolean\" | \"keyword\" | \"date\" | \"long\" | \"double\" | \"text\" | \"short\" | \"float\" | \"integer\" | \"byte\""
         ],
         "path": "src/plugins/usage_collection/server/collector/types.ts",
         "deprecated": false,
@@ -733,7 +733,7 @@
             "section": "def-server.SavedObjectsClient",
             "text": "SavedObjectsClient"
           },
-          ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; } & (WithKibanaRequest extends true ? { kibanaRequest?: ",
+          ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; } & (WithKibanaRequest extends true ? { kibanaRequest?: ",
           {
             "pluginId": "core",
             "scope": "server",
@@ -803,7 +803,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; } & (WithKibanaRequest extends true ? { kibanaRequest?: ",
+              ", \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"delete\" | \"find\" | \"bulkGet\" | \"bulkResolve\" | \"get\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; } & (WithKibanaRequest extends true ? { kibanaRequest?: ",
               {
                 "pluginId": "core",
                 "scope": "server",
diff --git a/api_docs/vis_type_pie.json b/api_docs/vis_type_pie.json
index 66f8da4dc56fc5..0bb24caeb55586 100644
--- a/api_docs/vis_type_pie.json
+++ b/api_docs/vis_type_pie.json
@@ -78,9 +78,9 @@
             "signature": [
               "{ id?: string | undefined; params?: ",
               {
-                "pluginId": "expressions",
+                "pluginId": "fieldFormats",
                 "scope": "common",
-                "docId": "kibExpressionsPluginApi",
+                "docId": "kibFieldFormatsPluginApi",
                 "section": "def-common.SerializedFieldFormat",
                 "text": "SerializedFieldFormat"
               },
diff --git a/api_docs/visualizations.json b/api_docs/visualizations.json
index d131d522b35156..9877a9bc18321a 100644
--- a/api_docs/visualizations.json
+++ b/api_docs/visualizations.json
@@ -1012,7 +1012,7 @@
                 "section": "def-public.SerializedVisData",
                 "text": "SerializedVisData"
               },
-              ">; }, never>, \"type\" | \"data\" | \"id\" | \"title\" | \"description\" | \"params\" | \"uiState\">) => Promise<void>"
+              ">; }, never>, \"data\" | \"type\" | \"id\" | \"title\" | \"description\" | \"params\" | \"uiState\">) => Promise<void>"
             ],
             "path": "src/plugins/visualizations/public/vis.ts",
             "deprecated": false,
@@ -1057,7 +1057,7 @@
                     "section": "def-public.SerializedVisData",
                     "text": "SerializedVisData"
                   },
-                  ">; }, never>, \"type\" | \"data\" | \"id\" | \"title\" | \"description\" | \"params\" | \"uiState\">"
+                  ">; }, never>, \"data\" | \"type\" | \"id\" | \"title\" | \"description\" | \"params\" | \"uiState\">"
                 ],
                 "path": "src/plugins/visualizations/public/vis.ts",
                 "deprecated": false,
@@ -1280,13 +1280,21 @@
           },
           "; field?: string | undefined; index?: string | undefined; params?: ",
           {
-            "pluginId": "expressions",
+            "pluginId": "fieldFormats",
             "scope": "common",
-            "docId": "kibExpressionsPluginApi",
+            "docId": "kibFieldFormatsPluginApi",
             "section": "def-common.SerializedFieldFormat",
             "text": "SerializedFieldFormat"
           },
-          "<Record<string, any>> | undefined; source?: string | undefined; sourceParams?: ",
+          "<",
+          {
+            "pluginId": "fieldFormats",
+            "scope": "common",
+            "docId": "kibFieldFormatsPluginApi",
+            "section": "def-common.FieldFormatParams",
+            "text": "FieldFormatParams"
+          },
+          "> | undefined; source?: string | undefined; sourceParams?: ",
           {
             "pluginId": "@kbn/utility-types",
             "scope": "server",
@@ -2100,13 +2108,21 @@
             "description": [],
             "signature": [
               {
-                "pluginId": "expressions",
+                "pluginId": "fieldFormats",
                 "scope": "common",
-                "docId": "kibExpressionsPluginApi",
+                "docId": "kibFieldFormatsPluginApi",
                 "section": "def-common.SerializedFieldFormat",
                 "text": "SerializedFieldFormat"
               },
-              "<Record<string, any>>"
+              "<",
+              {
+                "pluginId": "fieldFormats",
+                "scope": "common",
+                "docId": "kibFieldFormatsPluginApi",
+                "section": "def-common.FieldFormatParams",
+                "text": "FieldFormatParams"
+              },
+              ">"
             ],
             "path": "src/plugins/visualizations/public/vis_schemas.ts",
             "deprecated": false
@@ -4180,13 +4196,21 @@
           },
           "; format: ",
           {
-            "pluginId": "expressions",
+            "pluginId": "fieldFormats",
             "scope": "common",
-            "docId": "kibExpressionsPluginApi",
+            "docId": "kibFieldFormatsPluginApi",
             "section": "def-common.SerializedFieldFormat",
             "text": "SerializedFieldFormat"
           },
-          "<Record<string, any>>; }>)[] | undefined, string]"
+          "<",
+          {
+            "pluginId": "fieldFormats",
+            "scope": "common",
+            "docId": "kibFieldFormatsPluginApi",
+            "section": "def-common.FieldFormatParams",
+            "text": "FieldFormatParams"
+          },
+          ">; }>)[] | undefined, string]"
         ],
         "path": "src/plugins/visualizations/common/prepare_log_table.ts",
         "deprecated": false,
@@ -4238,13 +4262,21 @@
           },
           "; format: ",
           {
-            "pluginId": "expressions",
+            "pluginId": "fieldFormats",
             "scope": "common",
-            "docId": "kibExpressionsPluginApi",
+            "docId": "kibFieldFormatsPluginApi",
             "section": "def-common.SerializedFieldFormat",
             "text": "SerializedFieldFormat"
           },
-          "<Record<string, any>>; }"
+          "<",
+          {
+            "pluginId": "fieldFormats",
+            "scope": "common",
+            "docId": "kibFieldFormatsPluginApi",
+            "section": "def-common.FieldFormatParams",
+            "text": "FieldFormatParams"
+          },
+          ">; }"
         ],
         "path": "src/plugins/visualizations/common/expression_functions/xy_dimension.ts",
         "deprecated": false,
@@ -4602,7 +4634,7 @@
         "label": "VisualizeEmbeddableFactoryContract",
         "description": [],
         "signature": [
-          "{ readonly type: \"visualization\"; inject: (_state: ",
+          "{ inject: (_state: ",
           {
             "pluginId": "embeddable",
             "scope": "common",
@@ -4638,7 +4670,7 @@
           },
           "; references: ",
           "SavedObjectReference",
-          "[]; }; create: (input: ",
+          "[]; }; readonly type: \"visualization\"; create: (input: ",
           {
             "pluginId": "visualizations",
             "scope": "public",
@@ -5568,13 +5600,21 @@
           },
           "; field?: string | undefined; index?: string | undefined; params?: ",
           {
-            "pluginId": "expressions",
+            "pluginId": "fieldFormats",
             "scope": "common",
-            "docId": "kibExpressionsPluginApi",
+            "docId": "kibFieldFormatsPluginApi",
             "section": "def-common.SerializedFieldFormat",
             "text": "SerializedFieldFormat"
           },
-          "<Record<string, any>> | undefined; source?: string | undefined; sourceParams?: ",
+          "<",
+          {
+            "pluginId": "fieldFormats",
+            "scope": "common",
+            "docId": "kibFieldFormatsPluginApi",
+            "section": "def-common.FieldFormatParams",
+            "text": "FieldFormatParams"
+          },
+          "> | undefined; source?: string | undefined; sourceParams?: ",
           {
             "pluginId": "@kbn/utility-types",
             "scope": "server",
@@ -5994,13 +6034,21 @@
           },
           "; format: ",
           {
-            "pluginId": "expressions",
+            "pluginId": "fieldFormats",
             "scope": "common",
-            "docId": "kibExpressionsPluginApi",
+            "docId": "kibFieldFormatsPluginApi",
             "section": "def-common.SerializedFieldFormat",
             "text": "SerializedFieldFormat"
           },
-          "<Record<string, any>>; }>)[] | undefined, string]"
+          "<",
+          {
+            "pluginId": "fieldFormats",
+            "scope": "common",
+            "docId": "kibFieldFormatsPluginApi",
+            "section": "def-common.FieldFormatParams",
+            "text": "FieldFormatParams"
+          },
+          ">; }>)[] | undefined, string]"
         ],
         "path": "src/plugins/visualizations/common/prepare_log_table.ts",
         "deprecated": false,
diff --git a/api_docs/visualize.json b/api_docs/visualize.json
index 86196b0ba34c05..e1a0a134cde943 100644
--- a/api_docs/visualize.json
+++ b/api_docs/visualize.json
@@ -114,11 +114,11 @@
             "description": [],
             "signature": [
               {
-                "pluginId": "savedObjects",
+                "pluginId": "discover",
                 "scope": "public",
-                "docId": "kibSavedObjectsPluginApi",
-                "section": "def-public.SavedObject",
-                "text": "SavedObject"
+                "docId": "kibDiscoverPluginApi",
+                "section": "def-public.SavedSearch",
+                "text": "SavedSearch"
               },
               " | undefined"
             ],
diff --git a/packages/kbn-docs-utils/src/api_docs/build_api_docs_cli.ts b/packages/kbn-docs-utils/src/api_docs/build_api_docs_cli.ts
index 1f709a52a0fc1f..4ef3039253e90c 100644
--- a/packages/kbn-docs-utils/src/api_docs/build_api_docs_cli.ts
+++ b/packages/kbn-docs-utils/src/api_docs/build_api_docs_cli.ts
@@ -109,30 +109,36 @@ export function runBuildApiDocsCli() {
         const id = plugin.manifest.id;
         const pluginApi = pluginApiMap[id];
         const pluginStats = allPluginStats[id];
+        const pluginTeam = plugin.manifest.owner.name;
 
         reporter.metrics([
           {
             id,
+            meta: { pluginTeam },
             group: 'API count',
             value: pluginStats.apiCount,
           },
           {
             id,
+            meta: { pluginTeam },
             group: 'API count missing comments',
             value: pluginStats.missingComments.length,
           },
           {
             id,
+            meta: { pluginTeam },
             group: 'API count with any type',
             value: pluginStats.isAnyType.length,
           },
           {
             id,
+            meta: { pluginTeam },
             group: 'Non-exported public API item count',
             value: missingApiItems[id] ? Object.keys(missingApiItems[id]).length : 0,
           },
           {
             id,
+            meta: { pluginTeam },
             group: 'References to deprecated APIs',
             value: pluginStats.deprecatedAPIsReferencedCount,
           },

From 03fe419dd44a6401dde450fe2b8fc3bed43c1100 Mon Sep 17 00:00:00 2001
From: Zacqary Adam Xeper <Zacqary@users.noreply.github.com>
Date: Thu, 14 Oct 2021 11:21:55 -0500
Subject: [PATCH 66/71] [Stack Monitoring] Remove deprecation warning for
 Internal Monitoring (#114856)

* [Stack Monitoring] Remove deprecation warning for Internal Monitoring

* Fix i18n
---
 .../public/lib/internal_monitoring_toasts.tsx | 116 ------------------
 .../monitoring/public/services/clusters.js    |  39 ------
 .../translations/translations/ja-JP.json      |   6 -
 .../translations/translations/zh-CN.json      |   6 -
 4 files changed, 167 deletions(-)
 delete mode 100644 x-pack/plugins/monitoring/public/lib/internal_monitoring_toasts.tsx

diff --git a/x-pack/plugins/monitoring/public/lib/internal_monitoring_toasts.tsx b/x-pack/plugins/monitoring/public/lib/internal_monitoring_toasts.tsx
deleted file mode 100644
index b970ba5998ddf2..00000000000000
--- a/x-pack/plugins/monitoring/public/lib/internal_monitoring_toasts.tsx
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
-import { EuiSpacer, EuiLink } from '@elastic/eui';
-import { Legacy } from '../legacy_shims';
-import { toMountPoint } from '../../../../../src/plugins/kibana_react/public';
-import { isInSetupMode, toggleSetupMode } from './setup_mode';
-
-export interface MonitoringIndicesTypes {
-  legacyIndices: number;
-  metricbeatIndices: number;
-}
-
-const enterSetupModeLabel = () =>
-  i18n.translate('xpack.monitoring.internalMonitoringToast.enterSetupMode', {
-    defaultMessage: 'Enter setup mode',
-  });
-
-const learnMoreLabel = () =>
-  i18n.translate('xpack.monitoring.internalMonitoringToast.learnMoreAction', {
-    defaultMessage: 'Learn more',
-  });
-
-const showIfLegacyOnlyIndices = () => {
-  const blogUrl = Legacy.shims.docLinks.links.monitoring.metricbeatBlog;
-  const toast = Legacy.shims.toastNotifications.addWarning({
-    title: toMountPoint(
-      <FormattedMessage
-        id="xpack.monitoring.internalMonitoringToast.title"
-        defaultMessage="Internal Monitoring Detected"
-      />
-    ),
-    text: toMountPoint(
-      <div>
-        <p>
-          {i18n.translate('xpack.monitoring.internalMonitoringToast.description', {
-            defaultMessage: `It appears you are using "Legacy Collection" for Stack Monitoring.
-            This method of monitoring will no longer be supported in the next major release (8.0.0).
-            Please follow the steps in setup mode to start monitoring with Metricbeat.`,
-          })}
-        </p>
-        <EuiLink
-          onClick={() => {
-            Legacy.shims.toastNotifications.remove(toast);
-            toggleSetupMode(true);
-          }}
-        >
-          {enterSetupModeLabel()}
-        </EuiLink>
-
-        <EuiSpacer />
-        <EuiLink href={blogUrl} external target="_blank">
-          {learnMoreLabel()}
-        </EuiLink>
-      </div>
-    ),
-  });
-};
-
-const showIfLegacyAndMetricbeatIndices = () => {
-  const blogUrl = Legacy.shims.docLinks.links.monitoring.metricbeatBlog;
-  const toast = Legacy.shims.toastNotifications.addWarning({
-    title: toMountPoint(
-      <FormattedMessage
-        id="xpack.monitoring.internalAndMetricbeatMonitoringToast.title"
-        defaultMessage="Partial Legacy Monitoring Detected"
-      />
-    ),
-    text: toMountPoint(
-      <div>
-        <p>
-          {i18n.translate('xpack.monitoring.internalAndMetricbeatMonitoringToast.description', {
-            defaultMessage: `It appears you are using both Metricbeat and "Legacy Collection" for Stack Monitoring.
-            In 8.0.0, you must use Metricbeat to collect monitoring data.
-            Please follow the steps in setup mode to migrate the rest of the monitoring to Metricbeat.`,
-          })}
-        </p>
-        <EuiLink
-          onClick={() => {
-            Legacy.shims.toastNotifications.remove(toast);
-            toggleSetupMode(true);
-          }}
-        >
-          {enterSetupModeLabel()}
-        </EuiLink>
-
-        <EuiSpacer />
-        <EuiLink href={blogUrl} external target="_blank">
-          {learnMoreLabel()}
-        </EuiLink>
-      </div>
-    ),
-  });
-};
-
-export const showInternalMonitoringToast = ({
-  legacyIndices,
-  metricbeatIndices,
-}: MonitoringIndicesTypes) => {
-  if (isInSetupMode()) {
-    return;
-  }
-
-  if (legacyIndices && !metricbeatIndices) {
-    showIfLegacyOnlyIndices();
-  } else if (legacyIndices && metricbeatIndices) {
-    showIfLegacyAndMetricbeatIndices();
-  }
-};
diff --git a/x-pack/plugins/monitoring/public/services/clusters.js b/x-pack/plugins/monitoring/public/services/clusters.js
index 937a69cbbc32d5..b19d0ea56765f3 100644
--- a/x-pack/plugins/monitoring/public/services/clusters.js
+++ b/x-pack/plugins/monitoring/public/services/clusters.js
@@ -8,7 +8,6 @@
 import { ajaxErrorHandlersProvider } from '../lib/ajax_error_handler';
 import { Legacy } from '../legacy_shims';
 import { STANDALONE_CLUSTER_CLUSTER_UUID } from '../../common/constants';
-import { showInternalMonitoringToast } from '../lib/internal_monitoring_toasts';
 
 function formatClusters(clusters) {
   return clusters.map(formatCluster);
@@ -21,8 +20,6 @@ function formatCluster(cluster) {
   return cluster;
 }
 
-let once = false;
-
 export function monitoringClustersProvider($injector) {
   return async (clusterUuid, ccs, codePaths) => {
     const { min, max } = Legacy.shims.timefilter.getBounds();
@@ -57,42 +54,6 @@ export function monitoringClustersProvider($injector) {
       }
     }
 
-    async function ensureMetricbeatEnabled() {
-      if (Legacy.shims.isCloud) {
-        return;
-      }
-      const globalState = $injector.get('globalState');
-      try {
-        const response = await $http.post(
-          '../api/monitoring/v1/elasticsearch_settings/check/internal_monitoring',
-          {
-            ccs: globalState.ccs,
-          }
-        );
-        const { data } = response;
-        showInternalMonitoringToast({
-          legacyIndices: data.legacy_indices,
-          metricbeatIndices: data.mb_indices,
-        });
-      } catch (err) {
-        const Private = $injector.get('Private');
-        const ajaxErrorHandlers = Private(ajaxErrorHandlersProvider);
-        return ajaxErrorHandlers(err);
-      }
-    }
-
-    if (!once) {
-      once = true;
-      const clusters = await getClusters();
-      if (clusters.length) {
-        try {
-          await ensureMetricbeatEnabled();
-        } catch (_err) {
-          // Intentionally swallow the error as this will retry the next page load
-        }
-      }
-      return clusters;
-    }
     return await getClusters();
   };
 }
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index ab62d33fce5f58..583085879af933 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -17880,12 +17880,6 @@
     "xpack.monitoring.healthCheck.unableToDisableWatches.action": "詳細情報",
     "xpack.monitoring.healthCheck.unableToDisableWatches.text": "レガシークラスターアラートを削除できませんでした。Kibanaサーバーログで詳細を確認するか、しばらくたってから再試行してください。",
     "xpack.monitoring.healthCheck.unableToDisableWatches.title": "レガシークラスターアラートはまだ有効です",
-    "xpack.monitoring.internalAndMetricbeatMonitoringToast.description": "スタック監視で、Metricbeatと「レガシー収集」の両方を使用している可能性があります。\n            8.0.0では、Metricbeatを使用して、監視データを収集する必要があります。\n            セットアップモードの手順に従い、残りの監視をMetricbeatに移行してください。",
-    "xpack.monitoring.internalAndMetricbeatMonitoringToast.title": "一部のレガシー監視が検出されました",
-    "xpack.monitoring.internalMonitoringToast.description": "スタック監視で、「レガシー収集」の両方を使用している可能性があります。\n            この監視方法は、次のメジャーリリース（8.0.0）ではサポートされていません。\n            セットアップモードの手順に従い、Metricbeatで監視を開始してください。",
-    "xpack.monitoring.internalMonitoringToast.enterSetupMode": "設定モードにする",
-    "xpack.monitoring.internalMonitoringToast.learnMoreAction": "詳細",
-    "xpack.monitoring.internalMonitoringToast.title": "内部監視が検出されました",
     "xpack.monitoring.kibana.clusterStatus.connectionsLabel": "接続",
     "xpack.monitoring.kibana.clusterStatus.instancesLabel": "インスタンス",
     "xpack.monitoring.kibana.clusterStatus.maxResponseTimeLabel": "最高応答時間",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 1271e3a32a0d3e..efffec39ed98cb 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -18154,12 +18154,6 @@
     "xpack.monitoring.healthCheck.unableToDisableWatches.action": "了解详情。",
     "xpack.monitoring.healthCheck.unableToDisableWatches.text": "我们移除旧版集群告警。请查看 Kibana 服务器日志以获取更多信息，或稍后重试。",
     "xpack.monitoring.healthCheck.unableToDisableWatches.title": "旧版集群告警仍有效",
-    "xpack.monitoring.internalAndMetricbeatMonitoringToast.description": "似乎您正在同时使用 Metricbeat 和“Legacy Collection”进行堆栈监测。\n            在 8.0.0 中，必须使用 Metricbeat 收集监测数据。\n            请在设置模式下按照相关步骤将监测的其余部分迁移到 Metricbeat。",
-    "xpack.monitoring.internalAndMetricbeatMonitoringToast.title": "检测到部分旧版监测",
-    "xpack.monitoring.internalMonitoringToast.description": "似乎您正在使用“Legacy Collection”进行堆栈监测。\n            下一主要版本 (8.0.0) 将不再支持这种监测方法。\n            请在设置模式下按照相关步骤使用 Metricbeat 开始监测。",
-    "xpack.monitoring.internalMonitoringToast.enterSetupMode": "进入设置模式",
-    "xpack.monitoring.internalMonitoringToast.learnMoreAction": "了解详情",
-    "xpack.monitoring.internalMonitoringToast.title": "检测到内部监测",
     "xpack.monitoring.kibana.clusterStatus.connectionsLabel": "连接",
     "xpack.monitoring.kibana.clusterStatus.instancesLabel": "实例",
     "xpack.monitoring.kibana.clusterStatus.maxResponseTimeLabel": "最大响应时间",

From b204a20b45bd9f3a4b70e95db79646c2312ce62d Mon Sep 17 00:00:00 2001
From: Chris Cowan <chris@chriscowan.us>
Date: Thu, 14 Oct 2021 10:35:25 -0600
Subject: [PATCH 67/71] [Stack Monitoring] Convert Access Denied page to React
 (#114887)

* [Stack Monitoring] Convert Access Denied page to React

* Adding data-test-subj
---
 .../hooks/use_request_error_handler.tsx       |  6 +-
 .../monitoring/public/application/index.tsx   |  2 +
 .../application/pages/access_denied/index.tsx | 76 +++++++++++++++++++
 3 files changed, 82 insertions(+), 2 deletions(-)
 create mode 100644 x-pack/plugins/monitoring/public/application/pages/access_denied/index.tsx

diff --git a/x-pack/plugins/monitoring/public/application/hooks/use_request_error_handler.tsx b/x-pack/plugins/monitoring/public/application/hooks/use_request_error_handler.tsx
index 3a645318444510..6c7c86a3301352 100644
--- a/x-pack/plugins/monitoring/public/application/hooks/use_request_error_handler.tsx
+++ b/x-pack/plugins/monitoring/public/application/hooks/use_request_error_handler.tsx
@@ -5,6 +5,7 @@
  * 2.0.
  */
 import React, { useCallback } from 'react';
+import { useHistory } from 'react-router-dom';
 import { includes } from 'lodash';
 import { IHttpFetchError } from 'kibana/public';
 import { FormattedMessage } from '@kbn/i18n/react';
@@ -34,11 +35,12 @@ export function formatMonitoringError(err: IHttpFetchError) {
 
 export const useRequestErrorHandler = () => {
   const { services } = useKibana<MonitoringStartPluginDependencies>();
+  const history = useHistory();
   return useCallback(
     (err: IHttpFetchError) => {
       if (err.response?.status === 403) {
         // redirect to error message view
-        history.replaceState(null, '', '#/access-denied');
+        history.push('/access-denied');
       } else if (err.response?.status === 404 && !includes(window.location.hash, 'no-data')) {
         // pass through if this is a 404 and we're already on the no-data page
         const formattedError = formatMonitoringError(err);
@@ -74,6 +76,6 @@ export const useRequestErrorHandler = () => {
         });
       }
     },
-    [services.notifications]
+    [history, services.notifications?.toasts]
   );
 };
diff --git a/x-pack/plugins/monitoring/public/application/index.tsx b/x-pack/plugins/monitoring/public/application/index.tsx
index 2caead4f963a1e..f18201110eddcf 100644
--- a/x-pack/plugins/monitoring/public/application/index.tsx
+++ b/x-pack/plugins/monitoring/public/application/index.tsx
@@ -55,6 +55,7 @@ import { LogStashNodeAdvancedPage } from './pages/logstash/advanced';
 // import { LogStashNodePipelinesPage } from './pages/logstash/node_pipelines';
 import { LogStashNodePage } from './pages/logstash/node';
 import { LogStashNodePipelinesPage } from './pages/logstash/node_pipelines';
+import { AccessDeniedPage } from './pages/access_denied';
 
 export const renderApp = (
   core: CoreStart,
@@ -101,6 +102,7 @@ const MonitoringApp: React.FC<{
               <BreadcrumbContainer.Provider history={history}>
                 <Router history={history}>
                   <Switch>
+                    <Route path="/access-denied" component={AccessDeniedPage} />
                     <Route path="/no-data" component={NoDataPage} />
                     <Route path="/loading" component={LoadingPage} />
                     <RouteInit
diff --git a/x-pack/plugins/monitoring/public/application/pages/access_denied/index.tsx b/x-pack/plugins/monitoring/public/application/pages/access_denied/index.tsx
new file mode 100644
index 00000000000000..d578f797946eb2
--- /dev/null
+++ b/x-pack/plugins/monitoring/public/application/pages/access_denied/index.tsx
@@ -0,0 +1,76 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useState } from 'react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiPanel, EuiCallOut, EuiButton } from '@elastic/eui';
+import useInterval from 'react-use/lib/useInterval';
+import { Redirect } from 'react-router-dom';
+import { ComponentProps } from '../../route_init';
+import { useKibana } from '../../../../../../../src/plugins/kibana_react/public';
+import { MonitoringStartPluginDependencies } from '../../../types';
+
+export const AccessDeniedPage: React.FC<ComponentProps> = () => {
+  const { services } = useKibana<MonitoringStartPluginDependencies>();
+  const [hasAccess, setHasAccess] = useState<boolean>(false);
+
+  useInterval(() => {
+    async function tryPrivilege() {
+      if (services.http?.fetch) {
+        try {
+          const response = await services.http?.fetch<{ has_access: boolean }>(
+            '../api/monitoring/v1/check_access'
+          );
+          setHasAccess(response.has_access);
+        } catch (e) {
+          setHasAccess(false);
+        }
+      }
+    }
+    tryPrivilege();
+  }, 5000);
+
+  const title = i18n.translate('xpack.monitoring.accessDeniedTitle', {
+    defaultMessage: 'Access Denied',
+  });
+
+  if (hasAccess) {
+    return <Redirect to="/home" />;
+  }
+  return (
+    <EuiPanel paddingSize="m">
+      <EuiCallOut title={title} color="danger" iconType="alert" data-test-subj="accessDeniedTitle">
+        <p>
+          <FormattedMessage
+            id="xpack.monitoring.accessDenied.notAuthorizedDescription"
+            defaultMessage="You are not authorized to access Monitoring. To use Monitoring, you
+        need the privileges granted by both the `{kibanaAdmin}` and
+        `{monitoringUser}` roles."
+            values={{ kibanaAdmin: 'kibana_admin', monitoringUser: 'monitoring_user ' }}
+          />
+        </p>
+        <p>
+          <FormattedMessage
+            id="xpack.monitoring.accessDenied.clusterNotConfiguredDescription"
+            defaultMessage="If you are attempting to access a dedicated monitoring cluster, this
+        might be because you are logged in as a user that is not configured on
+        the monitoring cluster."
+          />
+        </p>
+        <p>
+          <EuiButton href="../app/home">
+            <FormattedMessage
+              id="xpack.monitoring.accessDenied.backToKibanaButtonLabel"
+              defaultMessage="Back to Kibana"
+            />
+          </EuiButton>
+        </p>
+      </EuiCallOut>
+    </EuiPanel>
+  );
+};

From 81a84a863b78ff0c477d886d5db14c4d3c2d55b6 Mon Sep 17 00:00:00 2001
From: Paul Tavares <56442535+paul-tavares@users.noreply.github.com>
Date: Thu, 14 Oct 2021 12:39:40 -0400
Subject: [PATCH 68/71] [Security Solution][Endpoint] Unit tests for Policy
 Details Remove Modal (#115005)

* test: refactor trusted apps http mocks to top-level `mocks` directory
* Completed tests for Remove modal
* improvements to UT code
---
 .../public/management/pages/mocks/index.ts    |   1 +
 .../pages/mocks/trusted_apps_http_mocks.ts    |  90 +++++++++++
 .../pages/policy/test_utils/mocks.ts          |  61 ++------
 .../list/policy_trusted_apps_list.test.tsx    |   2 +-
 ...ove_trusted_app_from_policy_modal.test.tsx | 145 +++++++++++++++---
 .../remove_trusted_app_from_policy_modal.tsx  |   5 +-
 6 files changed, 227 insertions(+), 77 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/management/pages/mocks/trusted_apps_http_mocks.ts

diff --git a/x-pack/plugins/security_solution/public/management/pages/mocks/index.ts b/x-pack/plugins/security_solution/public/management/pages/mocks/index.ts
index c7388cad5696f3..e1f793f6087dc7 100644
--- a/x-pack/plugins/security_solution/public/management/pages/mocks/index.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/mocks/index.ts
@@ -6,3 +6,4 @@
  */
 
 export * from './fleet_mocks';
+export * from './trusted_apps_http_mocks';
diff --git a/x-pack/plugins/security_solution/public/management/pages/mocks/trusted_apps_http_mocks.ts b/x-pack/plugins/security_solution/public/management/pages/mocks/trusted_apps_http_mocks.ts
new file mode 100644
index 00000000000000..6f90fcd629485a
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/mocks/trusted_apps_http_mocks.ts
@@ -0,0 +1,90 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { HttpFetchOptionsWithPath } from 'kibana/public';
+import {
+  httpHandlerMockFactory,
+  ResponseProvidersInterface,
+} from '../../../common/mock/endpoint/http_handler_mock_factory';
+import {
+  GetTrustedAppsListRequest,
+  GetTrustedAppsListResponse,
+  PutTrustedAppUpdateRequest,
+  PutTrustedAppUpdateResponse,
+} from '../../../../common/endpoint/types';
+import {
+  TRUSTED_APPS_LIST_API,
+  TRUSTED_APPS_UPDATE_API,
+} from '../../../../common/endpoint/constants';
+import { TrustedAppGenerator } from '../../../../common/endpoint/data_generators/trusted_app_generator';
+
+export type PolicyDetailsGetTrustedAppsListHttpMocksInterface = ResponseProvidersInterface<{
+  trustedAppsList: (options: HttpFetchOptionsWithPath) => GetTrustedAppsListResponse;
+}>;
+/**
+ * HTTP mock for retrieving list of Trusted Apps
+ */
+export const trustedAppsGetListHttpMocks =
+  httpHandlerMockFactory<PolicyDetailsGetTrustedAppsListHttpMocksInterface>([
+    {
+      id: 'trustedAppsList',
+      path: TRUSTED_APPS_LIST_API,
+      method: 'get',
+      handler: ({ query }): GetTrustedAppsListResponse => {
+        const apiQueryParams = query as GetTrustedAppsListRequest;
+        const generator = new TrustedAppGenerator('seed');
+        const perPage = apiQueryParams.per_page ?? 10;
+        const data = Array.from({ length: Math.min(perPage, 50) }, () => generator.generate());
+
+        // Change the 3rd entry (index 2) to be policy specific
+        data[2].effectScope = {
+          type: 'policy',
+          policies: [
+            // IDs below are those generated by the `fleetGetEndpointPackagePolicyListHttpMock()` mock
+            'ddf6570b-9175-4a6d-b288-61a09771c647',
+            'b8e616ae-44fc-4be7-846c-ce8fa5c082dd',
+          ],
+        };
+
+        return {
+          page: apiQueryParams.page ?? 1,
+          per_page: perPage,
+          total: 20,
+          data,
+        };
+      },
+    },
+  ]);
+
+export type TrustedAppPutHttpMocksInterface = ResponseProvidersInterface<{
+  trustedAppUpdate: (options: HttpFetchOptionsWithPath) => PutTrustedAppUpdateResponse;
+}>;
+/**
+ * HTTP mocks that support updating a single Trusted Apps
+ */
+export const trustedAppPutHttpMocks = httpHandlerMockFactory<TrustedAppPutHttpMocksInterface>([
+  {
+    id: 'trustedAppUpdate',
+    path: TRUSTED_APPS_UPDATE_API,
+    method: 'put',
+    handler: ({ body, path }): PutTrustedAppUpdateResponse => {
+      const response: PutTrustedAppUpdateResponse = {
+        data: {
+          ...(body as unknown as PutTrustedAppUpdateRequest),
+          id: path.split('/').pop()!,
+          created_at: '2021-10-12T16:02:55.856Z',
+          created_by: 'elastic',
+          updated_at: '2021-10-13T16:02:55.856Z',
+          updated_by: 'elastic',
+          version: 'abc',
+        },
+      };
+
+      return response;
+    },
+  },
+]);
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/test_utils/mocks.ts b/x-pack/plugins/security_solution/public/management/pages/policy/test_utils/mocks.ts
index aca09716218634..707f75913c7ed0 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/test_utils/mocks.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/test_utils/mocks.ts
@@ -5,20 +5,12 @@
  * 2.0.
  */
 
-import { HttpFetchOptionsWithPath } from 'kibana/public';
+import { composeHttpHandlerMocks } from '../../../../common/mock/endpoint/http_handler_mock_factory';
 import {
-  composeHttpHandlerMocks,
-  httpHandlerMockFactory,
-  ResponseProvidersInterface,
-} from '../../../../common/mock/endpoint/http_handler_mock_factory';
-import {
-  GetTrustedAppsListRequest,
   GetTrustedAppsListResponse,
   PostTrustedAppCreateResponse,
 } from '../../../../../common/endpoint/types';
-import { TRUSTED_APPS_LIST_API } from '../../../../../common/endpoint/constants';
-import { TrustedAppGenerator } from '../../../../../common/endpoint/data_generators/trusted_app_generator';
-import { createSampleTrustedApps, createSampleTrustedApp } from '../../trusted_apps/test_utils';
+import { createSampleTrustedApp, createSampleTrustedApps } from '../../trusted_apps/test_utils';
 import {
   PolicyDetailsArtifactsPageListLocationParams,
   PolicyDetailsArtifactsPageLocation,
@@ -30,6 +22,10 @@ import {
   FleetGetEndpointPackagePolicyHttpMockInterface,
   fleetGetEndpointPackagePolicyListHttpMock,
   FleetGetEndpointPackagePolicyListHttpMockInterface,
+  trustedAppsGetListHttpMocks,
+  PolicyDetailsGetTrustedAppsListHttpMocksInterface,
+  trustedAppPutHttpMocks,
+  TrustedAppPutHttpMocksInterface,
 } from '../../mocks';
 
 export const getMockListResponse: () => GetTrustedAppsListResponse = () => ({
@@ -71,54 +67,17 @@ export const getAPIError = () => ({
   message: 'Something is not right',
 });
 
-type PolicyDetailsTrustedAppsHttpMocksInterface = ResponseProvidersInterface<{
-  policyTrustedAppsList: (options: HttpFetchOptionsWithPath) => GetTrustedAppsListResponse;
-}>;
-
-/**
- * HTTP mocks that support the Trusted Apps tab of the Policy Details page
- */
-export const policyDetailsTrustedAppsHttpMocks =
-  httpHandlerMockFactory<PolicyDetailsTrustedAppsHttpMocksInterface>([
-    {
-      id: 'policyTrustedAppsList',
-      path: TRUSTED_APPS_LIST_API,
-      method: 'get',
-      handler: ({ query }): GetTrustedAppsListResponse => {
-        const apiQueryParams = query as GetTrustedAppsListRequest;
-        const generator = new TrustedAppGenerator('seed');
-        const perPage = apiQueryParams.per_page ?? 10;
-        const data = Array.from({ length: Math.min(perPage, 50) }, () => generator.generate());
-
-        // Change the 3rd entry (index 2) to be policy specific
-        data[2].effectScope = {
-          type: 'policy',
-          policies: [
-            // IDs below are those generated by the `fleetGetEndpointPackagePolicyListHttpMock()` mock
-            'ddf6570b-9175-4a6d-b288-61a09771c647',
-            'b8e616ae-44fc-4be7-846c-ce8fa5c082dd',
-          ],
-        };
-
-        return {
-          page: apiQueryParams.page ?? 1,
-          per_page: perPage,
-          total: 20,
-          data,
-        };
-      },
-    },
-  ]);
-
 export type PolicyDetailsPageAllApiHttpMocksInterface =
   FleetGetEndpointPackagePolicyHttpMockInterface &
     FleetGetAgentStatusHttpMockInterface &
     FleetGetEndpointPackagePolicyListHttpMockInterface &
-    PolicyDetailsTrustedAppsHttpMocksInterface;
+    PolicyDetailsGetTrustedAppsListHttpMocksInterface &
+    TrustedAppPutHttpMocksInterface;
 export const policyDetailsPageAllApiHttpMocks =
   composeHttpHandlerMocks<PolicyDetailsPageAllApiHttpMocksInterface>([
     fleetGetEndpointPackagePolicyHttpMock,
     fleetGetAgentStatusHttpMock,
     fleetGetEndpointPackagePolicyListHttpMock,
-    policyDetailsTrustedAppsHttpMocks,
+    trustedAppsGetListHttpMocks,
+    trustedAppPutHttpMocks,
   ]);
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.test.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.test.tsx
index 83709c50b76fa5..ff94e3befe8c89 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.test.tsx
@@ -282,7 +282,7 @@ describe('when rendering the PolicyTrustedAppsList', () => {
   it('should show toast message if trusted app list api call fails', async () => {
     const error = new Error('oh no');
     // @ts-expect-error
-    mockedApis.responseProvider.policyTrustedAppsList.mockRejectedValue(error);
+    mockedApis.responseProvider.trustedAppsList.mockRejectedValue(error);
     await render(false);
     await act(async () => {
       await waitForAction('assignedTrustedAppsListStateChanged', {
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/remove_trusted_app_from_policy_modal.test.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/remove_trusted_app_from_policy_modal.test.tsx
index fc2926bc65d3a3..0411751685a902 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/remove_trusted_app_from_policy_modal.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/remove_trusted_app_from_policy_modal.test.tsx
@@ -10,7 +10,7 @@ import {
   createAppRootMockRenderer,
 } from '../../../../../../common/mock/endpoint';
 import { getPolicyDetailsArtifactsListPath } from '../../../../../common/routing';
-import { isLoadedResourceState } from '../../../../../state';
+import { isFailedResourceState, isLoadedResourceState } from '../../../../../state';
 import React from 'react';
 import { fireEvent, act } from '@testing-library/react';
 import { policyDetailsPageAllApiHttpMocks } from '../../../test_utils';
@@ -18,7 +18,10 @@ import {
   RemoveTrustedAppFromPolicyModal,
   RemoveTrustedAppFromPolicyModalProps,
 } from './remove_trusted_app_from_policy_modal';
-import { PolicyArtifactsUpdateTrustedApps } from '../../../store/policy_details/action/policy_trusted_apps_action';
+import {
+  PolicyArtifactsUpdateTrustedApps,
+  PolicyDetailsTrustedAppsRemoveListStateChanged,
+} from '../../../store/policy_details/action/policy_trusted_apps_action';
 import { Immutable } from '../../../../../../../common/endpoint/types';
 import { HttpFetchOptionsWithPath } from 'kibana/public';
 
@@ -37,10 +40,19 @@ describe('When using the RemoveTrustedAppFromPolicyModal component', () => {
     onCloseHandler = jest.fn();
     mockedApis = policyDetailsPageAllApiHttpMocks(appTestContext.coreStart.http);
     trustedApps = [
-      mockedApis.responseProvider.policyTrustedAppsList({ query: {} } as HttpFetchOptionsWithPath)
-        .data[0],
+      // The 3rd trusted app generated by the HTTP mock is a Policy Specific one
+      mockedApis.responseProvider.trustedAppsList({ query: {} } as HttpFetchOptionsWithPath)
+        .data[2],
     ];
 
+    // Delay the Update Trusted App API response so that we can test UI states while the update is underway.
+    mockedApis.responseProvider.trustedAppUpdate.mockDelay.mockImplementation(
+      () =>
+        new Promise((resolve) => {
+          setTimeout(resolve, 20);
+        })
+    );
+
     render = async (waitForLoadedState: boolean = true) => {
       const pendingDataLoadState = waitForLoadedState
         ? Promise.all([
@@ -70,19 +82,48 @@ describe('When using the RemoveTrustedAppFromPolicyModal component', () => {
     renderResult.getByTestId('confirmModalConfirmButton') as HTMLButtonElement;
 
   const clickConfirmButton = async (
-    waitForActionDispatch: boolean = false
-  ): Promise<Immutable<PolicyArtifactsUpdateTrustedApps> | undefined> => {
+    /* wait for the UI action to the store middleware to initialize the remove */
+    waitForUpdateRequestActionDispatch: boolean = false,
+    /* wait for the removal to succeed */
+    waitForRemoveSuccessActionDispatch: boolean = false
+  ): Promise<
+    Immutable<
+      Array<PolicyArtifactsUpdateTrustedApps | PolicyDetailsTrustedAppsRemoveListStateChanged>
+    >
+  > => {
     const pendingConfirmStoreAction = waitForAction('policyArtifactsUpdateTrustedApps');
+    const pendingRemoveSuccessAction = waitForAction(
+      'policyDetailsTrustedAppsRemoveListStateChanged',
+      {
+        validate({ payload }) {
+          return isLoadedResourceState(payload);
+        },
+      }
+    );
 
     act(() => {
       fireEvent.click(getConfirmButton());
     });
 
-    let response: PolicyArtifactsUpdateTrustedApps | undefined;
+    let response: Array<
+      PolicyArtifactsUpdateTrustedApps | PolicyDetailsTrustedAppsRemoveListStateChanged
+    > = [];
+
+    if (waitForUpdateRequestActionDispatch || waitForRemoveSuccessActionDispatch) {
+      const pendingActions: Array<
+        Promise<PolicyArtifactsUpdateTrustedApps | PolicyDetailsTrustedAppsRemoveListStateChanged>
+      > = [];
+
+      if (waitForUpdateRequestActionDispatch) {
+        pendingActions.push(pendingConfirmStoreAction);
+      }
+
+      if (waitForRemoveSuccessActionDispatch) {
+        pendingActions.push(pendingRemoveSuccessAction);
+      }
 
-    if (waitForActionDispatch) {
       await act(async () => {
-        response = await pendingConfirmStoreAction;
+        response = await Promise.all(pendingActions);
       });
     }
 
@@ -113,7 +154,7 @@ describe('When using the RemoveTrustedAppFromPolicyModal component', () => {
 
   it('should dispatch action when confirmed', async () => {
     await render();
-    const confirmedAction = await clickConfirmButton(true);
+    const confirmedAction = (await clickConfirmButton(true))[0];
 
     expect(confirmedAction!.payload).toEqual({
       action: 'remove',
@@ -121,17 +162,11 @@ describe('When using the RemoveTrustedAppFromPolicyModal component', () => {
     });
   });
 
-  it.skip('should disable and show loading state on confirm button while update is underway', async () => {
+  it('should disable and show loading state on confirm button while update is underway', async () => {
     await render();
     await clickConfirmButton(true);
     const confirmButton = getConfirmButton();
 
-    // FIXME:PT will finish test in a subsequent PR (issue created #1876)
-    //  GETTING ERROR:
-    //  Error: current policy id not found
-    //     //     at removeTrustedAppsFromPolicy (.../x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware/policy_trusted_apps_middleware.ts:368:13)
-    //     //     at policyTrustedAppsMiddlewareRunner (.../x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware/policy_trusted_apps_middleware.ts:93:9)
-
     expect(confirmButton.disabled).toBe(true);
     expect(confirmButton.querySelector('.euiLoadingSpinner')).not.toBeNull();
   });
@@ -141,16 +176,80 @@ describe('When using the RemoveTrustedAppFromPolicyModal component', () => {
     ['close', clickCloseButton],
   ])(
     'should prevent dialog dismissal if %s button is clicked while update is underway',
-    (__, clickButton) => {
-      // TODO: implement test
+    async (__, clickButton) => {
+      await render();
+      await clickConfirmButton(true);
+      clickButton();
+
+      expect(onCloseHandler).not.toHaveBeenCalled();
     }
   );
 
-  it.todo('should show error toast if removal failed');
+  it('should show error toast if removal failed', async () => {
+    const error = new Error('oh oh');
+    mockedApis.responseProvider.trustedAppUpdate.mockImplementation(() => {
+      throw error;
+    });
+    await render();
+    await clickConfirmButton(true);
+    await act(async () => {
+      await waitForAction('policyDetailsTrustedAppsRemoveListStateChanged', {
+        validate({ payload }) {
+          return isFailedResourceState(payload);
+        },
+      });
+    });
 
-  it.todo('should show success toast and close modal when removed is successful');
+    expect(appTestContext.coreStart.notifications.toasts.addError).toHaveBeenCalledWith(
+      expect.objectContaining({ message: expect.stringContaining('oh oh') }),
+      expect.objectContaining({ title: expect.any(String) })
+    );
+  });
 
-  it.todo('should show single removal success message');
+  it('should show success toast and close modal when removed is successful', async () => {
+    await render();
+    await clickConfirmButton(true, true);
 
-  it.todo('should show multiples removal success message');
+    expect(appTestContext.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith({
+      text: '"Avast Business Antivirus" has been removed from Endpoint Policy policy',
+      title: 'Successfully removed',
+    });
+  });
+
+  it('should show multiples removal success message', async () => {
+    trustedApps = [
+      ...trustedApps,
+      {
+        ...trustedApps[0],
+        id: '123',
+        name: 'trusted app 2',
+      },
+    ];
+
+    await render();
+    await clickConfirmButton(true, true);
+
+    expect(appTestContext.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith({
+      text: '2 trusted applications have been removed from Endpoint Policy policy',
+      title: 'Successfully removed',
+    });
+  });
+
+  it('should trigger a refresh of trusted apps list data on successful removal', async () => {
+    await render();
+    const pendingActions = Promise.all([
+      // request list refresh
+      waitForAction('policyDetailsTrustedAppsForceListDataRefresh'),
+
+      // list data refresh received
+      waitForAction('assignedTrustedAppsListStateChanged', {
+        validate({ payload }) {
+          return isLoadedResourceState(payload);
+        },
+      }),
+    ]);
+    await clickConfirmButton(true, true);
+
+    await expect(pendingActions).resolves.toHaveLength(2);
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/remove_trusted_app_from_policy_modal.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/remove_trusted_app_from_policy_modal.tsx
index c43c28ec828290..fec9ae4d7a09ba 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/remove_trusted_app_from_policy_modal.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/remove_trusted_app_from_policy_modal.tsx
@@ -48,7 +48,8 @@ export const RemoveTrustedAppFromPolicyModal = memo<RemoveTrustedAppFromPolicyMo
         return i18n.translate(
           'xpack.securitySolution.endpoint.policy.trustedApps.list.removeDialog.successMultiplesToastText',
           {
-            defaultMessage: '{count} trusted apps have been removed from {policyName} policy',
+            defaultMessage:
+              '{count} trusted applications have been removed from {policyName} policy',
             values: { count, policyName },
           }
         );
@@ -57,7 +58,7 @@ export const RemoveTrustedAppFromPolicyModal = memo<RemoveTrustedAppFromPolicyMo
       return i18n.translate(
         'xpack.securitySolution.endpoint.policy.trustedApps.list.removeDialog.successToastText',
         {
-          defaultMessage: '"{trustedAppName}" has been removed from "{policyName}" policy',
+          defaultMessage: '"{trustedAppName}" has been removed from {policyName} policy',
           values: { trustedAppName: trustedApps[0].name, policyName },
         }
       );

From dfbb397696d23274ca92f095cb014a4b2d8681a7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patryk=20Kopyci=C5=84ski?= <patryk.kopycinski@elastic.co>
Date: Thu, 14 Oct 2021 18:43:14 +0200
Subject: [PATCH 69/71] [Osquery] Fix sql query parser logic (#114932)

---
 .../queries/ecs_mapping_editor_field.tsx      | 219 +++++++++++-------
 1 file changed, 134 insertions(+), 85 deletions(-)

diff --git a/x-pack/plugins/osquery/public/scheduled_query_groups/queries/ecs_mapping_editor_field.tsx b/x-pack/plugins/osquery/public/scheduled_query_groups/queries/ecs_mapping_editor_field.tsx
index 34d7dd755e2b9c..8a5fa0e2066f26 100644
--- a/x-pack/plugins/osquery/public/scheduled_query_groups/queries/ecs_mapping_editor_field.tsx
+++ b/x-pack/plugins/osquery/public/scheduled_query_groups/queries/ecs_mapping_editor_field.tsx
@@ -6,7 +6,7 @@
  */
 
 import { produce } from 'immer';
-import { isEmpty, find, orderBy, sortedUniqBy, isArray, map } from 'lodash';
+import { each, isEmpty, find, orderBy, sortedUniqBy, isArray, map, reduce, get } from 'lodash';
 import React, {
   forwardRef,
   useCallback,
@@ -624,30 +624,47 @@ export const ECSMappingEditorField = ({ field, query, fieldRef }: ECSMappingEdit
         return currentValue;
       }
 
-      const tablesOrderMap =
-        ast?.from?.value?.reduce(
-          (
-            acc: { [x: string]: number },
-            table: { value: { alias?: { value: string }; value: { value: string } } },
-            index: number
-          ) => {
-            acc[table.value.alias?.value ?? table.value.value.value] = index;
-            return acc;
-          },
-          {}
-        ) ?? {};
-
-      const astOsqueryTables: Record<string, OsqueryColumn[]> =
+      const astOsqueryTables: Record<
+        string,
+        {
+          columns: OsqueryColumn[];
+          order: number;
+        }
+      > =
         ast?.from?.value?.reduce(
           (
-            acc: { [x: string]: OsqueryColumn[] },
-            table: { value: { alias?: { value: string }; value: { value: string } } }
-          ) => {
-            const osqueryTable = find(osquerySchema, ['name', table.value.value.value]);
-
-            if (osqueryTable) {
-              acc[table.value.alias?.value ?? table.value.value.value] = osqueryTable.columns;
+            acc: {
+              [x: string]: {
+                columns: OsqueryColumn[];
+                order: number;
+              };
+            },
+            table: {
+              value: {
+                left?: { value: { value: string }; alias?: { value: string } };
+                right?: { value: { value: string }; alias?: { value: string } };
+                value?: { value: string };
+                alias?: { value: string };
+              };
             }
+          ) => {
+            each(['value.left', 'value.right', 'value'], (valueKey) => {
+              if (valueKey) {
+                const osqueryTable = find(osquerySchema, [
+                  'name',
+                  get(table, `${valueKey}.value.value`),
+                ]);
+
+                if (osqueryTable) {
+                  acc[
+                    get(table, `${valueKey}.alias.value`) ?? get(table, `${valueKey}.value.value`)
+                  ] = {
+                    columns: osqueryTable.columns,
+                    order: Object.keys(acc).length,
+                  };
+                }
+              }
+            });
 
             return acc;
           },
@@ -659,75 +676,107 @@ export const ECSMappingEditorField = ({ field, query, fieldRef }: ECSMappingEdit
         return currentValue;
       }
 
-      /*
-        Simple query
-        select * from users;
-      */
-      if (
-        ast?.selectItems?.value?.length &&
-        ast?.selectItems?.value[0].value === '*' &&
-        ast.from?.value?.length &&
-        ast?.from.value[0].value?.value?.value &&
-        astOsqueryTables[ast.from.value[0].value.value.value]
-      ) {
-        const tableName =
-          ast.from.value[0].value.alias?.value ?? ast.from.value[0].value.value.value;
-
-        return astOsqueryTables[ast.from.value[0].value.value.value].map((osqueryColumn) => ({
-          label: osqueryColumn.name,
-          value: {
-            name: osqueryColumn.name,
-            description: osqueryColumn.description,
-            table: tableName,
-            tableOrder: tablesOrderMap[tableName],
-            suggestion_label: osqueryColumn.name,
-          },
-        }));
-      }
-
-      /*
-       Advanced query
-       select i.*, p.resident_size, p.user_time, p.system_time, time.minutes as counter from osquery_info i, processes p, time where p.pid = i.pid;
-      */
       const suggestions =
         isArray(ast?.selectItems?.value) &&
         ast?.selectItems?.value
-          // @ts-expect-error update types
-          ?.map((selectItem) => {
-            const [table, column] = selectItem.value?.split('.');
-
-            if (column === '*' && astOsqueryTables[table]) {
-              return astOsqueryTables[table].map((osqueryColumn) => ({
-                label: osqueryColumn.name,
-                value: {
-                  name: osqueryColumn.name,
-                  description: osqueryColumn.description,
-                  table,
-                  tableOrder: tablesOrderMap[table],
-                  suggestion_label: `${osqueryColumn.name}`,
-                },
-              }));
-            }
+          ?.map((selectItem: { type: string; value: string; hasAs: boolean; alias?: string }) => {
+            if (selectItem.type === 'Identifier') {
+              /*
+                select * from routes, uptime;
+              */
+              if (ast?.selectItems?.value.length === 1 && selectItem.value === '*') {
+                return reduce(
+                  astOsqueryTables,
+                  (acc, { columns: osqueryColumns, order: tableOrder }, table) => {
+                    acc.push(
+                      ...osqueryColumns.map((osqueryColumn) => ({
+                        label: osqueryColumn.name,
+                        value: {
+                          name: osqueryColumn.name,
+                          description: osqueryColumn.description,
+                          table,
+                          tableOrder,
+                          suggestion_label: osqueryColumn.name,
+                        },
+                      }))
+                    );
+                    return acc;
+                  },
+                  [] as OsquerySchemaOption[]
+                );
+              }
 
-            if (astOsqueryTables && astOsqueryTables[table]) {
-              const osqueryColumn = find(astOsqueryTables[table], ['name', column]);
-
-              if (osqueryColumn) {
-                const label = selectItem.hasAs ? selectItem.alias : column;
-
-                return [
-                  {
-                    label,
-                    value: {
-                      name: osqueryColumn.name,
-                      description: osqueryColumn.description,
-                      table,
-                      tableOrder: tablesOrderMap[table],
-                      suggestion_label: `${label}`,
-                    },
+              /*
+                select i.*, p.resident_size, p.user_time, p.system_time, time.minutes as counter from osquery_info i, processes p, time where p.pid = i.pid;
+              */
+
+              const [table, column] = selectItem.value.includes('.')
+                ? selectItem.value?.split('.')
+                : [Object.keys(astOsqueryTables)[0], selectItem.value];
+
+              if (column === '*' && astOsqueryTables[table]) {
+                const { columns: osqueryColumns, order: tableOrder } = astOsqueryTables[table];
+                return osqueryColumns.map((osqueryColumn) => ({
+                  label: osqueryColumn.name,
+                  value: {
+                    name: osqueryColumn.name,
+                    description: osqueryColumn.description,
+                    table,
+                    tableOrder,
+                    suggestion_label: `${osqueryColumn.name}`,
                   },
-                ];
+                }));
               }
+
+              if (astOsqueryTables[table]) {
+                const osqueryColumn = find(astOsqueryTables[table].columns, ['name', column]);
+
+                if (osqueryColumn) {
+                  const label = selectItem.hasAs ? selectItem.alias : column;
+
+                  return [
+                    {
+                      label,
+                      value: {
+                        name: osqueryColumn.name,
+                        description: osqueryColumn.description,
+                        table,
+                        tableOrder: astOsqueryTables[table].order,
+                        suggestion_label: `${label}`,
+                      },
+                    },
+                  ];
+                }
+              }
+            }
+
+            /*
+              SELECT pid, uid, name, ROUND((
+                (user_time + system_time) / (cpu_time.tsb - cpu_time.itsb)
+              ) * 100, 2) AS percentage
+              FROM processes, (
+              SELECT (
+                SUM(user) + SUM(nice) + SUM(system) + SUM(idle) * 1.0) AS tsb,
+                SUM(COALESCE(idle, 0)) + SUM(COALESCE(iowait, 0)) AS itsb
+                FROM cpu_time
+              ) AS cpu_time
+              ORDER BY user_time+system_time DESC
+              LIMIT 5;
+            */
+
+            if (selectItem.type === 'FunctionCall' && selectItem.hasAs) {
+              return [
+                {
+                  label: selectItem.alias,
+                  value: {
+                    name: selectItem.alias,
+                    description: '',
+                    table: '',
+                    tableOrder: -1,
+                    suggestion_label: selectItem.alias,
+                  },
+                },
+              ];
             }
 
             return [];

From e4e7a1ced14565923a5948f2f985c90c21a46bc5 Mon Sep 17 00:00:00 2001
From: Dominique Clarke <doclarke71@gmail.com>
Date: Thu, 14 Oct 2021 12:43:39 -0400
Subject: [PATCH 70/71] [Observability] [Exploratory view] remove the filter
 buttons from the exploratory view legend (#114908)

---
 .../components/shared/exploratory_view/exploratory_view.tsx   | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/exploratory_view.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/exploratory_view.tsx
index 9870d88d1220ad..f3f332b5094b63 100644
--- a/x-pack/plugins/observability/public/components/shared/exploratory_view/exploratory_view.tsx
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/exploratory_view.tsx
@@ -183,6 +183,10 @@ const Wrapper = styled(EuiPanel)`
   width: 100%;
   overflow-x: auto;
   position: relative;
+
+  .echLegendItem__action {
+    display: none;
+  }
 `;
 
 const ShowPreview = styled(EuiButtonEmpty)`

From d0e19e49602b92abd1c255ed51eebfc578c21c5d Mon Sep 17 00:00:00 2001
From: Marco Liberati <dej611@users.noreply.github.com>
Date: Thu, 14 Oct 2021 18:45:31 +0200
Subject: [PATCH 71/71] [Lens][Inspector] Close the inspector on Lens unmount
 (#114317)

* :bug: First attempt to close the inspector automatically on app unmount

* :ok_hand: Integrate feedback

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../__snapshots__/app.test.tsx.snap           | 35 ++-----------------
 .../lens/public/app_plugin/app.test.tsx       |  2 +-
 x-pack/plugins/lens/public/app_plugin/app.tsx |  6 ++--
 .../lens/public/app_plugin/mounter.tsx        |  4 ++-
 .../plugins/lens/public/app_plugin/types.ts   |  3 +-
 .../lens/public/lens_inspector_service.ts     | 13 ++++++-
 x-pack/plugins/lens/public/mocks.tsx          |  7 +++-
 x-pack/test/functional/apps/lens/inspector.ts |  6 ++++
 8 files changed, 33 insertions(+), 43 deletions(-)

diff --git a/x-pack/plugins/lens/public/app_plugin/__snapshots__/app.test.tsx.snap b/x-pack/plugins/lens/public/app_plugin/__snapshots__/app.test.tsx.snap
index 51adf7737fd4b9..ca14bc908eb80d 100644
--- a/x-pack/plugins/lens/public/app_plugin/__snapshots__/app.test.tsx.snap
+++ b/x-pack/plugins/lens/public/app_plugin/__snapshots__/app.test.tsx.snap
@@ -28,39 +28,8 @@ Array [
             Symbol(kCapture): false,
           },
         },
-        "inspect": [Function],
-      },
-      "showNoDataPopover": [Function],
-    },
-    Object {},
-  ],
-  Array [
-    Object {
-      "lensInspector": Object {
-        "adapters": Object {
-          "expression": ExpressionsInspectorAdapter {
-            "_ast": Object {},
-            "_events": Object {},
-            "_eventsCount": 0,
-            "_maxListeners": undefined,
-            Symbol(kCapture): false,
-          },
-          "requests": RequestAdapter {
-            "_events": Object {},
-            "_eventsCount": 0,
-            "_maxListeners": undefined,
-            "requests": Map {},
-            Symbol(kCapture): false,
-          },
-          "tables": TablesAdapter {
-            "_events": Object {},
-            "_eventsCount": 0,
-            "_maxListeners": undefined,
-            "_tables": Object {},
-            Symbol(kCapture): false,
-          },
-        },
-        "inspect": [Function],
+        "close": [MockFunction],
+        "inspect": [MockFunction],
       },
       "showNoDataPopover": [Function],
     },
diff --git a/x-pack/plugins/lens/public/app_plugin/app.test.tsx b/x-pack/plugins/lens/public/app_plugin/app.test.tsx
index 0b800940e17871..b55d424c0db484 100644
--- a/x-pack/plugins/lens/public/app_plugin/app.test.tsx
+++ b/x-pack/plugins/lens/public/app_plugin/app.test.tsx
@@ -812,7 +812,7 @@ describe('Lens App', () => {
 
       await runInspect(instance);
 
-      expect(services.inspector.open).toHaveBeenCalledTimes(1);
+      expect(services.inspector.inspect).toHaveBeenCalledTimes(1);
     });
   });
 
diff --git a/x-pack/plugins/lens/public/app_plugin/app.tsx b/x-pack/plugins/lens/public/app_plugin/app.tsx
index ae2edaa1b98d31..5638a35d1cc6d3 100644
--- a/x-pack/plugins/lens/public/app_plugin/app.tsx
+++ b/x-pack/plugins/lens/public/app_plugin/app.tsx
@@ -37,7 +37,7 @@ import {
   getLastKnownDocWithoutPinnedFilters,
   runSaveLensVisualization,
 } from './save_modal_container';
-import { getLensInspectorService, LensInspector } from '../lens_inspector_service';
+import { LensInspector } from '../lens_inspector_service';
 import { getEditPath } from '../../common';
 
 export type SaveProps = Omit<OnSaveProps, 'onTitleDuplicate' | 'newDescription'> & {
@@ -66,7 +66,7 @@ export function App({
     data,
     chrome,
     uiSettings,
-    inspector,
+    inspector: lensInspector,
     application,
     notifications,
     savedObjectsTagging,
@@ -101,8 +101,6 @@ export function App({
   const [isSaveModalVisible, setIsSaveModalVisible] = useState(false);
   const [lastKnownDoc, setLastKnownDoc] = useState<Document | undefined>(undefined);
 
-  const lensInspector = getLensInspectorService(inspector);
-
   useEffect(() => {
     if (currentDoc) {
       setLastKnownDoc(currentDoc);
diff --git a/x-pack/plugins/lens/public/app_plugin/mounter.tsx b/x-pack/plugins/lens/public/app_plugin/mounter.tsx
index 22b345a64fa22a..d4bc59a1e9e2ca 100644
--- a/x-pack/plugins/lens/public/app_plugin/mounter.tsx
+++ b/x-pack/plugins/lens/public/app_plugin/mounter.tsx
@@ -41,6 +41,7 @@ import {
   LensState,
 } from '../state_management';
 import { getPreloadedState } from '../state_management/lens_slice';
+import { getLensInspectorService } from '../lens_inspector_service';
 
 export async function getLensServices(
   coreStart: CoreStart,
@@ -65,7 +66,7 @@ export async function getLensServices(
   return {
     data,
     storage,
-    inspector,
+    inspector: getLensInspectorService(inspector),
     navigation,
     fieldFormats,
     stateTransfer,
@@ -278,6 +279,7 @@ export async function mountApp(
   return () => {
     data.search.session.clear();
     unmountComponentAtNode(params.element);
+    lensServices.inspector.close();
     unlistenParentHistory();
     lensStore.dispatch(navigateAway());
   };
diff --git a/x-pack/plugins/lens/public/app_plugin/types.ts b/x-pack/plugins/lens/public/app_plugin/types.ts
index 8a3a848ffa204c..a5cd8bfef71f35 100644
--- a/x-pack/plugins/lens/public/app_plugin/types.ts
+++ b/x-pack/plugins/lens/public/app_plugin/types.ts
@@ -21,7 +21,6 @@ import type {
 import type { DataPublicPluginStart } from '../../../../../src/plugins/data/public';
 import type { UsageCollectionStart } from '../../../../../src/plugins/usage_collection/public';
 import type { DashboardStart } from '../../../../../src/plugins/dashboard/public';
-import type { Start as InspectorStart } from '../../../../../src/plugins/inspector/public';
 import type { LensEmbeddableInput } from '../embeddable/embeddable';
 import type { NavigationPublicPluginStart } from '../../../../../src/plugins/navigation/public';
 import type { LensAttributeService } from '../lens_attribute_service';
@@ -105,7 +104,7 @@ export interface LensAppServices {
   dashboard: DashboardStart;
   fieldFormats: FieldFormatsStart;
   data: DataPublicPluginStart;
-  inspector: InspectorStart;
+  inspector: LensInspector;
   uiSettings: IUiSettingsClient;
   application: ApplicationStart;
   notifications: NotificationsStart;
diff --git a/x-pack/plugins/lens/public/lens_inspector_service.ts b/x-pack/plugins/lens/public/lens_inspector_service.ts
index d9573962f12d42..6cac381871d73d 100644
--- a/x-pack/plugins/lens/public/lens_inspector_service.ts
+++ b/x-pack/plugins/lens/public/lens_inspector_service.ts
@@ -8,6 +8,7 @@
 import type {
   Adapters,
   InspectorOptions,
+  InspectorSession,
   Start as InspectorStartContract,
 } from '../../../../src/plugins/inspector/public';
 
@@ -15,9 +16,19 @@ import { createDefaultInspectorAdapters } from '../../../../src/plugins/expressi
 
 export const getLensInspectorService = (inspector: InspectorStartContract) => {
   const adapters: Adapters = createDefaultInspectorAdapters();
+  let overlayRef: InspectorSession | undefined;
   return {
     adapters,
-    inspect: (options?: InspectorOptions) => inspector.open(adapters, options),
+    inspect: (options?: InspectorOptions) => {
+      overlayRef = inspector.open(adapters, options);
+      overlayRef.onClose.then(() => {
+        if (overlayRef) {
+          overlayRef = undefined;
+        }
+      });
+      return overlayRef;
+    },
+    close: () => overlayRef?.close(),
   };
 };
 
diff --git a/x-pack/plugins/lens/public/mocks.tsx b/x-pack/plugins/lens/public/mocks.tsx
index 3b48c13f2585ab..989c858b1f29d5 100644
--- a/x-pack/plugins/lens/public/mocks.tsx
+++ b/x-pack/plugins/lens/public/mocks.tsx
@@ -56,6 +56,7 @@ import {
   DatasourceMap,
   VisualizationMap,
 } from './types';
+import { getLensInspectorService } from './lens_inspector_service';
 
 export function mockDatasourceStates() {
   return {
@@ -417,7 +418,11 @@ export function makeDefaultServices(
     navigation: navigationStartMock,
     notifications: core.notifications,
     attributeService: makeAttributeService(),
-    inspector: inspectorPluginMock.createStartContract(),
+    inspector: {
+      adapters: getLensInspectorService(inspectorPluginMock.createStartContract()).adapters,
+      inspect: jest.fn(),
+      close: jest.fn(),
+    },
     dashboard: dashboardPluginMock.createStartContract(),
     presentationUtil: presentationUtilPluginMock.createStartContract(core),
     savedObjectsClient: core.savedObjects.client,
diff --git a/x-pack/test/functional/apps/lens/inspector.ts b/x-pack/test/functional/apps/lens/inspector.ts
index 0783124079d4c1..9db804d324936b 100644
--- a/x-pack/test/functional/apps/lens/inspector.ts
+++ b/x-pack/test/functional/apps/lens/inspector.ts
@@ -11,6 +11,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const PageObjects = getPageObjects(['visualize', 'lens', 'common', 'header']);
   const elasticChart = getService('elasticChart');
   const inspector = getService('inspector');
+  const testSubjects = getService('testSubjects');
 
   describe('lens inspector', () => {
     before(async () => {
@@ -55,5 +56,10 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await inspector.openInspectorRequestsView();
       expect(await inspector.getRequestNames()).to.be('Data,Other bucket');
     });
+
+    it('should close the inspector when navigating away from Lens', async () => {
+      await PageObjects.visualize.navigateToNewVisualization();
+      expect(await testSubjects.exists('inspectorPanel')).to.be(false);
+    });
   });
 }