diff --git a/docs/migration/migrate_8_0.asciidoc b/docs/migration/migrate_8_0.asciidoc
index 555d479d860e1d..4c0c335b3c33eb 100644
--- a/docs/migration/migrate_8_0.asciidoc
+++ b/docs/migration/migrate_8_0.asciidoc
@@ -344,4 +344,24 @@ The output directory after extracting an archive no longer includes the target p
 *Impact:*
 Configuration management tools and automation will need to be updated to use the new directory.
 
+[float]
+=== `elasticsearch.preserveHost` is no longer valid
+*Details:* The deprecated `elasticsearch.preserveHost` setting in the `kibana.yml` file has been removed.
+
+*Impact:* Configure {kibana-ref}/settings.html#elasticsearch-requestHeadersWhitelist[`elasticsearch.requestHeadersWhitelist`] to whitelist client-side headers.
+
+[float]
+=== `elasticsearch.startupTimeout` is no longer valid
+*Details:* The deprecated `elasticsearch.startupTimeout` setting in the `kibana.yml` file has been removed.
+
+*Impact:* Kibana will keep on trying to connect to Elasticsearch until it manages to connect.
+
+[float]
+=== `savedObjects.indexCheckTimeout` is no longer valid
+*Details:* The deprecated `savedObjects.indexCheckTimeout` setting in the `kibana.yml` file has been removed.
+
+[float]
+=== `server.xsrf.token` is no longer valid
+*Details:* The deprecated `server.xsrf.token` setting in the `kibana.yml` file has been removed.
+
 // end::notable-breaking-changes[]
diff --git a/package.json b/package.json
index 8f329b4c548861..c2b30ef7ef1509 100644
--- a/package.json
+++ b/package.json
@@ -96,9 +96,9 @@
     "@elastic/apm-rum-react": "^1.3.1",
     "@elastic/charts": "34.2.1",
     "@elastic/datemath": "link:bazel-bin/packages/elastic-datemath",
-    "@elastic/elasticsearch": "npm:@elastic/elasticsearch-canary@^8.0.0-canary.20",
+    "@elastic/elasticsearch": "npm:@elastic/elasticsearch-canary@^8.0.0-canary.21",
     "@elastic/ems-client": "7.15.0",
-    "@elastic/eui": "37.6.0",
+    "@elastic/eui": "38.0.1",
     "@elastic/filesaver": "1.1.2",
     "@elastic/good": "^9.0.1-kibana3",
     "@elastic/maki": "6.3.0",
@@ -266,6 +266,7 @@
     "js-levenshtein": "^1.1.6",
     "js-search": "^1.4.3",
     "js-sha256": "^0.9.0",
+    "js-sql-parser": "^1.4.1",
     "js-yaml": "^3.14.0",
     "json-stable-stringify": "^1.0.1",
     "json-stringify-pretty-compact": "1.2.0",
@@ -298,7 +299,6 @@
     "nock": "12.0.3",
     "node-fetch": "^2.6.1",
     "node-forge": "^0.10.0",
-    "node-sql-parser": "^3.6.1",
     "nodemailer": "^6.6.2",
     "normalize-path": "^3.0.0",
     "object-hash": "^1.3.1",
diff --git a/src/core/public/chrome/ui/header/__snapshots__/header.test.tsx.snap b/src/core/public/chrome/ui/header/__snapshots__/header.test.tsx.snap
index 4450533090c7fc..e73d5e8002a029 100644
--- a/src/core/public/chrome/ui/header/__snapshots__/header.test.tsx.snap
+++ b/src/core/public/chrome/ui/header/__snapshots__/header.test.tsx.snap
@@ -4267,7 +4267,7 @@ exports[`Header renders 1`] = `
                     }
                     button={
                       <EuiHeaderSectionItemButton
-                        aria-controls="mockId"
+                        aria-controls="generated-id"
                         aria-expanded={false}
                         aria-label="Toggle primary navigation"
                         aria-pressed={false}
@@ -4337,7 +4337,7 @@ exports[`Header renders 1`] = `
                       }
                     }
                     homeHref="/"
-                    id="mockId"
+                    id="generated-id"
                     isLocked={true}
                     isNavOpen={false}
                     navLinks$={
@@ -4497,7 +4497,7 @@ exports[`Header renders 1`] = `
                       aria-label="Primary"
                       button={
                         <EuiHeaderSectionItemButton
-                          aria-controls="mockId"
+                          aria-controls="generated-id"
                           aria-expanded={false}
                           aria-label="Toggle primary navigation"
                           aria-pressed={false}
@@ -4511,14 +4511,14 @@ exports[`Header renders 1`] = `
                         </EuiHeaderSectionItemButton>
                       }
                       data-test-subj="collapsibleNav"
-                      id="mockId"
+                      id="generated-id"
                       isOpen={false}
                       onClose={[Function]}
                       ownFocus={false}
                       size={248}
                     >
                       <EuiHeaderSectionItemButton
-                        aria-controls="mockId"
+                        aria-controls="generated-id"
                         aria-expanded={false}
                         aria-label="Toggle primary navigation"
                         aria-pressed={false}
@@ -4528,14 +4528,14 @@ exports[`Header renders 1`] = `
                         onTouchEnd={[Function]}
                       >
                         <EuiButtonEmpty
-                          aria-controls="mockId"
+                          aria-controls="generated-id"
                           aria-expanded={false}
                           aria-label="Toggle primary navigation"
                           aria-pressed={false}
                           buttonRef={
                             Object {
                               "current": <button
-                                aria-controls="mockId"
+                                aria-controls="generated-id"
                                 aria-expanded="false"
                                 aria-label="Toggle primary navigation"
                                 aria-pressed="false"
@@ -4569,7 +4569,7 @@ exports[`Header renders 1`] = `
                           onTouchEnd={[Function]}
                         >
                           <button
-                            aria-controls="mockId"
+                            aria-controls="generated-id"
                             aria-expanded={false}
                             aria-label="Toggle primary navigation"
                             aria-pressed={false}
diff --git a/src/core/public/chrome/ui/header/header.test.tsx b/src/core/public/chrome/ui/header/header.test.tsx
index a3a0197b4017e0..2692f2dbd194f0 100644
--- a/src/core/public/chrome/ui/header/header.test.tsx
+++ b/src/core/public/chrome/ui/header/header.test.tsx
@@ -15,10 +15,6 @@ import { applicationServiceMock } from '../../../mocks';
 import { Header } from './header';
 import { ChromeBreadcrumbsAppendExtension } from '../../types';
 
-jest.mock('@elastic/eui/lib/services/accessibility/html_id_generator', () => ({
-  htmlIdGenerator: () => () => 'mockId',
-}));
-
 function mockProps() {
   const http = httpServiceMock.createSetupContract({ basePath: '/test' });
   const application = applicationServiceMock.createInternalStartContract();
diff --git a/src/core/public/saved_objects/saved_objects_client.test.ts b/src/core/public/saved_objects/saved_objects_client.test.ts
index 0f37d10b3f32d9..101f86b299ffc3 100644
--- a/src/core/public/saved_objects/saved_objects_client.test.ts
+++ b/src/core/public/saved_objects/saved_objects_client.test.ts
@@ -148,13 +148,15 @@ describe('SavedObjectsClient', () => {
   });
 
   describe('#resolve', () => {
-    beforeEach(() => {
+    function mockResolvedObjects(...objects: Array<Record<string, unknown>>) {
       http.fetch.mockResolvedValue({
-        resolved_objects: [
-          { saved_object: doc, outcome: 'conflict', alias_target_id: 'another-id' },
-        ],
+        resolved_objects: objects.map((obj) => ({
+          saved_object: obj,
+          outcome: 'conflict',
+          alias_target_id: 'another-id',
+        })),
       });
-    });
+    }
 
     test('rejects if `type` parameter is undefined', () => {
       return expect(
@@ -176,6 +178,7 @@ describe('SavedObjectsClient', () => {
     });
 
     test('makes HTTP call', async () => {
+      mockResolvedObjects(doc);
       await savedObjectsClient.resolve(doc.type, doc.id);
       expect(http.fetch.mock.calls[0]).toMatchInlineSnapshot(`
         Array [
@@ -191,10 +194,12 @@ describe('SavedObjectsClient', () => {
 
     test('batches several #resolve calls into a single HTTP call', async () => {
       // Await #resolve call to ensure batchQueue is empty and throttle has reset
+      mockResolvedObjects({ ...doc, type: 'type2' });
       await savedObjectsClient.resolve('type2', doc.id);
       http.fetch.mockClear();
 
       // Make two #resolve calls right after one another
+      mockResolvedObjects({ ...doc, type: 'type1' }, { ...doc, type: 'type0' });
       savedObjectsClient.resolve('type1', doc.id);
       await savedObjectsClient.resolve('type0', doc.id);
       expect(http.fetch.mock.calls).toMatchInlineSnapshot(`
@@ -213,9 +218,11 @@ describe('SavedObjectsClient', () => {
 
     test('removes duplicates when calling `_bulk_resolve`', async () => {
       // Await #resolve call to ensure batchQueue is empty and throttle has reset
+      mockResolvedObjects({ ...doc, type: 'type2' });
       await savedObjectsClient.resolve('type2', doc.id);
       http.fetch.mockClear();
 
+      mockResolvedObjects(doc, { ...doc, type: 'some-type', id: 'some-id' }); // the client will only request two objects, so we only mock two results
       savedObjectsClient.resolve(doc.type, doc.id);
       savedObjectsClient.resolve('some-type', 'some-id');
       await savedObjectsClient.resolve(doc.type, doc.id);
@@ -235,9 +242,11 @@ describe('SavedObjectsClient', () => {
 
     test('resolves with correct object when there are duplicates present', async () => {
       // Await #resolve call to ensure batchQueue is empty and throttle has reset
+      mockResolvedObjects({ ...doc, type: 'type2' });
       await savedObjectsClient.resolve('type2', doc.id);
       http.fetch.mockClear();
 
+      mockResolvedObjects(doc);
       const call1 = savedObjectsClient.resolve(doc.type, doc.id);
       const objFromCall2 = await savedObjectsClient.resolve(doc.type, doc.id);
       const objFromCall1 = await call1;
@@ -252,8 +261,10 @@ describe('SavedObjectsClient', () => {
     test('do not share instances or references between duplicate callers', async () => {
       // Await #resolve call to ensure batchQueue is empty and throttle has reset
       await savedObjectsClient.resolve('type2', doc.id);
+      mockResolvedObjects({ ...doc, type: 'type2' });
       http.fetch.mockClear();
 
+      mockResolvedObjects(doc);
       const call1 = savedObjectsClient.resolve(doc.type, doc.id);
       const objFromCall2 = await savedObjectsClient.resolve(doc.type, doc.id);
       const objFromCall1 = await call1;
@@ -263,6 +274,7 @@ describe('SavedObjectsClient', () => {
     });
 
     test('resolves with ResolvedSimpleSavedObject instance', async () => {
+      mockResolvedObjects(doc);
       const result = await savedObjectsClient.resolve(doc.type, doc.id);
       expect(result.saved_object).toBeInstanceOf(SimpleSavedObject);
       expect(result.saved_object.type).toBe(doc.type);
diff --git a/src/core/public/saved_objects/saved_objects_client.ts b/src/core/public/saved_objects/saved_objects_client.ts
index 218ffb94dd5d4a..0b0bc58729e3fe 100644
--- a/src/core/public/saved_objects/saved_objects_client.ts
+++ b/src/core/public/saved_objects/saved_objects_client.ts
@@ -151,9 +151,7 @@ interface ObjectTypeAndId {
   type: string;
 }
 
-const getObjectsToFetch = (
-  queue: Array<BatchGetQueueEntry | BatchResolveQueueEntry>
-): ObjectTypeAndId[] => {
+const getObjectsToFetch = (queue: BatchGetQueueEntry[]): ObjectTypeAndId[] => {
   const objects: ObjectTypeAndId[] = [];
   const inserted = new Set<string>();
   queue.forEach(({ id, type }) => {
@@ -165,6 +163,24 @@ const getObjectsToFetch = (
   return objects;
 };
 
+const getObjectsToResolve = (queue: BatchResolveQueueEntry[]) => {
+  const responseIndices: number[] = [];
+  const objectsToResolve: ObjectTypeAndId[] = [];
+  const inserted = new Map<string, number>();
+  queue.forEach(({ id, type }, currentIndex) => {
+    const key = `${type}|${id}`;
+    const indexForTypeAndId = inserted.get(key);
+    if (indexForTypeAndId === undefined) {
+      inserted.set(key, currentIndex);
+      objectsToResolve.push({ id, type });
+      responseIndices.push(currentIndex);
+    } else {
+      responseIndices.push(indexForTypeAndId);
+    }
+  });
+  return { objectsToResolve, responseIndices };
+};
+
 /**
  * Saved Objects is Kibana's data persisentence mechanism allowing plugins to
  * use Elasticsearch for storing plugin state. The client-side
@@ -224,28 +240,18 @@ export class SavedObjectsClient {
       this.batchResolveQueue = [];
 
       try {
-        const objectsToFetch = getObjectsToFetch(queue);
-        const { resolved_objects: savedObjects } = await this.performBulkResolve(objectsToFetch);
-
-        queue.forEach((queueItem) => {
-          const foundObject = savedObjects.find((resolveResponse) => {
-            return (
-              resolveResponse.saved_object.id === queueItem.id &&
-              resolveResponse.saved_object.type === queueItem.type
-            );
-          });
-
-          if (foundObject) {
-            // multiple calls may have been requested the same object.
-            // we need to clone to avoid sharing references between the instances
-            queueItem.resolve(this.createResolvedSavedObject(cloneDeep(foundObject)));
-          } else {
-            queueItem.resolve(
-              this.createResolvedSavedObject({
-                saved_object: pick(queueItem, ['id', 'type']),
-              } as SavedObjectsResolveResponse)
-            );
-          }
+        const { objectsToResolve, responseIndices } = getObjectsToResolve(queue);
+        const { resolved_objects: resolvedObjects } = await this.performBulkResolve(
+          objectsToResolve
+        );
+
+        queue.forEach((queueItem, i) => {
+          // This differs from the older processBatchGetQueue approach because the resolved object IDs are *not* guaranteed to be the same.
+          // Instead, we rely on the guarantee that the objects in the bulkResolve response will be in the same order as the requests.
+          // However, we still need to clone the response object because we deduplicate batched requests.
+          const responseIndex = responseIndices[i];
+          const clone = cloneDeep(resolvedObjects[responseIndex]);
+          queueItem.resolve(this.createResolvedSavedObject(clone));
         });
       } catch (err) {
         queue.forEach((queueItem) => {
diff --git a/src/core/server/saved_objects/migrationsv2/actions/integration_tests/actions.test.ts b/src/core/server/saved_objects/migrationsv2/actions/integration_tests/actions.test.ts
index efe1dc018a1749..21e99d83443f6b 100644
--- a/src/core/server/saved_objects/migrationsv2/actions/integration_tests/actions.test.ts
+++ b/src/core/server/saved_objects/migrationsv2/actions/integration_tests/actions.test.ts
@@ -422,8 +422,7 @@ describe('migration actions', () => {
 
   // Reindex doesn't return any errors on it's own, so we have to test
   // together with waitForReindexTask
-  // FLAKY: https://github.com/elastic/kibana/issues/103231
-  describe.skip('reindex & waitForReindexTask', () => {
+  describe('reindex & waitForReindexTask', () => {
     it('resolves right when reindex succeeds without reindex script', async () => {
       const res = (await reindex({
         client,
@@ -792,6 +791,11 @@ describe('migration actions', () => {
               `);
     });
     it('resolves left wait_for_task_completion_timeout when the task does not finish within the timeout', async () => {
+      await waitForIndexStatusYellow({
+        client,
+        index: '.kibana_1',
+      })();
+
       const res = (await reindex({
         client,
         sourceIndex: '.kibana_1',
diff --git a/src/dev/license_checker/config.ts b/src/dev/license_checker/config.ts
index addedbb97f55ae..b996ae0167555a 100644
--- a/src/dev/license_checker/config.ts
+++ b/src/dev/license_checker/config.ts
@@ -73,9 +73,8 @@ export const DEV_ONLY_LICENSE_ALLOWED = ['MPL-2.0'];
 export const LICENSE_OVERRIDES = {
   'jsts@1.6.2': ['Eclipse Distribution License - v 1.0'], // cf. https://github.com/bjornharrtell/jsts
   '@mapbox/jsonlint-lines-primitives@2.0.2': ['MIT'], // license in readme https://github.com/tmcw/jsonlint
-  'node-sql-parser@3.6.1': ['(GPL-2.0 OR MIT)'], // GPL-2.0* https://github.com/taozhi8833998/node-sql-parser
   '@elastic/ems-client@7.15.0': ['Elastic License 2.0'],
-  '@elastic/eui@37.6.0': ['SSPL-1.0 OR Elastic License 2.0'],
+  '@elastic/eui@38.0.1': ['SSPL-1.0 OR Elastic License 2.0'],
 
   // TODO can be removed if the https://github.com/jindw/xmldom/issues/239 is released
   'xmldom@0.1.27': ['MIT'],
diff --git a/src/plugins/custom_integrations/common/index.ts b/src/plugins/custom_integrations/common/index.ts
index 24ed44f3e5cfe7..48f31cb0bcb0c5 100755
--- a/src/plugins/custom_integrations/common/index.ts
+++ b/src/plugins/custom_integrations/common/index.ts
@@ -46,6 +46,11 @@ export const CATEGORY_DISPLAY = {
 
 export type Category = keyof typeof CATEGORY_DISPLAY;
 
+export interface CustomIntegrationIcon {
+  src: string;
+  type: 'eui' | 'svg';
+}
+
 export interface CustomIntegration {
   id: string;
   title: string;
@@ -53,7 +58,7 @@ export interface CustomIntegration {
   type: 'ui_link';
   uiInternalPath: string;
   isBeta: boolean;
-  icons: Array<{ src: string; type: string }>;
+  icons: CustomIntegrationIcon[];
   categories: Category[];
   shipper: string;
 }
diff --git a/src/plugins/custom_integrations/server/mocks.ts b/src/plugins/custom_integrations/server/mocks.ts
index 661c7e567aef66..1846885192853b 100644
--- a/src/plugins/custom_integrations/server/mocks.ts
+++ b/src/plugins/custom_integrations/server/mocks.ts
@@ -6,17 +6,15 @@
  * Side Public License, v 1.
  */
 
-import type { MockedKeys } from '@kbn/utility-types/jest';
-
 import { CustomIntegrationsPluginSetup } from '../server';
 
-function createCustomIntegrationsSetup(): MockedKeys<CustomIntegrationsPluginSetup> {
-  const mock = {
+function createCustomIntegrationsSetup(): jest.Mocked<CustomIntegrationsPluginSetup> {
+  const mock: jest.Mocked<CustomIntegrationsPluginSetup> = {
     registerCustomIntegration: jest.fn(),
     getAppendCustomIntegrations: jest.fn(),
   };
 
-  return mock as MockedKeys<CustomIntegrationsPluginSetup>;
+  return mock;
 }
 
 export const customIntegrationsMock = {
diff --git a/src/plugins/dashboard/kibana.json b/src/plugins/dashboard/kibana.json
index 164be971d22b77..d13b833790a226 100644
--- a/src/plugins/dashboard/kibana.json
+++ b/src/plugins/dashboard/kibana.json
@@ -10,7 +10,6 @@
     "data",
     "embeddable",
     "inspector",
-    "kibanaLegacy",
     "navigation",
     "savedObjects",
     "share",
diff --git a/src/plugins/dashboard/public/plugin.tsx b/src/plugins/dashboard/public/plugin.tsx
index d4e4de2558678b..496526c08ece8d 100644
--- a/src/plugins/dashboard/public/plugin.tsx
+++ b/src/plugins/dashboard/public/plugin.tsx
@@ -31,7 +31,6 @@ import { createKbnUrlTracker } from './services/kibana_utils';
 import { UsageCollectionSetup } from './services/usage_collection';
 import { UiActionsSetup, UiActionsStart } from './services/ui_actions';
 import { PresentationUtilPluginStart } from './services/presentation_util';
-import { KibanaLegacySetup, KibanaLegacyStart } from './services/kibana_legacy';
 import { FeatureCatalogueCategory, HomePublicPluginSetup } from './services/home';
 import { NavigationPublicPluginStart as NavigationStart } from './services/navigation';
 import { DataPublicPluginSetup, DataPublicPluginStart, esFilters } from './services/data';
@@ -98,7 +97,6 @@ export interface DashboardSetupDependencies {
   data: DataPublicPluginSetup;
   embeddable: EmbeddableSetup;
   home?: HomePublicPluginSetup;
-  kibanaLegacy: KibanaLegacySetup;
   urlForwarding: UrlForwardingSetup;
   share?: SharePluginSetup;
   uiActions: UiActionsSetup;
@@ -107,7 +105,6 @@ export interface DashboardSetupDependencies {
 
 export interface DashboardStartDependencies {
   data: DataPublicPluginStart;
-  kibanaLegacy: KibanaLegacyStart;
   urlForwarding: UrlForwardingStart;
   embeddable: EmbeddableStart;
   inspector: InspectorStartContract;
diff --git a/src/plugins/dashboard/public/services/kibana_legacy.ts b/src/plugins/dashboard/public/services/kibana_legacy.ts
deleted file mode 100644
index 247ee2c49d87b6..00000000000000
--- a/src/plugins/dashboard/public/services/kibana_legacy.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-export { KibanaLegacySetup, KibanaLegacyStart } from '../../../kibana_legacy/public';
diff --git a/src/plugins/dashboard/tsconfig.json b/src/plugins/dashboard/tsconfig.json
index 7558ade4705bed..78a1958a431564 100644
--- a/src/plugins/dashboard/tsconfig.json
+++ b/src/plugins/dashboard/tsconfig.json
@@ -16,7 +16,6 @@
   "references": [
     { "path": "../../core/tsconfig.json" },
     { "path": "../inspector/tsconfig.json" },
-    { "path": "../kibana_legacy/tsconfig.json" },
     { "path": "../kibana_react/tsconfig.json" },
     { "path": "../kibana_utils/tsconfig.json" },
     { "path": "../share/tsconfig.json" },
diff --git a/src/plugins/home/public/assets/sample_data_resources/ecommerce/icon.svg b/src/plugins/home/public/assets/sample_data_resources/ecommerce/icon.svg
new file mode 100644
index 00000000000000..ae2acbbfecb2a7
--- /dev/null
+++ b/src/plugins/home/public/assets/sample_data_resources/ecommerce/icon.svg
@@ -0,0 +1,6 @@
+<svg width="34" height="32" viewBox="0 0 34 32" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M2.00024 22C2.47508 22.2862 3.49851 22.5776 4.42785 22.8421L4.64995 22.9054C7.06615 23.5957 10.4115 24 14 24C14.7424 24 15.4744 23.9827 16.1899 23.9491C16.3251 24.6338 16.5303 25.2934 16.7976 25.9201C15.8936 25.9725 14.9581 26 14 26C6.26801 26 0 24.2091 0 22V4C0 1.79086 6.26801 0 14 0C21.732 0 28 1.79086 28 4V12.2C27.3538 12.0689 26.6849 12 26 12C24.0582 12 22.2456 12.5535 20.7115 13.5113C18.7188 13.8229 16.4318 14 14 14C8.90735 14 4.44979 13.2231 2 12.0615V16C2.47483 16.2862 3.49851 16.5776 4.42785 16.8421L4.64995 16.9054C7.06615 17.5957 10.4115 18 14 18C14.9798 18 15.9415 17.9699 16.871 17.912C16.5813 18.558 16.3581 19.2404 16.2102 19.9504C15.4903 19.9831 14.7521 20 14 20C8.90735 20 4.44979 19.2231 2 18.0615L2.00024 22ZM2 6.06148V10C2.47483 10.2862 3.49853 10.5776 4.42787 10.8421L4.64995 10.9054C7.06615 11.5957 10.4115 12 14 12C17.5885 12 20.9338 11.5957 23.3501 10.9054L23.5863 10.8381C24.5124 10.5746 25.5311 10.2848 26.0035 10H26V6.06148C23.5502 7.2231 19.0927 8 14 8C8.90735 8 4.44979 7.2231 2 6.06148ZM23.3501 3.09462C20.9338 2.40428 17.5885 2 14 2C10.4115 2 7.06615 2.40428 4.64995 3.09462C3.6667 3.37555 2.89023 3.69073 2.37721 4C2.89023 4.30927 3.6667 4.62445 4.64995 4.90538C7.06615 5.59572 10.4115 6 14 6C17.5885 6 20.9338 5.59572 23.3501 4.90538C24.3333 4.62445 25.1098 4.30927 25.6228 4C25.1098 3.69073 24.3333 3.37555 23.3501 3.09462Z" fill="#343741"/>
+<path d="M22 28.5C22 27.675 22.675 27 23.5 27C24.325 27 25 27.675 25 28.5C25 29.325 24.325 30 23.5 30C22.675 30 22 29.325 22 28.5Z" fill="#343741"/>
+<path d="M19 16.5V15H21.475L22.15 16.5H33.25C33.7 16.5 34 16.8 34 17.25C34 17.4 34 17.475 33.85 17.625L31.15 22.5C30.925 22.95 30.475 23.25 29.875 23.25H24.325L23.65 24.525V24.6C23.65 24.675 23.725 24.75 23.8 24.75H32.5V26.25H23.5C22.675 26.25 22 25.575 22 24.75C22 24.525 22.075 24.225 22.15 24L23.2 22.2L20.5 16.5H19Z" fill="#343741"/>
+<path d="M29.5 28.5C29.5 27.675 30.175 27 31 27C31.825 27 32.5 27.675 32.5 28.5C32.5 29.325 31.825 30 31 30C30.175 30 29.5 29.325 29.5 28.5Z" fill="#343741"/>
+</svg>
diff --git a/src/plugins/home/public/assets/sample_data_resources/flights/icon.svg b/src/plugins/home/public/assets/sample_data_resources/flights/icon.svg
new file mode 100644
index 00000000000000..fca14f79e33add
--- /dev/null
+++ b/src/plugins/home/public/assets/sample_data_resources/flights/icon.svg
@@ -0,0 +1,4 @@
+<svg width="34" height="32" viewBox="0 0 34 32" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M2.00024 22C2.47508 22.2862 3.49851 22.5776 4.42785 22.8421L4.64995 22.9054C7.06615 23.5957 10.4115 24 14 24C14.7424 24 15.4744 23.9827 16.1899 23.9491C16.3251 24.6338 16.5303 25.2934 16.7976 25.9201C15.8936 25.9725 14.9581 26 14 26C6.26801 26 0 24.2091 0 22V4C0 1.79086 6.26801 0 14 0C21.732 0 28 1.79086 28 4V12.2C27.3538 12.0689 26.6849 12 26 12C24.0582 12 22.2456 12.5535 20.7115 13.5113C18.7188 13.8229 16.4318 14 14 14C8.90735 14 4.44979 13.2231 2 12.0615V16C2.47483 16.2862 3.49851 16.5776 4.42785 16.8421L4.64995 16.9054C7.06615 17.5957 10.4115 18 14 18C14.9798 18 15.9415 17.9699 16.871 17.912C16.5813 18.558 16.3581 19.2404 16.2102 19.9504C15.4903 19.9831 14.7521 20 14 20C8.90735 20 4.44979 19.2231 2 18.0615L2.00024 22ZM2 6.06148V10C2.47483 10.2862 3.49853 10.5776 4.42787 10.8421L4.64995 10.9054C7.06615 11.5957 10.4115 12 14 12C17.5885 12 20.9338 11.5957 23.3501 10.9054L23.5863 10.8381C24.5124 10.5746 25.5311 10.2848 26.0035 10H26V6.06148C23.5502 7.2231 19.0927 8 14 8C8.90735 8 4.44979 7.2231 2 6.06148ZM23.3501 3.09462C20.9338 2.40428 17.5885 2 14 2C10.4115 2 7.06615 2.40428 4.64995 3.09462C3.6667 3.37555 2.89023 3.69073 2.37721 4C2.89023 4.30927 3.6667 4.62445 4.64995 4.90538C7.06615 5.59572 10.4115 6 14 6C17.5885 6 20.9338 5.59572 23.3501 4.90538C24.3333 4.62445 25.1098 4.30927 25.6228 4C25.1098 3.69073 24.3333 3.37555 23.3501 3.09462Z" fill="#343741"/>
+<path d="M30.2054 20.997C30.2054 20.997 31.4286 28.6726 31.4441 28.8802C31.4626 29.0909 31.4873 29.407 31.1771 29.7356C30.7986 30.1137 30.6435 30.0518 30.4885 29.7667C30.4885 29.7667 27.3666 24.1989 27.2457 23.9975C27.1247 23.7961 26.9821 23.7713 26.7556 23.9728C26.5291 24.1743 25.285 25.3863 25.1454 25.5258C25.0195 25.6515 25.0172 25.6841 25.0089 25.8028C25.008 25.8158 25.007 25.8298 25.0058 25.845L24.7322 28.101C24.726 28.2126 24.6763 28.3242 24.5895 28.411L24.2048 28.7953C24.0093 28.9906 23.8914 28.9349 23.7985 28.6932C23.7055 28.4515 23.3274 27.1438 23.3274 27.1438C23.315 27.1129 23.2437 26.9424 23.1879 26.8867L23.1819 26.8807C23.054 26.7528 22.9365 26.6353 22.7227 26.8062C22.3287 27.1193 21.9409 27.2837 21.8293 27.1721C21.7177 27.0606 21.8821 26.6732 22.1955 26.2796C22.3635 26.0629 22.2489 25.9484 22.121 25.8207L22.115 25.8147C22.0592 25.759 21.8886 25.6877 21.8576 25.6754C21.8576 25.6754 20.5488 25.2976 20.3069 25.2047C20.065 25.1118 20.0092 24.9941 20.2046 24.7988L20.5893 24.4144C20.6762 24.3277 20.7848 24.2811 20.8995 24.2718L23.1576 23.9985C23.1775 23.9969 23.1952 23.9958 23.2112 23.9949C23.3209 23.9882 23.3554 23.986 23.4771 23.859C23.5142 23.8204 23.6266 23.7051 23.7756 23.5523C24.1888 23.1287 24.8833 22.4166 25.0315 22.2503C25.2332 22.024 25.2084 21.8815 25.0068 21.7606C24.8052 21.6398 19.2323 18.5207 19.2323 18.5207C18.9501 18.3689 18.885 18.2109 19.2635 17.8328C19.5862 17.5104 19.9026 17.5351 20.1135 17.5536C20.3244 17.5722 28.0038 18.7911 28.0038 18.7911L28.0348 18.7911C28.3492 18.7882 28.4929 18.6562 28.7234 18.4445C28.7453 18.4243 28.768 18.4034 28.7918 18.3819C28.7918 18.3819 30.9604 16.271 31.7143 15.5983C32.4682 14.9257 33.3025 14.8294 33.7367 15.2631C34.1708 15.6968 34.0744 16.5367 33.4011 17.2899C32.7279 18.0431 30.6151 20.2097 30.6151 20.2097C30.5935 20.2335 30.5726 20.2562 30.5524 20.2781C30.3405 20.5083 30.2084 20.6519 30.2055 20.966L30.2054 20.997Z" fill="#343741"/>
+</svg>
diff --git a/src/plugins/home/public/assets/sample_data_resources/logs/icon.svg b/src/plugins/home/public/assets/sample_data_resources/logs/icon.svg
new file mode 100644
index 00000000000000..64b8422964d9b5
--- /dev/null
+++ b/src/plugins/home/public/assets/sample_data_resources/logs/icon.svg
@@ -0,0 +1,4 @@
+<svg width="34" height="32" viewBox="0 0 34 32" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M2.00024 22C2.47508 22.2862 3.49851 22.5776 4.42785 22.8421L4.64995 22.9054C7.06615 23.5957 10.4115 24 14 24C14.7424 24 15.4744 23.9827 16.1899 23.9491C16.3251 24.6338 16.5303 25.2934 16.7976 25.9201C15.8936 25.9725 14.9581 26 14 26C6.26801 26 0 24.2091 0 22V4C0 1.79086 6.26801 0 14 0C21.732 0 28 1.79086 28 4V12.2C27.3538 12.0689 26.6849 12 26 12C24.0582 12 22.2456 12.5535 20.7115 13.5113C18.7188 13.8229 16.4318 14 14 14C8.90735 14 4.44979 13.2231 2 12.0615V16C2.47483 16.2862 3.49851 16.5776 4.42785 16.8421L4.64995 16.9054C7.06615 17.5957 10.4115 18 14 18C14.9798 18 15.9415 17.9699 16.871 17.912C16.5813 18.558 16.3581 19.2404 16.2102 19.9504C15.4903 19.9831 14.7521 20 14 20C8.90735 20 4.44979 19.2231 2 18.0615L2.00024 22ZM2 6.06148V10C2.47483 10.2862 3.49853 10.5776 4.42787 10.8421L4.64995 10.9054C7.06615 11.5957 10.4115 12 14 12C17.5885 12 20.9338 11.5957 23.3501 10.9054L23.5863 10.8381C24.5124 10.5746 25.5311 10.2848 26.0035 10H26V6.06148C23.5502 7.2231 19.0927 8 14 8C8.90735 8 4.44979 7.2231 2 6.06148ZM23.3501 3.09462C20.9338 2.40428 17.5885 2 14 2C10.4115 2 7.06615 2.40428 4.64995 3.09462C3.6667 3.37555 2.89023 3.69073 2.37721 4C2.89023 4.30927 3.6667 4.62445 4.64995 4.90538C7.06615 5.59572 10.4115 6 14 6C17.5885 6 20.9338 5.59572 23.3501 4.90538C24.3333 4.62445 25.1098 4.30927 25.6228 4C25.1098 3.69073 24.3333 3.37555 23.3501 3.09462Z" fill="#343741"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M18 22.5333H18.0175C18.2919 26.703 21.7609 30 26 30C30.2391 30 33.7081 26.703 33.9825 22.5333H34V21.4667H33.9825C33.7081 17.2971 30.2391 14 26 14C21.7609 14 18.2919 17.2971 18.0175 21.4667H18V22.5333ZM20.1566 25.7333C19.5567 24.7964 19.1761 23.7056 19.0869 22.5333H22.2748C22.3102 23.6833 22.4589 24.767 22.6973 25.7333H20.1566ZM22.2748 21.4667H19.0869C19.1761 20.2944 19.5567 19.2036 20.1566 18.2667H22.6973C22.4589 19.233 22.3102 20.3167 22.2748 21.4667ZM29.7252 22.5333H32.9131C32.824 23.7056 32.4433 24.7964 31.8434 25.7333H29.3027C29.5411 24.767 29.6898 23.6833 29.7252 22.5333ZM31.8434 18.2667C32.4433 19.2036 32.824 20.2944 32.9131 21.4667H29.7252C29.6898 20.3167 29.5411 19.233 29.3027 18.2667H31.8434ZM23.7991 25.7333C23.5494 24.802 23.3815 23.7139 23.3422 22.5333H28.6578C28.6185 23.7139 28.4506 24.802 28.2009 25.7333H23.7991ZM28.2009 18.2667C28.4506 19.198 28.6185 20.2861 28.6578 21.4667H23.3422C23.3815 20.2861 23.5494 19.198 23.7991 18.2667H28.2009ZM23.895 28.608C22.7802 28.2532 21.7877 27.6241 20.9969 26.8H23.0131C23.2587 27.5009 23.5569 28.1125 23.895 28.608ZM28.9869 26.8H31.0031C30.2123 27.6241 29.2198 28.2532 28.105 28.608C28.4431 28.1125 28.7413 27.5009 28.9869 26.8ZM26 28.9333C25.3532 28.9333 24.6624 28.1223 24.146 26.8H27.854C27.3376 28.1223 26.6468 28.9333 26 28.9333ZM23.0131 17.2H20.9969C21.7877 16.3759 22.7802 15.7468 23.895 15.392C23.5569 15.8875 23.2587 16.4991 23.0131 17.2ZM28.105 15.392C29.2198 15.7468 30.2123 16.3759 31.0031 17.2H28.9869C28.7413 16.4991 28.4431 15.8875 28.105 15.392ZM26 15.0667C26.6468 15.0667 27.3376 15.8777 27.854 17.2H24.146C24.6624 15.8777 25.3532 15.0667 26 15.0667Z" fill="#343741"/>
+</svg>
diff --git a/src/plugins/home/server/plugin.test.ts b/src/plugins/home/server/plugin.test.ts
index fdf671e10ad097..2dc8a8e6484aa4 100644
--- a/src/plugins/home/server/plugin.test.ts
+++ b/src/plugins/home/server/plugin.test.ts
@@ -53,7 +53,6 @@ describe('HomeServerPlugin', () => {
         homeServerPluginSetupDependenciesMock
       );
       expect(setup).toHaveProperty('sampleData');
-      expect(setup.sampleData).toHaveProperty('registerSampleDataset');
       expect(setup.sampleData).toHaveProperty('getSampleDatasets');
       expect(setup.sampleData).toHaveProperty('addSavedObjectsToSampleDataset');
       expect(setup.sampleData).toHaveProperty('addAppLinksToSampleDataset');
diff --git a/src/plugins/home/server/plugin.ts b/src/plugins/home/server/plugin.ts
index 7c830dd8d5bc34..5902544d9867fd 100644
--- a/src/plugins/home/server/plugin.ts
+++ b/src/plugins/home/server/plugin.ts
@@ -40,7 +40,9 @@ export class HomeServerPlugin implements Plugin<HomeServerPluginSetup, HomeServe
 
     return {
       tutorials: { ...this.tutorialsRegistry.setup(core, plugins.customIntegrations) },
-      sampleData: { ...this.sampleDataRegistry.setup(core, plugins.usageCollection) },
+      sampleData: {
+        ...this.sampleDataRegistry.setup(core, plugins.usageCollection, plugins.customIntegrations),
+      },
     };
   }
 
diff --git a/src/plugins/home/server/services/sample_data/data_sets/ecommerce/index.ts b/src/plugins/home/server/services/sample_data/data_sets/ecommerce/index.ts
index 798685eebd8ed3..cc328f3edbf71d 100644
--- a/src/plugins/home/server/services/sample_data/data_sets/ecommerce/index.ts
+++ b/src/plugins/home/server/services/sample_data/data_sets/ecommerce/index.ts
@@ -42,5 +42,6 @@ export const ecommerceSpecProvider = function (): SampleDatasetSchema {
       },
     ],
     status: 'not_installed',
+    iconPath: '/plugins/home/assets/sample_data_resources/ecommerce/icon.svg',
   };
 };
diff --git a/src/plugins/home/server/services/sample_data/data_sets/flights/index.ts b/src/plugins/home/server/services/sample_data/data_sets/flights/index.ts
index 332bf63d4ddd69..29260b99674000 100644
--- a/src/plugins/home/server/services/sample_data/data_sets/flights/index.ts
+++ b/src/plugins/home/server/services/sample_data/data_sets/flights/index.ts
@@ -42,5 +42,6 @@ export const flightsSpecProvider = function (): SampleDatasetSchema {
       },
     ],
     status: 'not_installed',
+    iconPath: '/plugins/home/assets/sample_data_resources/flights/icon.svg',
   };
 };
diff --git a/src/plugins/home/server/services/sample_data/data_sets/logs/index.ts b/src/plugins/home/server/services/sample_data/data_sets/logs/index.ts
index b814286d763607..ac783c1a2aba68 100644
--- a/src/plugins/home/server/services/sample_data/data_sets/logs/index.ts
+++ b/src/plugins/home/server/services/sample_data/data_sets/logs/index.ts
@@ -42,5 +42,6 @@ export const logsSpecProvider = function (): SampleDatasetSchema {
       },
     ],
     status: 'not_installed',
+    iconPath: '/plugins/home/assets/sample_data_resources/logs/icon.svg',
   };
 };
diff --git a/src/plugins/home/server/services/sample_data/lib/register_with_integrations.ts b/src/plugins/home/server/services/sample_data/lib/register_with_integrations.ts
new file mode 100644
index 00000000000000..96c62b040926c2
--- /dev/null
+++ b/src/plugins/home/server/services/sample_data/lib/register_with_integrations.ts
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { CoreSetup } from 'kibana/server';
+import { CustomIntegrationsPluginSetup } from '../../../../../custom_integrations/server';
+import { SampleDatasetSchema } from './sample_dataset_schema';
+import { HOME_APP_BASE_PATH } from '../../../../common/constants';
+
+export function registerSampleDatasetWithIntegration(
+  customIntegrations: CustomIntegrationsPluginSetup,
+  core: CoreSetup,
+  sampleDataset: SampleDatasetSchema
+) {
+  customIntegrations.registerCustomIntegration({
+    id: sampleDataset.id,
+    title: sampleDataset.name,
+    description: sampleDataset.description,
+    uiInternalPath: `${HOME_APP_BASE_PATH}#/tutorial_directory/sampleData`,
+    isBeta: false,
+    icons: sampleDataset.iconPath
+      ? [
+          {
+            type: 'svg',
+            src: core.http.basePath.prepend(sampleDataset.iconPath),
+          },
+        ]
+      : [],
+    categories: ['sample_data'],
+    shipper: 'sample_data',
+  });
+}
diff --git a/src/plugins/home/server/services/sample_data/lib/sample_dataset_schema.ts b/src/plugins/home/server/services/sample_data/lib/sample_dataset_schema.ts
index 3c1764b2b8df1c..87b042aebcc1f5 100644
--- a/src/plugins/home/server/services/sample_data/lib/sample_dataset_schema.ts
+++ b/src/plugins/home/server/services/sample_data/lib/sample_dataset_schema.ts
@@ -67,6 +67,7 @@ export const sampleDataSchema = schema.object({
   description: schema.string(),
   previewImagePath: schema.string(),
   darkPreviewImagePath: schema.maybe(schema.string()),
+  iconPath: schema.maybe(schema.string()), // relative path to icon. Used for display in the Fleet-integrations app
 
   // saved object id of main dashboard for sample data set
   overviewDashboard: schema.string(),
diff --git a/src/plugins/home/server/services/sample_data/sample_data_registry.mock.ts b/src/plugins/home/server/services/sample_data/sample_data_registry.mock.ts
index b3db0cd499487b..02db3dd1a5e9ef 100644
--- a/src/plugins/home/server/services/sample_data/sample_data_registry.mock.ts
+++ b/src/plugins/home/server/services/sample_data/sample_data_registry.mock.ts
@@ -15,7 +15,6 @@ import {
 
 const createSetupMock = (): jest.Mocked<SampleDataRegistrySetup> => {
   const setup = {
-    registerSampleDataset: jest.fn(),
     getSampleDatasets: jest.fn(),
     addSavedObjectsToSampleDataset: jest.fn(),
     addAppLinksToSampleDataset: jest.fn(),
diff --git a/src/plugins/home/server/services/sample_data/sample_data_registry.test.ts b/src/plugins/home/server/services/sample_data/sample_data_registry.test.ts
new file mode 100644
index 00000000000000..74c4d66c4fb021
--- /dev/null
+++ b/src/plugins/home/server/services/sample_data/sample_data_registry.test.ts
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { MockedKeys } from '@kbn/utility-types/jest';
+import { CoreSetup } from '../../../../../core/server';
+
+import { CustomIntegrationsPluginSetup } from '../../../../custom_integrations/server';
+import { customIntegrationsMock } from '../../../../custom_integrations/server/mocks';
+import { SampleDataRegistry } from './sample_data_registry';
+import { usageCollectionPluginMock } from '../../../../usage_collection/server/mocks';
+import { UsageCollectionSetup } from '../../../../usage_collection/server/plugin';
+import { coreMock } from '../../../../../core/server/mocks';
+
+describe('SampleDataRegistry', () => {
+  let mockCoreSetup: MockedKeys<CoreSetup>;
+  let mockCustomIntegrationsPluginSetup: jest.Mocked<CustomIntegrationsPluginSetup>;
+  let mockUsageCollectionPluginSetup: MockedKeys<UsageCollectionSetup>;
+
+  beforeEach(() => {
+    mockCoreSetup = coreMock.createSetup();
+    mockCustomIntegrationsPluginSetup = customIntegrationsMock.createSetup();
+    mockUsageCollectionPluginSetup = usageCollectionPluginMock.createSetupContract();
+  });
+
+  describe('setup', () => {
+    test('should register the three sample datasets', () => {
+      const initContext = coreMock.createPluginInitializerContext();
+      const plugin = new SampleDataRegistry(initContext);
+      plugin.setup(
+        mockCoreSetup,
+        mockUsageCollectionPluginSetup,
+        mockCustomIntegrationsPluginSetup
+      );
+
+      const ids: string[] =
+        mockCustomIntegrationsPluginSetup.registerCustomIntegration.mock.calls.map((args) => {
+          return args[0].id;
+        });
+      expect(ids).toEqual(['flights', 'logs', 'ecommerce']);
+    });
+  });
+});
diff --git a/src/plugins/home/server/services/sample_data/sample_data_registry.ts b/src/plugins/home/server/services/sample_data/sample_data_registry.ts
index ad7e1d45e290b6..f966a05c123978 100644
--- a/src/plugins/home/server/services/sample_data/sample_data_registry.ts
+++ b/src/plugins/home/server/services/sample_data/sample_data_registry.ts
@@ -21,20 +21,54 @@ import { createListRoute, createInstallRoute } from './routes';
 import { UsageCollectionSetup } from '../../../../usage_collection/server';
 import { makeSampleDataUsageCollector, usage } from './usage';
 import { createUninstallRoute } from './routes/uninstall';
-
-const flightsSampleDataset = flightsSpecProvider();
-const logsSampleDataset = logsSpecProvider();
-const ecommerceSampleDataset = ecommerceSpecProvider();
+import { CustomIntegrationsPluginSetup } from '../../../../custom_integrations/server';
+import { registerSampleDatasetWithIntegration } from './lib/register_with_integrations';
 
 export class SampleDataRegistry {
   constructor(private readonly initContext: PluginInitializerContext) {}
-  private readonly sampleDatasets: SampleDatasetSchema[] = [
-    flightsSampleDataset,
-    logsSampleDataset,
-    ecommerceSampleDataset,
-  ];
+  private readonly sampleDatasets: SampleDatasetSchema[] = [];
+
+  private registerSampleDataSet(
+    specProvider: SampleDatasetProvider,
+    core: CoreSetup,
+    customIntegrations?: CustomIntegrationsPluginSetup
+  ) {
+    let value: SampleDatasetSchema;
+    try {
+      value = sampleDataSchema.validate(specProvider());
+    } catch (error) {
+      throw new Error(`Unable to register sample dataset spec because it's invalid. ${error}`);
+    }
+
+    if (customIntegrations && core) {
+      registerSampleDatasetWithIntegration(customIntegrations, core, value);
+    }
 
-  public setup(core: CoreSetup, usageCollections: UsageCollectionSetup | undefined) {
+    const defaultIndexSavedObjectJson = value.savedObjects.find((savedObjectJson: any) => {
+      return savedObjectJson.type === 'index-pattern' && savedObjectJson.id === value.defaultIndex;
+    });
+    if (!defaultIndexSavedObjectJson) {
+      throw new Error(
+        `Unable to register sample dataset spec, defaultIndex: "${value.defaultIndex}" does not exist in savedObjects list.`
+      );
+    }
+
+    const dashboardSavedObjectJson = value.savedObjects.find((savedObjectJson: any) => {
+      return savedObjectJson.type === 'dashboard' && savedObjectJson.id === value.overviewDashboard;
+    });
+    if (!dashboardSavedObjectJson) {
+      throw new Error(
+        `Unable to register sample dataset spec, overviewDashboard: "${value.overviewDashboard}" does not exist in savedObject list.`
+      );
+    }
+    this.sampleDatasets.push(value);
+  }
+
+  public setup(
+    core: CoreSetup,
+    usageCollections: UsageCollectionSetup | undefined,
+    customIntegrations?: CustomIntegrationsPluginSetup
+  ) {
     if (usageCollections) {
       makeSampleDataUsageCollector(usageCollections, this.initContext);
     }
@@ -52,38 +86,11 @@ export class SampleDataRegistry {
     );
     createUninstallRoute(router, this.sampleDatasets, usageTracker);
 
-    return {
-      registerSampleDataset: (specProvider: SampleDatasetProvider) => {
-        let value: SampleDatasetSchema;
-        try {
-          value = sampleDataSchema.validate(specProvider());
-        } catch (error) {
-          throw new Error(`Unable to register sample dataset spec because it's invalid. ${error}`);
-        }
-
-        const defaultIndexSavedObjectJson = value.savedObjects.find((savedObjectJson: any) => {
-          return (
-            savedObjectJson.type === 'index-pattern' && savedObjectJson.id === value.defaultIndex
-          );
-        });
-        if (!defaultIndexSavedObjectJson) {
-          throw new Error(
-            `Unable to register sample dataset spec, defaultIndex: "${value.defaultIndex}" does not exist in savedObjects list.`
-          );
-        }
+    this.registerSampleDataSet(flightsSpecProvider, core, customIntegrations);
+    this.registerSampleDataSet(logsSpecProvider, core, customIntegrations);
+    this.registerSampleDataSet(ecommerceSpecProvider, core, customIntegrations);
 
-        const dashboardSavedObjectJson = value.savedObjects.find((savedObjectJson: any) => {
-          return (
-            savedObjectJson.type === 'dashboard' && savedObjectJson.id === value.overviewDashboard
-          );
-        });
-        if (!dashboardSavedObjectJson) {
-          throw new Error(
-            `Unable to register sample dataset spec, overviewDashboard: "${value.overviewDashboard}" does not exist in savedObject list.`
-          );
-        }
-        this.sampleDatasets.push(value);
-      },
+    return {
       getSampleDatasets: () => this.sampleDatasets,
 
       addSavedObjectsToSampleDataset: (id: string, savedObjects: SavedObject[]) => {
diff --git a/src/plugins/home/server/services/tutorials/tutorials_registry.test.ts b/src/plugins/home/server/services/tutorials/tutorials_registry.test.ts
index 5c7ec0a3382bf7..15372949b16533 100644
--- a/src/plugins/home/server/services/tutorials/tutorials_registry.test.ts
+++ b/src/plugins/home/server/services/tutorials/tutorials_registry.test.ts
@@ -71,7 +71,7 @@ describe('TutorialsRegistry', () => {
   let mockCoreSetup: MockedKeys<CoreSetup>;
   let testProvider: TutorialProvider;
   let testScopedTutorialContextFactory: ScopedTutorialContextFactory;
-  let mockCustomIntegrationsPluginSetup: MockedKeys<CustomIntegrationsPluginSetup>;
+  let mockCustomIntegrationsPluginSetup: jest.Mocked<CustomIntegrationsPluginSetup>;
 
   beforeEach(() => {
     mockCustomIntegrationsPluginSetup = customIntegrationsMock.createSetup();
@@ -107,8 +107,6 @@ describe('TutorialsRegistry', () => {
       const setup = new TutorialsRegistry().setup(mockCoreSetup, mockCustomIntegrationsPluginSetup);
       testProvider = ({}) => validTutorialProvider;
       expect(() => setup.registerTutorial(testProvider)).not.toThrowError();
-
-      // @ts-expect-error
       expect(mockCustomIntegrationsPluginSetup.registerCustomIntegration.mock.calls).toEqual([
         [
           {
diff --git a/src/plugins/kibana_legacy/public/angular/index.ts b/src/plugins/kibana_legacy/public/angular/index.ts
index 369495698591d0..8ba68a88271bf5 100644
--- a/src/plugins/kibana_legacy/public/angular/index.ts
+++ b/src/plugins/kibana_legacy/public/angular/index.ts
@@ -5,10 +5,6 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
-
-// @ts-ignore
-export { watchMultiDecorator } from './watch_multi';
 export * from './angular_config';
 // @ts-ignore
 export { createTopNavDirective, createTopNavHelper, loadKbnTopNavDirectives } from './kbn_top_nav';
-export { subscribeWithScope } from './subscribe_with_scope';
diff --git a/src/plugins/kibana_legacy/public/angular/subscribe_with_scope.test.ts b/src/plugins/kibana_legacy/public/angular/subscribe_with_scope.test.ts
deleted file mode 100644
index c1c057886c5640..00000000000000
--- a/src/plugins/kibana_legacy/public/angular/subscribe_with_scope.test.ts
+++ /dev/null
@@ -1,186 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import * as Rx from 'rxjs';
-import { subscribeWithScope } from './subscribe_with_scope';
-
-// eslint-disable-next-line prefer-const
-let $rootScope: Scope;
-
-class Scope {
-  public $$phase?: string;
-  public $root = $rootScope;
-  public $apply = jest.fn((fn: () => void) => fn());
-}
-
-$rootScope = new Scope();
-
-afterEach(() => {
-  jest.clearAllMocks();
-});
-
-it('subscribes to the passed observable, returns subscription', () => {
-  const $scope = new Scope();
-
-  const unsubSpy = jest.fn();
-  const subSpy = jest.fn<any, any>(() => unsubSpy);
-  const observable = new Rx.Observable(subSpy);
-
-  const subscription = subscribeWithScope($scope as any, observable);
-  expect(subSpy).toHaveBeenCalledTimes(1);
-  expect(unsubSpy).not.toHaveBeenCalled();
-
-  subscription.unsubscribe();
-
-  expect(subSpy).toHaveBeenCalledTimes(1);
-  expect(unsubSpy).toHaveBeenCalledTimes(1);
-});
-
-it('calls observer.next() if already in a digest cycle, wraps in $scope.$apply if not', () => {
-  const subject = new Rx.Subject();
-  const nextSpy = jest.fn();
-  const $scope = new Scope();
-
-  subscribeWithScope($scope as any, subject, { next: nextSpy });
-
-  subject.next();
-  expect($scope.$apply).toHaveBeenCalledTimes(1);
-  expect(nextSpy).toHaveBeenCalledTimes(1);
-
-  jest.clearAllMocks();
-
-  $rootScope.$$phase = '$digest';
-  subject.next();
-  expect($scope.$apply).not.toHaveBeenCalled();
-  expect(nextSpy).toHaveBeenCalledTimes(1);
-});
-
-it('reports fatalError if observer.next() throws', () => {
-  const fatalError = jest.fn();
-  const $scope = new Scope();
-  subscribeWithScope(
-    $scope as any,
-    Rx.of(undefined),
-    {
-      next() {
-        throw new Error('foo bar');
-      },
-    },
-    fatalError
-  );
-
-  expect(fatalError.mock.calls).toMatchInlineSnapshot(`
-Array [
-  Array [
-    [Error: foo bar],
-  ],
-]
-`);
-});
-
-it('reports fatal error if observer.error is not defined and observable errors', () => {
-  const fatalError = jest.fn();
-  const $scope = new Scope();
-  const error = new Error('foo');
-  error.stack = `${error.message}\n---stack trace ---`;
-  subscribeWithScope($scope as any, Rx.throwError(error), undefined, fatalError);
-
-  expect(fatalError.mock.calls).toMatchInlineSnapshot(`
-Array [
-  Array [
-    [Error: Uncaught error in subscribeWithScope(): foo
----stack trace ---],
-  ],
-]
-`);
-});
-
-it('reports fatal error if observer.error throws', () => {
-  const fatalError = jest.fn();
-  const $scope = new Scope();
-  subscribeWithScope(
-    $scope as any,
-    Rx.throwError(new Error('foo')),
-    {
-      error: () => {
-        throw new Error('foo');
-      },
-    },
-    fatalError
-  );
-
-  expect(fatalError.mock.calls).toMatchInlineSnapshot(`
-Array [
-  Array [
-    [Error: foo],
-  ],
-]
-`);
-});
-
-it('does not report fatal error if observer.error handles the error', () => {
-  const fatalError = jest.fn();
-  const $scope = new Scope();
-  subscribeWithScope(
-    $scope as any,
-    Rx.throwError(new Error('foo')),
-    {
-      error: () => {
-        // noop, swallow error
-      },
-    },
-    fatalError
-  );
-
-  expect(fatalError.mock.calls).toEqual([]);
-});
-
-it('reports fatal error if observer.complete throws', () => {
-  const fatalError = jest.fn();
-  const $scope = new Scope();
-  subscribeWithScope(
-    $scope as any,
-    Rx.EMPTY,
-    {
-      complete: () => {
-        throw new Error('foo');
-      },
-    },
-    fatalError
-  );
-
-  expect(fatalError.mock.calls).toMatchInlineSnapshot(`
-Array [
-  Array [
-    [Error: foo],
-  ],
-]
-`);
-});
-
-it('preserves the context of the observer functions', () => {
-  const $scope = new Scope();
-  const observer = {
-    next() {
-      expect(this).toBe(observer);
-    },
-    complete() {
-      expect(this).toBe(observer);
-    },
-  };
-
-  subscribeWithScope($scope as any, Rx.of([1, 2, 3]), observer);
-
-  const observer2 = {
-    error() {
-      expect(this).toBe(observer);
-    },
-  };
-
-  subscribeWithScope($scope as any, Rx.throwError(new Error('foo')), observer2);
-});
diff --git a/src/plugins/kibana_legacy/public/angular/subscribe_with_scope.ts b/src/plugins/kibana_legacy/public/angular/subscribe_with_scope.ts
deleted file mode 100644
index 4c3f17e4e46e5a..00000000000000
--- a/src/plugins/kibana_legacy/public/angular/subscribe_with_scope.ts
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { IScope } from 'angular';
-import * as Rx from 'rxjs';
-import { AngularHttpError } from '../notify/lib';
-
-type FatalErrorFn = (error: AngularHttpError | Error | string, location?: string) => void;
-
-function callInDigest($scope: IScope, fn: () => void, fatalError?: FatalErrorFn) {
-  try {
-    // this is terrible, but necessary to synchronously deliver subscription values
-    // to angular scopes. This is required by some APIs, like the `config` service,
-    // and beneficial for root level directives where additional digest cycles make
-    // kibana sluggish to load.
-    //
-    // If you copy this code elsewhere you better have a good reason :)
-    if ($scope.$root.$$phase) {
-      fn();
-    } else {
-      $scope.$apply(() => fn());
-    }
-  } catch (error) {
-    if (fatalError) {
-      fatalError(error);
-    }
-  }
-}
-
-/**
- * Subscribe to an observable at a $scope, ensuring that the digest cycle
- * is run for subscriber hooks and routing errors to fatalError if not handled.
- */
-export function subscribeWithScope<T>(
-  $scope: IScope,
-  observable: Rx.Observable<T>,
-  observer?: Rx.PartialObserver<T>,
-  fatalError?: FatalErrorFn
-) {
-  return observable.subscribe({
-    next(value) {
-      if (observer && observer.next) {
-        callInDigest($scope, () => observer.next!(value), fatalError);
-      }
-    },
-    error(error) {
-      callInDigest(
-        $scope,
-        () => {
-          if (observer && observer.error) {
-            observer.error(error);
-          } else {
-            throw new Error(
-              `Uncaught error in subscribeWithScope(): ${
-                error ? error.stack || error.message : error
-              }`
-            );
-          }
-        },
-        fatalError
-      );
-    },
-    complete() {
-      if (observer && observer.complete) {
-        callInDigest($scope, () => observer.complete!(), fatalError);
-      }
-    },
-  });
-}
diff --git a/src/plugins/kibana_legacy/public/angular/watch_multi.js b/src/plugins/kibana_legacy/public/angular/watch_multi.js
deleted file mode 100644
index f4ba6e78751245..00000000000000
--- a/src/plugins/kibana_legacy/public/angular/watch_multi.js
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import _ from 'lodash';
-
-export function watchMultiDecorator($provide) {
-  $provide.decorator('$rootScope', function ($delegate) {
-    /**
-     * Watch multiple expressions with a single callback. Along
-     * with making code simpler it also merges all of the watcher
-     * handlers within a single tick.
-     *
-     * # expression format
-     * expressions can be specified in one of the following ways:
-     * 1. string that evaluates to a value on scope. Creates a regular $watch
-     *    expression.
-     *     'someScopeValue.prop' === $scope.$watch('someScopeValue.prop', fn);
-     *
-     * 2. #1 prefixed with '[]', which uses $watchCollection rather than $watch.
-     *     '[]expr' === $scope.$watchCollection('expr', fn);
-     *
-     * 3. #1 prefixed with '=', which uses $watch with objectEquality turned on
-     *     '=expr' === $scope.$watch('expr', fn, true);
-     *
-     * 4. a function that will be called, like a normal function water
-     *
-     * 5. an object with any of the properties:
-     *   `get`: the getter called on each iteration
-     *   `deep`: a flag to turn on objectEquality in $watch
-     *   `fn`: the watch registration function ($scope.$watch or $scope.$watchCollection)
-     *
-     * @param  {array[string|function|obj]} expressions - the list of expressions to $watch
-     * @param  {Function} fn - the callback function
-     * @return {Function} - an unwatch function, just like the return value of $watch
-     */
-    $delegate.constructor.prototype.$watchMulti = function (expressions, fn) {
-      if (!Array.isArray(expressions)) {
-        throw new TypeError('expected an array of expressions to watch');
-      }
-
-      if (!_.isFunction(fn)) {
-        throw new TypeError('expected a function that is triggered on each watch');
-      }
-      const $scope = this;
-      const vals = new Array(expressions.length);
-      const prev = new Array(expressions.length);
-      let fire = false;
-      let init = 0;
-      const neededInits = expressions.length;
-
-      // first, register all of the multi-watchers
-      const unwatchers = expressions.map(function (expr, i) {
-        expr = normalizeExpression($scope, expr);
-        if (!expr) return;
-
-        return expr.fn.call(
-          $scope,
-          expr.get,
-          function (newVal, oldVal) {
-            if (newVal === oldVal) {
-              init += 1;
-            }
-
-            vals[i] = newVal;
-            prev[i] = oldVal;
-            fire = true;
-          },
-          expr.deep
-        );
-      });
-
-      // then, the watcher that checks to see if any of
-      // the other watchers triggered this cycle
-      let flip = false;
-      unwatchers.push(
-        $scope.$watch(
-          function () {
-            if (init < neededInits) return init;
-
-            if (fire) {
-              fire = false;
-              flip = !flip;
-            }
-            return flip;
-          },
-          function () {
-            if (init < neededInits) return false;
-
-            fn(vals.slice(0), prev.slice(0));
-            vals.forEach(function (v, i) {
-              prev[i] = v;
-            });
-          }
-        )
-      );
-
-      return function () {
-        unwatchers.forEach((listener) => listener());
-      };
-    };
-
-    function normalizeExpression($scope, expr) {
-      if (!expr) return;
-      const norm = {
-        fn: $scope.$watch,
-        deep: false,
-      };
-
-      if (_.isFunction(expr)) return _.assign(norm, { get: expr });
-      if (_.isObject(expr)) return _.assign(norm, expr);
-      if (!_.isString(expr)) return;
-
-      if (expr.substr(0, 2) === '[]') {
-        return _.assign(norm, {
-          fn: $scope.$watchCollection,
-          get: expr.substr(2),
-        });
-      }
-
-      if (expr.charAt(0) === '=') {
-        return _.assign(norm, {
-          deep: true,
-          get: expr.substr(1),
-        });
-      }
-
-      return _.assign(norm, { get: expr });
-    }
-
-    return $delegate;
-  });
-}
diff --git a/src/plugins/kibana_legacy/public/angular_bootstrap/bind_html/bind_html.js b/src/plugins/kibana_legacy/public/angular_bootstrap/bind_html/bind_html.js
deleted file mode 100755
index 77844a3dd1363b..00000000000000
--- a/src/plugins/kibana_legacy/public/angular_bootstrap/bind_html/bind_html.js
+++ /dev/null
@@ -1,17 +0,0 @@
-/* eslint-disable */
-
-import angular from 'angular';
-
-export function initBindHtml() {
-  angular
-    .module('ui.bootstrap.bindHtml', [])
-
-    .directive('bindHtmlUnsafe', function() {
-      return function(scope, element, attr) {
-        element.addClass('ng-binding').data('$binding', attr.bindHtmlUnsafe);
-        scope.$watch(attr.bindHtmlUnsafe, function bindHtmlUnsafeWatchAction(value) {
-          element.html(value || '');
-        });
-      };
-    });
-}
diff --git a/src/plugins/kibana_legacy/public/angular_bootstrap/index.ts b/src/plugins/kibana_legacy/public/angular_bootstrap/index.ts
deleted file mode 100644
index 1f15107a027623..00000000000000
--- a/src/plugins/kibana_legacy/public/angular_bootstrap/index.ts
+++ /dev/null
@@ -1,50 +0,0 @@
-/* eslint-disable */
-
-import { once } from 'lodash';
-import angular from 'angular';
-
-// @ts-ignore
-import { initBindHtml } from './bind_html/bind_html';
-// @ts-ignore
-import { initBootstrapTooltip } from './tooltip/tooltip';
-
-import tooltipPopup from './tooltip/tooltip_popup.html';
-
-import tooltipUnsafePopup from './tooltip/tooltip_html_unsafe_popup.html';
-
-export const initAngularBootstrap = once(() => {
-  /*
- * angular-ui-bootstrap
- * http://angular-ui.github.io/bootstrap/
-
- * Version: 0.12.1 - 2015-02-20
- * License: MIT
- */
-  angular.module('ui.bootstrap', [
-    'ui.bootstrap.tpls',
-    'ui.bootstrap.bindHtml',
-    'ui.bootstrap.tooltip',
-  ]);
-
-  angular.module('ui.bootstrap.tpls', [
-    'template/tooltip/tooltip-html-unsafe-popup.html',
-    'template/tooltip/tooltip-popup.html',
-  ]);
-
-  initBindHtml();
-  initBootstrapTooltip();
-
-  angular.module('template/tooltip/tooltip-html-unsafe-popup.html', []).run([
-    '$templateCache',
-    function($templateCache: any) {
-      $templateCache.put('template/tooltip/tooltip-html-unsafe-popup.html', tooltipUnsafePopup);
-    },
-  ]);
-
-  angular.module('template/tooltip/tooltip-popup.html', []).run([
-    '$templateCache',
-    function($templateCache: any) {
-      $templateCache.put('template/tooltip/tooltip-popup.html', tooltipPopup);
-    },
-  ]);
-});
diff --git a/src/plugins/kibana_legacy/public/angular_bootstrap/tooltip/position.js b/src/plugins/kibana_legacy/public/angular_bootstrap/tooltip/position.js
deleted file mode 100755
index 24c8a8c5979cd5..00000000000000
--- a/src/plugins/kibana_legacy/public/angular_bootstrap/tooltip/position.js
+++ /dev/null
@@ -1,167 +0,0 @@
-/* eslint-disable */
-
-import angular from 'angular';
-
-export function initBootstrapPosition() {
-  angular
-    .module('ui.bootstrap.position', [])
-
-    /**
-     * A set of utility methods that can be use to retrieve position of DOM elements.
-     * It is meant to be used where we need to absolute-position DOM elements in
-     * relation to other, existing elements (this is the case for tooltips, popovers,
-     * typeahead suggestions etc.).
-     */
-    .factory('$position', [
-      '$document',
-      '$window',
-      function($document, $window) {
-        function getStyle(el, cssprop) {
-          if (el.currentStyle) {
-            //IE
-            return el.currentStyle[cssprop];
-          } else if ($window.getComputedStyle) {
-            return $window.getComputedStyle(el)[cssprop];
-          }
-          // finally try and get inline style
-          return el.style[cssprop];
-        }
-
-        /**
-         * Checks if a given element is statically positioned
-         * @param element - raw DOM element
-         */
-        function isStaticPositioned(element) {
-          return (getStyle(element, 'position') || 'static') === 'static';
-        }
-
-        /**
-         * returns the closest, non-statically positioned parentOffset of a given element
-         * @param element
-         */
-        const parentOffsetEl = function(element) {
-          const docDomEl = $document[0];
-          let offsetParent = element.offsetParent || docDomEl;
-          while (offsetParent && offsetParent !== docDomEl && isStaticPositioned(offsetParent)) {
-            offsetParent = offsetParent.offsetParent;
-          }
-          return offsetParent || docDomEl;
-        };
-
-        return {
-          /**
-           * Provides read-only equivalent of jQuery's position function:
-           * http://api.jquery.com/position/
-           */
-          position: function(element) {
-            const elBCR = this.offset(element);
-            let offsetParentBCR = { top: 0, left: 0 };
-            const offsetParentEl = parentOffsetEl(element[0]);
-            if (offsetParentEl != $document[0]) {
-              offsetParentBCR = this.offset(angular.element(offsetParentEl));
-              offsetParentBCR.top += offsetParentEl.clientTop - offsetParentEl.scrollTop;
-              offsetParentBCR.left += offsetParentEl.clientLeft - offsetParentEl.scrollLeft;
-            }
-
-            const boundingClientRect = element[0].getBoundingClientRect();
-            return {
-              width: boundingClientRect.width || element.prop('offsetWidth'),
-              height: boundingClientRect.height || element.prop('offsetHeight'),
-              top: elBCR.top - offsetParentBCR.top,
-              left: elBCR.left - offsetParentBCR.left,
-            };
-          },
-
-          /**
-           * Provides read-only equivalent of jQuery's offset function:
-           * http://api.jquery.com/offset/
-           */
-          offset: function(element) {
-            const boundingClientRect = element[0].getBoundingClientRect();
-            return {
-              width: boundingClientRect.width || element.prop('offsetWidth'),
-              height: boundingClientRect.height || element.prop('offsetHeight'),
-              top:
-                boundingClientRect.top +
-                ($window.pageYOffset || $document[0].documentElement.scrollTop),
-              left:
-                boundingClientRect.left +
-                ($window.pageXOffset || $document[0].documentElement.scrollLeft),
-            };
-          },
-
-          /**
-           * Provides coordinates for the targetEl in relation to hostEl
-           */
-          positionElements: function(hostEl, targetEl, positionStr, appendToBody) {
-            const positionStrParts = positionStr.split('-');
-            const pos0 = positionStrParts[0];
-            const pos1 = positionStrParts[1] || 'center';
-
-            let hostElPos;
-            let targetElWidth;
-            let targetElHeight;
-            let targetElPos;
-
-            hostElPos = appendToBody ? this.offset(hostEl) : this.position(hostEl);
-
-            targetElWidth = targetEl.prop('offsetWidth');
-            targetElHeight = targetEl.prop('offsetHeight');
-
-            const shiftWidth = {
-              center: function() {
-                return hostElPos.left + hostElPos.width / 2 - targetElWidth / 2;
-              },
-              left: function() {
-                return hostElPos.left;
-              },
-              right: function() {
-                return hostElPos.left + hostElPos.width;
-              },
-            };
-
-            const shiftHeight = {
-              center: function() {
-                return hostElPos.top + hostElPos.height / 2 - targetElHeight / 2;
-              },
-              top: function() {
-                return hostElPos.top;
-              },
-              bottom: function() {
-                return hostElPos.top + hostElPos.height;
-              },
-            };
-
-            switch (pos0) {
-              case 'right':
-                targetElPos = {
-                  top: shiftHeight[pos1](),
-                  left: shiftWidth[pos0](),
-                };
-                break;
-              case 'left':
-                targetElPos = {
-                  top: shiftHeight[pos1](),
-                  left: hostElPos.left - targetElWidth,
-                };
-                break;
-              case 'bottom':
-                targetElPos = {
-                  top: shiftHeight[pos0](),
-                  left: shiftWidth[pos1](),
-                };
-                break;
-              default:
-                targetElPos = {
-                  top: hostElPos.top - targetElHeight,
-                  left: shiftWidth[pos1](),
-                };
-                break;
-            }
-
-            return targetElPos;
-          },
-        };
-      },
-    ]);
-}
diff --git a/src/plugins/kibana_legacy/public/angular_bootstrap/tooltip/tooltip.js b/src/plugins/kibana_legacy/public/angular_bootstrap/tooltip/tooltip.js
deleted file mode 100755
index 05235fde9419be..00000000000000
--- a/src/plugins/kibana_legacy/public/angular_bootstrap/tooltip/tooltip.js
+++ /dev/null
@@ -1,423 +0,0 @@
-/* eslint-disable */
-
-import angular from 'angular';
-
-import { initBootstrapPosition } from './position';
-
-export function initBootstrapTooltip() {
-  initBootstrapPosition();
-  /**
-   * The following features are still outstanding: animation as a
-   * function, placement as a function, inside, support for more triggers than
-   * just mouse enter/leave, html tooltips, and selector delegation.
-   */
-  angular
-    .module('ui.bootstrap.tooltip', ['ui.bootstrap.position'])
-
-    /**
-     * The $tooltip service creates tooltip- and popover-like directives as well as
-     * houses global options for them.
-     */
-    .provider('$tooltip', function() {
-      // The default options tooltip and popover.
-      const defaultOptions = {
-        placement: 'top',
-        animation: true,
-        popupDelay: 0,
-      };
-
-      // Default hide triggers for each show trigger
-      const triggerMap = {
-        mouseenter: 'mouseleave',
-        click: 'click',
-        focus: 'blur',
-      };
-
-      // The options specified to the provider globally.
-      const globalOptions = {};
-
-      /**
-       * `options({})` allows global configuration of all tooltips in the
-       * application.
-       *
-       *   var app = angular.module( 'App', ['ui.bootstrap.tooltip'], function( $tooltipProvider ) {
-       *     // place tooltips left instead of top by default
-       *     $tooltipProvider.options( { placement: 'left' } );
-       *   });
-       */
-      this.options = function(value) {
-        angular.extend(globalOptions, value);
-      };
-
-      /**
-       * This allows you to extend the set of trigger mappings available. E.g.:
-       *
-       *   $tooltipProvider.setTriggers( 'openTrigger': 'closeTrigger' );
-       */
-      this.setTriggers = function setTriggers(triggers) {
-        angular.extend(triggerMap, triggers);
-      };
-
-      /**
-       * This is a helper function for translating camel-case to snake-case.
-       */
-      function snake_case(name) {
-        const regexp = /[A-Z]/g;
-        const separator = '-';
-        return name.replace(regexp, function(letter, pos) {
-          return (pos ? separator : '') + letter.toLowerCase();
-        });
-      }
-
-      /**
-       * Returns the actual instance of the $tooltip service.
-       * TODO support multiple triggers
-       */
-      this.$get = [
-        '$window',
-        '$compile',
-        '$timeout',
-        '$document',
-        '$position',
-        '$interpolate',
-        function($window, $compile, $timeout, $document, $position, $interpolate) {
-          return function $tooltip(type, prefix, defaultTriggerShow) {
-            const options = angular.extend({}, defaultOptions, globalOptions);
-
-            /**
-             * Returns an object of show and hide triggers.
-             *
-             * If a trigger is supplied,
-             * it is used to show the tooltip; otherwise, it will use the `trigger`
-             * option passed to the `$tooltipProvider.options` method; else it will
-             * default to the trigger supplied to this directive factory.
-             *
-             * The hide trigger is based on the show trigger. If the `trigger` option
-             * was passed to the `$tooltipProvider.options` method, it will use the
-             * mapped trigger from `triggerMap` or the passed trigger if the map is
-             * undefined; otherwise, it uses the `triggerMap` value of the show
-             * trigger; else it will just use the show trigger.
-             */
-            function getTriggers(trigger) {
-              const show = trigger || options.trigger || defaultTriggerShow;
-              const hide = triggerMap[show] || show;
-              return {
-                show: show,
-                hide: hide,
-              };
-            }
-
-            const directiveName = snake_case(type);
-
-            const startSym = $interpolate.startSymbol();
-            const endSym = $interpolate.endSymbol();
-            const template =
-              '<div ' +
-              directiveName +
-              '-popup ' +
-              'title="' +
-              startSym +
-              'title' +
-              endSym +
-              '" ' +
-              'content="' +
-              startSym +
-              'content' +
-              endSym +
-              '" ' +
-              'placement="' +
-              startSym +
-              'placement' +
-              endSym +
-              '" ' +
-              'animation="animation" ' +
-              'is-open="isOpen"' +
-              '>' +
-              '</div>';
-
-            return {
-              restrict: 'EA',
-              compile: function(tElem, tAttrs) {
-                const tooltipLinker = $compile(template);
-
-                return function link(scope, element, attrs) {
-                  let tooltip;
-                  let tooltipLinkedScope;
-                  let transitionTimeout;
-                  let popupTimeout;
-                  let appendToBody = angular.isDefined(options.appendToBody)
-                    ? options.appendToBody
-                    : false;
-                  let triggers = getTriggers(undefined);
-                  const hasEnableExp = angular.isDefined(attrs[prefix + 'Enable']);
-                  let ttScope = scope.$new(true);
-
-                  const positionTooltip = function() {
-                    const ttPosition = $position.positionElements(
-                      element,
-                      tooltip,
-                      ttScope.placement,
-                      appendToBody
-                    );
-                    ttPosition.top += 'px';
-                    ttPosition.left += 'px';
-
-                    // Now set the calculated positioning.
-                    tooltip.css(ttPosition);
-                  };
-
-                  // By default, the tooltip is not open.
-                  // TODO add ability to start tooltip opened
-                  ttScope.isOpen = false;
-
-                  function toggleTooltipBind() {
-                    if (!ttScope.isOpen) {
-                      showTooltipBind();
-                    } else {
-                      hideTooltipBind();
-                    }
-                  }
-
-                  // Show the tooltip with delay if specified, otherwise show it immediately
-                  function showTooltipBind() {
-                    if (hasEnableExp && !scope.$eval(attrs[prefix + 'Enable'])) {
-                      return;
-                    }
-
-                    prepareTooltip();
-
-                    if (ttScope.popupDelay) {
-                      // Do nothing if the tooltip was already scheduled to pop-up.
-                      // This happens if show is triggered multiple times before any hide is triggered.
-                      if (!popupTimeout) {
-                        popupTimeout = $timeout(show, ttScope.popupDelay, false);
-                        popupTimeout
-                          .then(reposition => reposition())
-                          .catch(error => {
-                            // if the timeout is canceled then the string `canceled` is thrown. To prevent
-                            // this from triggering an 'unhandled promise rejection' in angular 1.5+ the
-                            // $timeout service explicitly tells $q that the promise it generated is "handled"
-                            // but that does not include down chain promises like the one created by calling
-                            // `popupTimeout.then()`. Because of this we need to ignore the "canceled" string
-                            // and only propagate real errors
-                            if (error !== 'canceled') {
-                              throw error;
-                            }
-                          });
-                      }
-                    } else {
-                      show()();
-                    }
-                  }
-
-                  function hideTooltipBind() {
-                    scope.$evalAsync(function() {
-                      hide();
-                    });
-                  }
-
-                  // Show the tooltip popup element.
-                  function show() {
-                    popupTimeout = null;
-
-                    // If there is a pending remove transition, we must cancel it, lest the
-                    // tooltip be mysteriously removed.
-                    if (transitionTimeout) {
-                      $timeout.cancel(transitionTimeout);
-                      transitionTimeout = null;
-                    }
-
-                    // Don't show empty tooltips.
-                    if (!ttScope.content) {
-                      return angular.noop;
-                    }
-
-                    createTooltip();
-
-                    // Set the initial positioning.
-                    tooltip.css({ top: 0, left: 0, display: 'block' });
-                    ttScope.$digest();
-
-                    positionTooltip();
-
-                    // And show the tooltip.
-                    ttScope.isOpen = true;
-                    ttScope.$digest(); // digest required as $apply is not called
-
-                    // Return positioning function as promise callback for correct
-                    // positioning after draw.
-                    return positionTooltip;
-                  }
-
-                  // Hide the tooltip popup element.
-                  function hide() {
-                    // First things first: we don't show it anymore.
-                    ttScope.isOpen = false;
-
-                    //if tooltip is going to be shown after delay, we must cancel this
-                    $timeout.cancel(popupTimeout);
-                    popupTimeout = null;
-
-                    // And now we remove it from the DOM. However, if we have animation, we
-                    // need to wait for it to expire beforehand.
-                    // FIXME: this is a placeholder for a port of the transitions library.
-                    if (ttScope.animation) {
-                      if (!transitionTimeout) {
-                        transitionTimeout = $timeout(removeTooltip, 500);
-                      }
-                    } else {
-                      removeTooltip();
-                    }
-                  }
-
-                  function createTooltip() {
-                    // There can only be one tooltip element per directive shown at once.
-                    if (tooltip) {
-                      removeTooltip();
-                    }
-                    tooltipLinkedScope = ttScope.$new();
-                    tooltip = tooltipLinker(tooltipLinkedScope, function(tooltip) {
-                      if (appendToBody) {
-                        $document.find('body').append(tooltip);
-                      } else {
-                        element.after(tooltip);
-                      }
-                    });
-                  }
-
-                  function removeTooltip() {
-                    transitionTimeout = null;
-                    if (tooltip) {
-                      tooltip.remove();
-                      tooltip = null;
-                    }
-                    if (tooltipLinkedScope) {
-                      tooltipLinkedScope.$destroy();
-                      tooltipLinkedScope = null;
-                    }
-                  }
-
-                  function prepareTooltip() {
-                    prepPlacement();
-                    prepPopupDelay();
-                  }
-
-                  /**
-                   * Observe the relevant attributes.
-                   */
-                  attrs.$observe(type, function(val) {
-                    ttScope.content = val;
-
-                    if (!val && ttScope.isOpen) {
-                      hide();
-                    }
-                  });
-
-                  attrs.$observe(prefix + 'Title', function(val) {
-                    ttScope.title = val;
-                  });
-
-                  function prepPlacement() {
-                    const val = attrs[prefix + 'Placement'];
-                    ttScope.placement = angular.isDefined(val) ? val : options.placement;
-                  }
-
-                  function prepPopupDelay() {
-                    const val = attrs[prefix + 'PopupDelay'];
-                    const delay = parseInt(val, 10);
-                    ttScope.popupDelay = !isNaN(delay) ? delay : options.popupDelay;
-                  }
-
-                  const unregisterTriggers = function() {
-                    element.unbind(triggers.show, showTooltipBind);
-                    element.unbind(triggers.hide, hideTooltipBind);
-                  };
-
-                  function prepTriggers() {
-                    const val = attrs[prefix + 'Trigger'];
-                    unregisterTriggers();
-
-                    triggers = getTriggers(val);
-
-                    if (triggers.show === triggers.hide) {
-                      element.bind(triggers.show, toggleTooltipBind);
-                    } else {
-                      element.bind(triggers.show, showTooltipBind);
-                      element.bind(triggers.hide, hideTooltipBind);
-                    }
-                  }
-
-                  prepTriggers();
-
-                  const animation = scope.$eval(attrs[prefix + 'Animation']);
-                  ttScope.animation = angular.isDefined(animation)
-                    ? !!animation
-                    : options.animation;
-
-                  const appendToBodyVal = scope.$eval(attrs[prefix + 'AppendToBody']);
-                  appendToBody = angular.isDefined(appendToBodyVal)
-                    ? appendToBodyVal
-                    : appendToBody;
-
-                  // if a tooltip is attached to <body> we need to remove it on
-                  // location change as its parent scope will probably not be destroyed
-                  // by the change.
-                  if (appendToBody) {
-                    scope.$on(
-                      '$locationChangeSuccess',
-                      function closeTooltipOnLocationChangeSuccess() {
-                        if (ttScope.isOpen) {
-                          hide();
-                        }
-                      }
-                    );
-                  }
-
-                  // Make sure tooltip is destroyed and removed.
-                  scope.$on('$destroy', function onDestroyTooltip() {
-                    $timeout.cancel(transitionTimeout);
-                    $timeout.cancel(popupTimeout);
-                    unregisterTriggers();
-                    removeTooltip();
-                    ttScope = null;
-                  });
-                };
-              },
-            };
-          };
-        },
-      ];
-    })
-
-    .directive('tooltip', [
-      '$tooltip',
-      function($tooltip) {
-        return $tooltip('tooltip', 'tooltip', 'mouseenter');
-      },
-    ])
-
-    .directive('tooltipPopup', function() {
-      return {
-        restrict: 'EA',
-        replace: true,
-        scope: { content: '@', placement: '@', animation: '&', isOpen: '&' },
-        templateUrl: 'template/tooltip/tooltip-popup.html',
-      };
-    })
-
-    .directive('tooltipHtmlUnsafe', [
-      '$tooltip',
-      function($tooltip) {
-        return $tooltip('tooltipHtmlUnsafe', 'tooltip', 'mouseenter');
-      },
-    ])
-
-    .directive('tooltipHtmlUnsafePopup', function() {
-      return {
-        restrict: 'EA',
-        replace: true,
-        scope: { content: '@', placement: '@', animation: '&', isOpen: '&' },
-        templateUrl: 'template/tooltip/tooltip-html-unsafe-popup.html',
-      };
-    });
-}
diff --git a/src/plugins/kibana_legacy/public/angular_bootstrap/tooltip/tooltip_html_unsafe_popup.html b/src/plugins/kibana_legacy/public/angular_bootstrap/tooltip/tooltip_html_unsafe_popup.html
deleted file mode 100644
index b48bf704989064..00000000000000
--- a/src/plugins/kibana_legacy/public/angular_bootstrap/tooltip/tooltip_html_unsafe_popup.html
+++ /dev/null
@@ -1,4 +0,0 @@
-<div class="bsTooltip {{placement}}" ng-class="{ in: isOpen(), fade: animation() }">	
-    <div class="bsTooltip-arrow"></div>	
-    <div class="bsTooltip-inner" bind-html-unsafe="content"></div>	
-  </div>
\ No newline at end of file
diff --git a/src/plugins/kibana_legacy/public/angular_bootstrap/tooltip/tooltip_popup.html b/src/plugins/kibana_legacy/public/angular_bootstrap/tooltip/tooltip_popup.html
deleted file mode 100644
index eed4ca7d930163..00000000000000
--- a/src/plugins/kibana_legacy/public/angular_bootstrap/tooltip/tooltip_popup.html
+++ /dev/null
@@ -1,4 +0,0 @@
-<div class="bsTooltip {{placement}}" ng-class="{ in: isOpen(), fade: animation() }">	
-    <div class="bsTooltip-arrow"></div>	
-    <div class="bsTooltip-inner" ng-bind="content"></div>	
-  </div>
\ No newline at end of file
diff --git a/src/plugins/kibana_legacy/public/index.ts b/src/plugins/kibana_legacy/public/index.ts
index 13271532881cb4..74c3c2351fde0a 100644
--- a/src/plugins/kibana_legacy/public/index.ts
+++ b/src/plugins/kibana_legacy/public/index.ts
@@ -15,7 +15,6 @@ export const plugin = () => new KibanaLegacyPlugin();
 
 export * from './plugin';
 
-export { PaginateDirectiveProvider, PaginateControlsDirectiveProvider } from './paginate/paginate';
 export * from './angular';
 export * from './notify';
 export * from './utils';
diff --git a/src/plugins/kibana_legacy/public/mocks.ts b/src/plugins/kibana_legacy/public/mocks.ts
index 510e59c7ff190f..3eac98a84d40ad 100644
--- a/src/plugins/kibana_legacy/public/mocks.ts
+++ b/src/plugins/kibana_legacy/public/mocks.ts
@@ -15,7 +15,6 @@ const createSetupContract = (): Setup => ({});
 
 const createStartContract = (): Start => ({
   loadFontAwesome: jest.fn(),
-  loadAngularBootstrap: jest.fn(),
 });
 
 export const kibanaLegacyPluginMock = {
diff --git a/src/plugins/kibana_legacy/public/notify/lib/add_fatal_error.ts b/src/plugins/kibana_legacy/public/notify/lib/add_fatal_error.ts
deleted file mode 100644
index 42207432861aae..00000000000000
--- a/src/plugins/kibana_legacy/public/notify/lib/add_fatal_error.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { FatalErrorsSetup } from '../../../../../core/public';
-import {
-  AngularHttpError,
-  formatAngularHttpError,
-  isAngularHttpError,
-} from './format_angular_http_error';
-
-export function addFatalError(
-  fatalErrors: FatalErrorsSetup,
-  error: AngularHttpError | Error | string,
-  location?: string
-) {
-  // add support for angular http errors to newPlatformFatalErrors
-  if (isAngularHttpError(error)) {
-    error = formatAngularHttpError(error);
-  }
-
-  fatalErrors.add(error, location);
-}
diff --git a/src/plugins/kibana_legacy/public/notify/lib/format_stack.ts b/src/plugins/kibana_legacy/public/notify/lib/format_stack.ts
deleted file mode 100644
index 345891fd156ceb..00000000000000
--- a/src/plugins/kibana_legacy/public/notify/lib/format_stack.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { i18n } from '@kbn/i18n';
-
-// browsers format Error.stack differently; always include message
-export function formatStack(err: Record<string, any>) {
-  if (err.stack && err.stack.indexOf(err.message) === -1) {
-    return i18n.translate('kibana_legacy.notify.toaster.errorMessage', {
-      defaultMessage: `Error: {errorMessage}
-      {errorStack}`,
-      values: {
-        errorMessage: err.message,
-        errorStack: err.stack,
-      },
-    });
-  }
-  return err.stack;
-}
diff --git a/src/plugins/kibana_legacy/public/notify/lib/index.ts b/src/plugins/kibana_legacy/public/notify/lib/index.ts
index 41f723f9c1ea25..59ad069c9793cc 100644
--- a/src/plugins/kibana_legacy/public/notify/lib/index.ts
+++ b/src/plugins/kibana_legacy/public/notify/lib/index.ts
@@ -8,10 +8,8 @@
 
 export { formatESMsg } from './format_es_msg';
 export { formatMsg } from './format_msg';
-export { formatStack } from './format_stack';
 export {
   isAngularHttpError,
   formatAngularHttpError,
   AngularHttpError,
 } from './format_angular_http_error';
-export { addFatalError } from './add_fatal_error';
diff --git a/src/plugins/kibana_legacy/public/paginate/_paginate.scss b/src/plugins/kibana_legacy/public/paginate/_paginate.scss
deleted file mode 100644
index 9824ff2d8dff36..00000000000000
--- a/src/plugins/kibana_legacy/public/paginate/_paginate.scss
+++ /dev/null
@@ -1,56 +0,0 @@
-paginate {
-  display: block;
-
-  paginate-controls {
-    display: flex;
-    align-items: center;
-    padding: $euiSizeXS $euiSizeXS $euiSizeS;
-    text-align: center;
-
-    .pagination-other-pages {
-      flex: 1 0 auto;
-      display: flex;
-      justify-content: center;
-    }
-
-    .pagination-other-pages-list {
-      flex: 0 0 auto;
-      display: flex;
-      justify-content: center;
-      padding: 0;
-      margin: 0;
-      list-style: none;
-
-      > li {
-        flex: 0 0 auto;
-        user-select: none;
-
-        a {
-          text-decoration: none;
-          background-color: $euiColorLightestShade;
-          margin-left: $euiSizeXS / 2;
-          padding: $euiSizeS $euiSizeM;
-        }
-
-        a:hover {
-          text-decoration: underline;
-        }
-
-        &.active a { // stylelint-disable-line selector-no-qualifying-type
-          text-decoration: none !important;
-          font-weight: $euiFontWeightBold;
-          color: $euiColorDarkShade;
-          cursor: default;
-        }
-      }
-    }
-
-    .pagination-size {
-      flex: 0 0 auto;
-
-      input[type=number] {
-        width: 3em;
-      }
-    }
-  }
-}
diff --git a/src/plugins/kibana_legacy/public/paginate/paginate.d.ts b/src/plugins/kibana_legacy/public/paginate/paginate.d.ts
deleted file mode 100644
index 770f7f7ec7c126..00000000000000
--- a/src/plugins/kibana_legacy/public/paginate/paginate.d.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-export function PaginateDirectiveProvider($parse: any, $compile: any): any;
-export function PaginateControlsDirectiveProvider(): any;
diff --git a/src/plugins/kibana_legacy/public/paginate/paginate.js b/src/plugins/kibana_legacy/public/paginate/paginate.js
deleted file mode 100644
index ebab8f35571de0..00000000000000
--- a/src/plugins/kibana_legacy/public/paginate/paginate.js
+++ /dev/null
@@ -1,217 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import _ from 'lodash';
-import { i18n } from '@kbn/i18n';
-import './_paginate.scss';
-import paginateControlsTemplate from './paginate_controls.html';
-
-export function PaginateDirectiveProvider($parse, $compile) {
-  return {
-    restrict: 'E',
-    scope: true,
-    link: {
-      pre: function ($scope, $el, attrs) {
-        if (_.isUndefined(attrs.bottomControls)) attrs.bottomControls = true;
-        if ($el.find('paginate-controls.paginate-bottom').length === 0 && attrs.bottomControls) {
-          $el.append($compile('<paginate-controls class="paginate-bottom">')($scope));
-        }
-      },
-      post: function ($scope, $el, attrs) {
-        if (_.isUndefined(attrs.topControls)) attrs.topControls = false;
-        if ($el.find('paginate-controls.paginate-top').length === 0 && attrs.topControls) {
-          $el.prepend($compile('<paginate-controls class="paginate-top">')($scope));
-        }
-
-        const paginate = $scope.paginate;
-
-        // add some getters to the controller powered by attributes
-        paginate.getList = $parse(attrs.list);
-        paginate.perPageProp = attrs.perPageProp;
-
-        if (attrs.perPage) {
-          paginate.perPage = attrs.perPage;
-          $scope.showSelector = false;
-        } else {
-          $scope.showSelector = true;
-        }
-
-        paginate.otherWidthGetter = $parse(attrs.otherWidth);
-
-        paginate.init();
-      },
-    },
-    controllerAs: 'paginate',
-    controller: function ($scope, $document) {
-      const self = this;
-      const ALL = 0;
-      const allSizeTitle = i18n.translate('kibana_legacy.paginate.size.allDropDownOptionLabel', {
-        defaultMessage: 'All',
-      });
-
-      self.sizeOptions = [
-        { title: '10', value: 10 },
-        { title: '25', value: 25 },
-        { title: '100', value: 100 },
-        { title: allSizeTitle, value: ALL },
-      ];
-
-      // setup the watchers, called in the post-link function
-      self.init = function () {
-        self.perPage = _.parseInt(self.perPage) || $scope[self.perPageProp];
-
-        $scope.$watchMulti(
-          ['paginate.perPage', self.perPageProp, self.otherWidthGetter],
-          function (vals, oldVals) {
-            const intChanges = vals[0] !== oldVals[0];
-
-            if (intChanges) {
-              if (!setPerPage(self.perPage)) {
-                // if we are not able to set the external value,
-                // render now, otherwise wait for the external value
-                // to trigger the watcher again
-                self.renderList();
-              }
-              return;
-            }
-
-            self.perPage = _.parseInt(self.perPage) || $scope[self.perPageProp];
-            if (self.perPage == null) {
-              self.perPage = ALL;
-              return;
-            }
-
-            self.renderList();
-          }
-        );
-
-        $scope.$watch('page', self.changePage);
-        $scope.$watchCollection(self.getList, function (list) {
-          $scope.list = list;
-          self.renderList();
-        });
-      };
-
-      self.goToPage = function (number) {
-        if (number) {
-          if (number.hasOwnProperty('number')) number = number.number;
-          $scope.page = $scope.pages[number - 1] || $scope.pages[0];
-        }
-      };
-
-      self.goToTop = function goToTop() {
-        $document.scrollTop(0);
-      };
-
-      self.renderList = function () {
-        $scope.pages = [];
-        if (!$scope.list) return;
-
-        const perPage = _.parseInt(self.perPage);
-        const count = perPage ? Math.ceil($scope.list.length / perPage) : 1;
-
-        _.times(count, function (i) {
-          let page;
-
-          if (perPage) {
-            const start = perPage * i;
-            page = $scope.list.slice(start, start + perPage);
-          } else {
-            page = $scope.list.slice(0);
-          }
-
-          page.number = i + 1;
-          page.i = i;
-
-          page.count = count;
-          page.first = page.number === 1;
-          page.last = page.number === count;
-          page.firstItem = (page.number - 1) * perPage + 1;
-          page.lastItem = Math.min(page.number * perPage, $scope.list.length);
-
-          page.prev = $scope.pages[i - 1];
-          if (page.prev) page.prev.next = page;
-
-          $scope.pages.push(page);
-        });
-
-        // set the new page, or restore the previous page number
-        if ($scope.page && $scope.page.i < $scope.pages.length) {
-          $scope.page = $scope.pages[$scope.page.i];
-        } else {
-          $scope.page = $scope.pages[0];
-        }
-
-        if ($scope.page && $scope.onPageChanged) {
-          $scope.onPageChanged($scope.page);
-        }
-      };
-
-      self.changePage = function (page) {
-        if (!page) {
-          $scope.otherPages = null;
-          return;
-        }
-
-        // setup the list of the other pages to link to
-        $scope.otherPages = [];
-        const width = +self.otherWidthGetter($scope) || 5;
-        let left = page.i - Math.round((width - 1) / 2);
-        let right = left + width - 1;
-
-        // shift neg count from left to right
-        if (left < 0) {
-          right += 0 - left;
-          left = 0;
-        }
-
-        // shift extra right nums to left
-        const lastI = page.count - 1;
-        if (right > lastI) {
-          right = lastI;
-          left = right - width + 1;
-        }
-
-        for (let i = left; i <= right; i++) {
-          const other = $scope.pages[i];
-
-          if (!other) continue;
-
-          $scope.otherPages.push(other);
-          if (other.last) $scope.otherPages.containsLast = true;
-          if (other.first) $scope.otherPages.containsFirst = true;
-        }
-
-        if ($scope.onPageChanged) {
-          $scope.onPageChanged($scope.page);
-        }
-      };
-
-      function setPerPage(val) {
-        let $ppParent = $scope;
-
-        while ($ppParent && !_.has($ppParent, self.perPageProp)) {
-          $ppParent = $ppParent.$parent;
-        }
-
-        if ($ppParent) {
-          $ppParent[self.perPageProp] = val;
-          return true;
-        }
-      }
-    },
-  };
-}
-
-export function PaginateControlsDirectiveProvider() {
-  // this directive is automatically added by paginate if not found within it's $el
-  return {
-    restrict: 'E',
-    template: paginateControlsTemplate,
-  };
-}
diff --git a/src/plugins/kibana_legacy/public/paginate/paginate_controls.html b/src/plugins/kibana_legacy/public/paginate/paginate_controls.html
deleted file mode 100644
index a553bc22317203..00000000000000
--- a/src/plugins/kibana_legacy/public/paginate/paginate_controls.html
+++ /dev/null
@@ -1,98 +0,0 @@
-<button
-  class="kuiLink"
-  ng-if="linkToTop"
-  ng-click="paginate.goToTop()"
-  data-test-subj="paginateControlsLinkToTop"
-  i18n-id="kibana_legacy.paginate.controls.scrollTopButtonLabel"
-  i18n-default-message="Scroll to top"
-></button>
-
-<div
-  class="pagination-other-pages"
-  data-test-subj="paginationControls"
->
-  <ul class="pagination-other-pages-list pagination-sm" ng-if="page.count > 1">
-    <li ng-style="{'visibility':'hidden'}" ng-if="page.first">
-      <button
-        class="euiButtonEmpty euiButtonEmpty--text euiButtonEmpty--small euiPaginationButton"
-        ng-click="paginate.goToPage(page.prev)"
-      >
-        <span class="euiButtonEmpty__content">«</span>
-      </button>
-    </li>
-    <li ng-style="{'visibility':'visible'}" ng-if="!page.first">
-      <button
-        class="euiButtonEmpty euiButtonEmpty--text euiButtonEmpty--small euiPaginationButton"
-        ng-click="paginate.goToPage(page.prev)"
-      >
-        <span class="euiButtonEmpty__content">«</span>
-      </button>
-    </li>
-
-    <li ng-if="!otherPages.containsFirst">
-      <button
-        class="euiButtonEmpty euiButtonEmpty--text euiButtonEmpty--small euiPaginationButton"
-        ng-click="paginate.goToPage(1)"
-      >
-        <span class="euiButtonEmpty__content">1</span>
-      </button>
-      ...
-    </li>
-
-    <li
-      ng-repeat="other in otherPages"
-      ng-class="{ active: other.number === page.number }"
-    >
-      <button
-        class="euiButtonEmpty euiButtonEmpty--text euiButtonEmpty--small euiPaginationButton"
-        ng-class="{ 'euiPaginationButton-isActive': other.number === page.number }"
-        ng-click="paginate.goToPage(other)"
-      >
-        <span class="euiButtonEmpty__content">{{other.number}}</span>
-      </button>
-    </li>
-
-    <li ng-if="!otherPages.containsLast">
-      ...
-      <button
-        class="euiButtonEmpty euiButtonEmpty--text euiButtonEmpty--small euiPaginationButton"
-        ng-click="paginate.goToPage(page.count)"
-      >
-        <span class="euiButtonEmpty__content">{{page.count}}</span>
-      </button>
-    </li>
-
-    <li ng-style="{'visibility':'hidden'}" ng-if="page.last">
-      <button
-        class="euiButtonEmpty euiButtonEmpty--text euiButtonEmpty--small euiPaginationButton"
-        data-test-subj="paginateNext"
-        ng-click="paginate.goToPage(page.next)"
-      >
-        <span class="euiButtonEmpty__content">»</span>
-      </button>
-    </li>
-    <li ng-style="{'visibility':'visible'}" ng-if="!page.last">
-      <button
-        class="euiButtonEmpty euiButtonEmpty--text euiButtonEmpty--small euiPaginationButton"
-        data-test-subj="paginateNext"
-        ng-click="paginate.goToPage(page.next)"
-      >
-        <span class="euiButtonEmpty__content">»</span>
-      </button>
-    </li>
-  </ul>
-</div>
-
-<form class="form-inline pagination-size" ng-if="showSelector">
-  <div class="form-group">
-    <label
-      i18n-id="kibana_legacy.paginate.controls.pageSizeLabel"
-      i18n-default-message="Page Size"
-    ></label>
-    <select
-      ng-model="paginate.perPage"
-      ng-options="opt.value as opt.title for opt in paginate.sizeOptions"
-      data-test-subj="paginateControlsPageSizeSelect"
-    ></select>
-  </div>
-</form>
diff --git a/src/plugins/kibana_legacy/public/plugin.ts b/src/plugins/kibana_legacy/public/plugin.ts
index e5244c110ad205..ac78e8cac4f074 100644
--- a/src/plugins/kibana_legacy/public/plugin.ts
+++ b/src/plugins/kibana_legacy/public/plugin.ts
@@ -24,14 +24,6 @@ export class KibanaLegacyPlugin {
       loadFontAwesome: async () => {
         await import('./font_awesome');
       },
-      /**
-       * Loads angular bootstrap modules. Should be removed once the last consumer has migrated to EUI
-       * @deprecated
-       */
-      loadAngularBootstrap: async () => {
-        const { initAngularBootstrap } = await import('./angular_bootstrap');
-        initAngularBootstrap();
-      },
     };
   }
 }
diff --git a/src/plugins/kibana_legacy/public/utils/index.ts b/src/plugins/kibana_legacy/public/utils/index.ts
index 94233558b4627c..9bfc185b6a69e9 100644
--- a/src/plugins/kibana_legacy/public/utils/index.ts
+++ b/src/plugins/kibana_legacy/public/utils/index.ts
@@ -6,9 +6,5 @@
  * Side Public License, v 1.
  */
 
-// @ts-ignore
-export { KbnAccessibleClickProvider } from './kbn_accessible_click';
 // @ts-ignore
 export { PrivateProvider, IPrivate } from './private';
-// @ts-ignore
-export { registerListenEventListener } from './register_listen_event_listener';
diff --git a/src/plugins/kibana_legacy/public/utils/kbn_accessible_click.d.ts b/src/plugins/kibana_legacy/public/utils/kbn_accessible_click.d.ts
deleted file mode 100644
index 16adb3750e9ea6..00000000000000
--- a/src/plugins/kibana_legacy/public/utils/kbn_accessible_click.d.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { Injectable, IDirectiveFactory, IScope, IAttributes, IController } from 'angular';
-
-export const KbnAccessibleClickProvider: Injectable<
-  IDirectiveFactory<IScope, JQLite, IAttributes, IController>
->;
diff --git a/src/plugins/kibana_legacy/public/utils/kbn_accessible_click.js b/src/plugins/kibana_legacy/public/utils/kbn_accessible_click.js
deleted file mode 100644
index adcd133bf17193..00000000000000
--- a/src/plugins/kibana_legacy/public/utils/kbn_accessible_click.js
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { accessibleClickKeys, keys } from '@elastic/eui';
-
-export function KbnAccessibleClickProvider() {
-  return {
-    restrict: 'A',
-    controller: ($element) => {
-      $element.on('keydown', (e) => {
-        // Prevent a scroll from occurring if the user has hit space.
-        if (e.key === keys.SPACE) {
-          e.preventDefault();
-        }
-      });
-    },
-    link: (scope, element, attrs) => {
-      // The whole point of this directive is to hack in functionality that native buttons provide
-      // by default.
-      const elementType = element.prop('tagName');
-
-      if (elementType === 'BUTTON') {
-        throw new Error(`kbnAccessibleClick doesn't need to be used on a button.`);
-      }
-
-      if (elementType === 'A' && attrs.href !== undefined) {
-        throw new Error(
-          `kbnAccessibleClick doesn't need to be used on a link if it has a href attribute.`
-        );
-      }
-
-      // We're emulating a click action, so we should already have a regular click handler defined.
-      if (!attrs.ngClick) {
-        throw new Error('kbnAccessibleClick requires ng-click to be defined on its element.');
-      }
-
-      // If the developer hasn't already specified attributes required for accessibility, add them.
-      if (attrs.tabindex === undefined) {
-        element.attr('tabindex', '0');
-      }
-
-      if (attrs.role === undefined) {
-        element.attr('role', 'button');
-      }
-
-      element.on('keyup', (e) => {
-        // Support keyboard accessibility by emulating mouse click on ENTER or SPACE keypress.
-        if (accessibleClickKeys[e.key]) {
-          // Delegate to the click handler on the element (assumed to be ng-click).
-          element.click();
-        }
-      });
-    },
-  };
-}
diff --git a/src/plugins/kibana_legacy/public/utils/register_listen_event_listener.d.ts b/src/plugins/kibana_legacy/public/utils/register_listen_event_listener.d.ts
deleted file mode 100644
index 800965baba4b4e..00000000000000
--- a/src/plugins/kibana_legacy/public/utils/register_listen_event_listener.d.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-export function registerListenEventListener($rootScope: unknown): void;
diff --git a/src/plugins/kibana_legacy/public/utils/register_listen_event_listener.js b/src/plugins/kibana_legacy/public/utils/register_listen_event_listener.js
deleted file mode 100644
index be91a69a9240df..00000000000000
--- a/src/plugins/kibana_legacy/public/utils/register_listen_event_listener.js
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-export function registerListenEventListener($rootScope) {
-  /**
-   * Helper that registers an event listener, and removes that listener when
-   * the $scope is destroyed.
-   *
-   * @param  {EventEmitter} emitter - the event emitter to listen to
-   * @param  {string} eventName - the event name
-   * @param  {Function} handler - the event handler
-   * @return {undefined}
-   */
-  $rootScope.constructor.prototype.$listen = function (emitter, eventName, handler) {
-    emitter.on(eventName, handler);
-    this.$on('$destroy', function () {
-      emitter.off(eventName, handler);
-    });
-  };
-}
diff --git a/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts b/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts
index 53eb49e1013b05..a8a391995b0051 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts
@@ -408,12 +408,12 @@ export const stackManagementSchema: MakeSchemaFrom<UsageStats> = {
     type: 'text',
     _meta: { description: 'Non-default value of setting.' },
   },
-  'apm:enableSignificantTerms': {
+  'observability:enableInspectEsQueries': {
     type: 'boolean',
     _meta: { description: 'Non-default value of setting.' },
   },
-  'observability:enableInspectEsQueries': {
-    type: 'boolean',
+  'observability:maxSuggestions': {
+    type: 'integer',
     _meta: { description: 'Non-default value of setting.' },
   },
   'banners:placement': {
diff --git a/src/plugins/kibana_usage_collection/server/collectors/management/types.ts b/src/plugins/kibana_usage_collection/server/collectors/management/types.ts
index b76ef14e62b8c3..7ea80ffb77dda3 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/management/types.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/management/types.ts
@@ -34,8 +34,8 @@ export interface UsageStats {
   'discover:showMultiFields': boolean;
   'discover:maxDocFieldsDisplayed': number;
   'securitySolution:rulesTableRefresh': string;
-  'apm:enableSignificantTerms': boolean;
   'observability:enableInspectEsQueries': boolean;
+  'observability:maxSuggestions': number;
   'visualize:enableLabs': boolean;
   'visualization:heatmap:maxBuckets': number;
   'visualization:colorMapping': string;
diff --git a/src/plugins/telemetry/schema/oss_plugins.json b/src/plugins/telemetry/schema/oss_plugins.json
index 2363c0ca103a2d..c6724056f77a54 100644
--- a/src/plugins/telemetry/schema/oss_plugins.json
+++ b/src/plugins/telemetry/schema/oss_plugins.json
@@ -7629,14 +7629,14 @@
             "description": "Non-default value of setting."
           }
         },
-        "apm:enableSignificantTerms": {
+        "observability:enableInspectEsQueries": {
           "type": "boolean",
           "_meta": {
             "description": "Non-default value of setting."
           }
         },
-        "observability:enableInspectEsQueries": {
-          "type": "boolean",
+        "observability:maxSuggestions": {
+          "type": "integer",
           "_meta": {
             "description": "Non-default value of setting."
           }
@@ -9088,6 +9088,12 @@
           "_meta": {
             "description": "Number of TSVB visualizations using \"last value\" as a time range"
           }
+        },
+        "timeseries_table_use_aggregate_function": {
+          "type": "long",
+          "_meta": {
+            "description": "Number of TSVB table visualizations using aggregate function"
+          }
         }
       }
     },
diff --git a/src/plugins/vis_types/table/kibana.json b/src/plugins/vis_types/table/kibana.json
index b3ebd5117bbc8b..a56965a2143494 100644
--- a/src/plugins/vis_types/table/kibana.json
+++ b/src/plugins/vis_types/table/kibana.json
@@ -6,8 +6,7 @@
   "requiredPlugins": [
     "expressions",
     "visualizations",
-    "data",
-    "kibanaLegacy"
+    "data"
   ],
   "requiredBundles": [
     "kibanaUtils",
diff --git a/src/plugins/vis_types/table/tsconfig.json b/src/plugins/vis_types/table/tsconfig.json
index 9325064d571d02..578b10fb09be8e 100644
--- a/src/plugins/vis_types/table/tsconfig.json
+++ b/src/plugins/vis_types/table/tsconfig.json
@@ -20,7 +20,6 @@
     { "path": "../../usage_collection/tsconfig.json" },
     { "path": "../../expressions/tsconfig.json" },
     { "path": "../../kibana_utils/tsconfig.json" },
-    { "path": "../../kibana_legacy/tsconfig.json" },
     { "path": "../../kibana_react/tsconfig.json" },
     { "path": "../../vis_default_editor/tsconfig.json" },
     { "path": "../../field_formats/tsconfig.json" }
diff --git a/src/plugins/vis_types/timeseries/server/usage_collector/get_usage_collector.test.ts b/src/plugins/vis_types/timeseries/server/usage_collector/get_usage_collector.test.ts
index aac6d879f48fd2..3f3a204d29263f 100644
--- a/src/plugins/vis_types/timeseries/server/usage_collector/get_usage_collector.test.ts
+++ b/src/plugins/vis_types/timeseries/server/usage_collector/get_usage_collector.test.ts
@@ -49,6 +49,23 @@ const mockedSavedObject = {
         }),
       },
     },
+    {
+      attributes: {
+        visState: JSON.stringify({
+          type: 'metrics',
+          title: 'TSVB visualization 4',
+          params: {
+            type: 'table',
+            series: [
+              {
+                aggregate_by: 'test',
+                aggregate_function: 'max',
+              },
+            ],
+          },
+        }),
+      },
+    },
   ],
 } as SavedObjectsFindResponse;
 
@@ -83,6 +100,27 @@ const mockedSavedObjectsByValue = [
       }),
     },
   },
+  {
+    attributes: {
+      panelsJSON: JSON.stringify({
+        type: 'visualization',
+        embeddableConfig: {
+          savedVis: {
+            type: 'metrics',
+            params: {
+              type: 'table',
+              series: [
+                {
+                  aggregate_by: 'test1',
+                  aggregate_function: 'sum',
+                },
+              ],
+            },
+          },
+        },
+      }),
+    },
+  },
 ];
 
 const getMockCollectorFetchContext = (
@@ -142,6 +180,58 @@ describe('Timeseries visualization usage collector', () => {
     expect(result).toBeUndefined();
   });
 
+  test('Returns undefined when aggregate function is null', async () => {
+    const mockCollectorFetchContext = getMockCollectorFetchContext({
+      saved_objects: [
+        {
+          attributes: {
+            panelsJSON: JSON.stringify({
+              type: 'visualization',
+              embeddableConfig: {
+                savedVis: {
+                  type: 'metrics',
+                  params: {
+                    type: 'table',
+                    series: [
+                      {
+                        aggregate_by: null,
+                        aggregate_function: null,
+                      },
+                    ],
+                  },
+                },
+              },
+            }),
+          },
+        },
+        {
+          attributes: {
+            panelsJSON: JSON.stringify({
+              type: 'visualization',
+              embeddableConfig: {
+                savedVis: {
+                  type: 'metrics',
+                  params: {
+                    type: 'table',
+                    series: [
+                      {
+                        axis_position: 'right',
+                      },
+                    ],
+                  },
+                },
+              },
+            }),
+          },
+        },
+      ],
+    } as SavedObjectsFindResponse);
+
+    const result = await getStats(mockCollectorFetchContext.soClient);
+
+    expect(result).toBeUndefined();
+  });
+
   test('Summarizes visualizations response data', async () => {
     const mockCollectorFetchContext = getMockCollectorFetchContext(
       mockedSavedObject,
@@ -149,8 +239,9 @@ describe('Timeseries visualization usage collector', () => {
     );
     const result = await getStats(mockCollectorFetchContext.soClient);
 
-    expect(result).toMatchObject({
-      timeseries_use_last_value_mode_total: 3,
+    expect(result).toStrictEqual({
+      timeseries_use_last_value_mode_total: 5,
+      timeseries_table_use_aggregate_function: 2,
     });
   });
 });
diff --git a/src/plugins/vis_types/timeseries/server/usage_collector/get_usage_collector.ts b/src/plugins/vis_types/timeseries/server/usage_collector/get_usage_collector.ts
index 8309d51a9d56d9..58f0c9c7f14597 100644
--- a/src/plugins/vis_types/timeseries/server/usage_collector/get_usage_collector.ts
+++ b/src/plugins/vis_types/timeseries/server/usage_collector/get_usage_collector.ts
@@ -15,14 +15,16 @@ import type {
   SavedObjectsFindResult,
 } from '../../../../../core/server';
 import type { SavedVisState } from '../../../../visualizations/common';
+import type { Panel } from '../../common/types';
 
 export interface TimeseriesUsage {
   timeseries_use_last_value_mode_total: number;
+  timeseries_table_use_aggregate_function: number;
 }
 
 const doTelemetryFoVisualizations = async (
   soClient: SavedObjectsClientContract | ISavedObjectsRepository,
-  telemetryUseLastValueMode: (savedVis: SavedVisState) => void
+  calculateTelemetry: (savedVis: SavedVisState<Panel>) => void
 ) => {
   const finder = await soClient.createPointInTimeFinder({
     type: 'visualization',
@@ -34,9 +36,9 @@ const doTelemetryFoVisualizations = async (
     (response.saved_objects || []).forEach(({ attributes }: SavedObjectsFindResult<any>) => {
       if (attributes?.visState) {
         try {
-          const visState: SavedVisState = JSON.parse(attributes.visState);
+          const visState: SavedVisState<Panel> = JSON.parse(attributes.visState);
 
-          telemetryUseLastValueMode(visState);
+          calculateTelemetry(visState);
         } catch {
           // nothing to be here, "so" not valid
         }
@@ -48,12 +50,12 @@ const doTelemetryFoVisualizations = async (
 
 const doTelemetryForByValueVisualizations = async (
   soClient: SavedObjectsClientContract | ISavedObjectsRepository,
-  telemetryUseLastValueMode: (savedVis: SavedVisState) => void
+  telemetryUseLastValueMode: (savedVis: SavedVisState<Panel>) => void
 ) => {
   const byValueVisualizations = await findByValueEmbeddables(soClient, 'visualization');
 
   for (const item of byValueVisualizations) {
-    telemetryUseLastValueMode(item.savedVis as unknown as SavedVisState);
+    telemetryUseLastValueMode(item.savedVis as unknown as SavedVisState<Panel>);
   }
 };
 
@@ -62,9 +64,10 @@ export const getStats = async (
 ): Promise<TimeseriesUsage | undefined> => {
   const timeseriesUsage = {
     timeseries_use_last_value_mode_total: 0,
+    timeseries_table_use_aggregate_function: 0,
   };
 
-  function telemetryUseLastValueMode(visState: SavedVisState) {
+  function telemetryUseLastValueMode(visState: SavedVisState<Panel>) {
     if (
       visState.type === 'metrics' &&
       visState.params.type !== 'timeseries' &&
@@ -75,10 +78,33 @@ export const getStats = async (
     }
   }
 
+  function telemetryTableAggFunction(visState: SavedVisState<Panel>) {
+    if (
+      visState.type === 'metrics' &&
+      visState.params.type === 'table' &&
+      visState.params.series &&
+      visState.params.series.length > 0
+    ) {
+      const usesAggregateFunction = visState.params.series.some(
+        (s) => s.aggregate_by && s.aggregate_function
+      );
+      if (usesAggregateFunction) {
+        timeseriesUsage.timeseries_table_use_aggregate_function++;
+      }
+    }
+  }
+
   await Promise.all([
+    // last value usage telemetry
     doTelemetryFoVisualizations(soClient, telemetryUseLastValueMode),
     doTelemetryForByValueVisualizations(soClient, telemetryUseLastValueMode),
+    //  table aggregate function telemetry
+    doTelemetryFoVisualizations(soClient, telemetryTableAggFunction),
+    doTelemetryForByValueVisualizations(soClient, telemetryTableAggFunction),
   ]);
 
-  return timeseriesUsage.timeseries_use_last_value_mode_total ? timeseriesUsage : undefined;
+  return timeseriesUsage.timeseries_use_last_value_mode_total ||
+    timeseriesUsage.timeseries_table_use_aggregate_function
+    ? timeseriesUsage
+    : undefined;
 };
diff --git a/src/plugins/vis_types/timeseries/server/usage_collector/register_timeseries_collector.ts b/src/plugins/vis_types/timeseries/server/usage_collector/register_timeseries_collector.ts
index 6fccd7ef30171d..b96d6ce4c5da80 100644
--- a/src/plugins/vis_types/timeseries/server/usage_collector/register_timeseries_collector.ts
+++ b/src/plugins/vis_types/timeseries/server/usage_collector/register_timeseries_collector.ts
@@ -18,6 +18,10 @@ export function registerTimeseriesUsageCollector(collectorSet: UsageCollectionSe
         type: 'long',
         _meta: { description: 'Number of TSVB visualizations using "last value" as a time range' },
       },
+      timeseries_table_use_aggregate_function: {
+        type: 'long',
+        _meta: { description: 'Number of TSVB table visualizations using aggregate function' },
+      },
     },
     fetch: async ({ soClient }) => await getStats(soClient),
   });
diff --git a/test/api_integration/apis/custom_integration/integrations.ts b/test/api_integration/apis/custom_integration/integrations.ts
index d8f098fdc1fcf2..2d1d085198bb48 100644
--- a/test/api_integration/apis/custom_integration/integrations.ts
+++ b/test/api_integration/apis/custom_integration/integrations.ts
@@ -20,7 +20,11 @@ export default function ({ getService }: FtrProviderContext) {
         .expect(200);
 
       expect(resp.body).to.be.an('array');
-      expect(resp.body.length).to.be.above(0);
+      expect(resp.body.length).to.be.above(2); // Should at least have registered the three sample data-sets
+
+      ['flights', 'logs', 'ecommerce'].forEach((sampleData) => {
+        expect(resp.body.findIndex((c: { id: string }) => c.id === sampleData)).to.be.above(-1);
+      });
     });
   });
 }
diff --git a/src/plugins/kibana_legacy/public/angular/watch_multi.d.ts b/typings/js_sql_parser.d.ts
similarity index 85%
rename from src/plugins/kibana_legacy/public/angular/watch_multi.d.ts
rename to typings/js_sql_parser.d.ts
index 5d2031148f3dec..b58091d0117e31 100644
--- a/src/plugins/kibana_legacy/public/angular/watch_multi.d.ts
+++ b/typings/js_sql_parser.d.ts
@@ -6,4 +6,4 @@
  * Side Public License, v 1.
  */
 
-export function watchMultiDecorator($provide: unknown): void;
+declare module 'js-sql-parser';
diff --git a/x-pack/plugins/apm/common/anomaly_detection.ts b/x-pack/plugins/apm/common/anomaly_detection.ts
index 43a779407d2a49..eb7c74a4540be3 100644
--- a/x-pack/plugins/apm/common/anomaly_detection.ts
+++ b/x-pack/plugins/apm/common/anomaly_detection.ts
@@ -33,6 +33,8 @@ export function getSeverityColor(score: number) {
   return mlGetSeverityColor(score);
 }
 
+export const ML_TRANSACTION_LATENCY_DETECTOR_INDEX = 0;
+
 export const ML_ERRORS = {
   INVALID_LICENSE: i18n.translate(
     'xpack.apm.anomaly_detection.error.invalid_license',
diff --git a/x-pack/plugins/apm/common/utils/apm_ml_anomaly_query.ts b/x-pack/plugins/apm/common/utils/apm_ml_anomaly_query.ts
new file mode 100644
index 00000000000000..26b859d37cf7f4
--- /dev/null
+++ b/x-pack/plugins/apm/common/utils/apm_ml_anomaly_query.ts
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export function apmMlAnomalyQuery(detectorIndex: 0 | 1 | 2) {
+  return [
+    {
+      bool: {
+        filter: [
+          {
+            terms: {
+              result_type: ['model_plot', 'record'],
+            },
+          },
+          {
+            term: { detector_index: detectorIndex },
+          },
+        ],
+      },
+    },
+  ];
+}
diff --git a/x-pack/plugins/apm/dev_docs/feature_flags.md b/x-pack/plugins/apm/dev_docs/feature_flags.md
deleted file mode 100644
index 9f722dd5eac5a0..00000000000000
--- a/x-pack/plugins/apm/dev_docs/feature_flags.md
+++ /dev/null
@@ -1,14 +0,0 @@
-## Feature flags
-
-To set up a flagged feature, add the name of the feature key (`apm:myFeature`) to [commmon/ui_settings_keys.ts](./common/ui_settings_keys.ts) and the feature parameters to [server/ui_settings.ts](./server/ui_settings.ts).
-
-Test for the feature like:
-
-```js
-import { myFeatureEnabled } from '../ui_settings_keys';
-if (core.uiSettings.get(myFeatureEnabled)) {
-  doStuff();
-}
-```
-
-Settings can be managed in Kibana under Stack Management > Advanced Settings > Observability.
\ No newline at end of file
diff --git a/x-pack/plugins/apm/ftr_e2e/cypress/integration/power_user/rules/error_count.spec.ts b/x-pack/plugins/apm/ftr_e2e/cypress/integration/power_user/rules/error_count.spec.ts
new file mode 100644
index 00000000000000..42da37aa7ef57e
--- /dev/null
+++ b/x-pack/plugins/apm/ftr_e2e/cypress/integration/power_user/rules/error_count.spec.ts
@@ -0,0 +1,108 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+describe('Rules', () => {
+  describe('Error count', () => {
+    const ruleName = 'Error count threshold';
+    const comboBoxInputSelector =
+      '.euiPopover__panel-isOpen [data-test-subj=comboBoxSearchInput]';
+    const confirmModalButtonSelector =
+      '.euiModal button[data-test-subj=confirmModalConfirmButton]';
+    const deleteButtonSelector =
+      '[data-test-subj=deleteActionHoverButton]:first';
+    const editButtonSelector = '[data-test-subj=editActionHoverButton]:first';
+
+    describe('when created from APM', () => {
+      describe('when created from Service Inventory', () => {
+        before(() => {
+          cy.loginAsPowerUser();
+        });
+
+        it('creates and updates a rule', () => {
+          // Create a rule in APM
+          cy.visit('/app/apm/services');
+          cy.contains('Alerts and rules').click();
+          cy.contains('Error count').click();
+          cy.contains('Create threshold rule').click();
+
+          // Change the environment to "testing"
+          cy.contains('Environment All').click();
+          cy.get(comboBoxInputSelector).type('testing{enter}');
+
+          // Save, with no actions
+          cy.contains('button:not(:disabled)', 'Save').click();
+          cy.get(confirmModalButtonSelector).click();
+
+          cy.contains(`Created rule "${ruleName}`);
+
+          // Go to Stack Management
+          cy.contains('Alerts and rules').click();
+          cy.contains('Manage rules').click();
+
+          // Edit the rule, changing the environment to "All"
+          cy.get(editButtonSelector).click();
+          cy.contains('Environment testing').click();
+          cy.get(comboBoxInputSelector).type('All{enter}');
+          cy.contains('button:not(:disabled)', 'Save').click();
+
+          cy.contains(`Updated '${ruleName}'`);
+
+          // Wait for the table to be ready for next edit click
+          cy.get('.euiBasicTable').not('.euiBasicTable-loading');
+
+          // Ensure the rule now shows "All" for the environment
+          cy.get(editButtonSelector).click();
+          cy.contains('Environment All');
+          cy.contains('button', 'Cancel').click();
+
+          // Delete the rule
+          cy.get(deleteButtonSelector).click();
+          cy.get(confirmModalButtonSelector).click();
+
+          // Ensure the table is empty
+          cy.contains('Create your first rule');
+        });
+      });
+    });
+
+    describe('when created from Stack management', () => {
+      before(() => {
+        cy.loginAsPowerUser();
+      });
+
+      it('creates a rule', () => {
+        // Go to stack management
+        cy.visit('/app/management/insightsAndAlerting/triggersActions/rules');
+
+        // Create a rule
+        cy.contains('button', 'Create rule').click();
+        cy.get('[name=name]').type(ruleName);
+        cy.contains('.euiFlyout button', ruleName).click();
+
+        // Change the environment to "testing"
+        cy.contains('Environment All').click();
+        cy.get(comboBoxInputSelector).type('testing{enter}');
+
+        // Save, with no actions
+        cy.contains('button:not(:disabled)', 'Save').click();
+        cy.get(confirmModalButtonSelector).click();
+
+        cy.contains(`Created rule "${ruleName}`);
+
+        // Wait for the table to be ready for next delete click
+        cy.get('.euiBasicTable').not('.euiBasicTable-loading');
+
+        // Delete the rule
+        cy.get(deleteButtonSelector).click();
+        cy.get(confirmModalButtonSelector).click();
+
+        // Ensure the table is empty
+        cy.contains('Create your first rule');
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/apm/ftr_e2e/cypress/integration/read_only_user/home.spec.ts b/x-pack/plugins/apm/ftr_e2e/cypress/integration/read_only_user/home.spec.ts
index 9d4c773422cdc4..679e2934f9c37a 100644
--- a/x-pack/plugins/apm/ftr_e2e/cypress/integration/read_only_user/home.spec.ts
+++ b/x-pack/plugins/apm/ftr_e2e/cypress/integration/read_only_user/home.spec.ts
@@ -17,11 +17,11 @@ const serviceInventoryHref = url.format({
 
 const apisToIntercept = [
   {
-    endpoint: '/api/apm/service',
+    endpoint: '/api/apm/service?*',
     name: 'servicesMainStatistics',
   },
   {
-    endpoint: '/api/apm/services/detailed_statistics',
+    endpoint: '/api/apm/services/detailed_statistics?*',
     name: 'servicesDetailedStatistics',
   },
 ];
diff --git a/x-pack/plugins/apm/public/components/alerting/error_count_alert_trigger/error_count_alert_trigger.stories.tsx b/x-pack/plugins/apm/public/components/alerting/error_count_alert_trigger/error_count_alert_trigger.stories.tsx
new file mode 100644
index 00000000000000..d28d3076b21c0f
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/alerting/error_count_alert_trigger/error_count_alert_trigger.stories.tsx
@@ -0,0 +1,152 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { Meta, Story } from '@storybook/react';
+import React, { useState } from 'react';
+import { AlertParams, ErrorCountAlertTrigger } from '.';
+import { CoreStart } from '../../../../../../../src/core/public';
+import { createKibanaReactContext } from '../../../../../../../src/plugins/kibana_react/public';
+import { ENVIRONMENT_ALL } from '../../../../common/environment_filter_values';
+import { AlertMetadata } from '../helper';
+
+const KibanaReactContext = createKibanaReactContext({
+  notifications: { toasts: { add: () => {} } },
+} as unknown as Partial<CoreStart>);
+
+interface Args {
+  alertParams: AlertParams;
+  metadata?: AlertMetadata;
+}
+
+const stories: Meta<{}> = {
+  title: 'alerting/ErrorCountAlertTrigger',
+  component: ErrorCountAlertTrigger,
+  decorators: [
+    (StoryComponent) => {
+      return (
+        <KibanaReactContext.Provider>
+          <div style={{ width: 400 }}>
+            <StoryComponent />
+          </div>
+        </KibanaReactContext.Provider>
+      );
+    },
+  ],
+};
+export default stories;
+
+export const CreatingInApmFromInventory: Story<Args> = ({
+  alertParams,
+  metadata,
+}) => {
+  const [params, setParams] = useState<AlertParams>(alertParams);
+
+  function setAlertParams(property: string, value: any) {
+    setParams({ ...params, [property]: value });
+  }
+
+  return (
+    <ErrorCountAlertTrigger
+      alertParams={params}
+      metadata={metadata}
+      setAlertParams={setAlertParams}
+      setAlertProperty={() => {}}
+    />
+  );
+};
+CreatingInApmFromInventory.args = {
+  alertParams: {},
+  metadata: {
+    end: '2021-09-10T14:14:04.789Z',
+    environment: ENVIRONMENT_ALL.value,
+    serviceName: undefined,
+    start: '2021-09-10T13:59:00.000Z',
+  },
+};
+
+export const CreatingInApmFromService: Story<Args> = ({
+  alertParams,
+  metadata,
+}) => {
+  const [params, setParams] = useState<AlertParams>(alertParams);
+
+  function setAlertParams(property: string, value: any) {
+    setParams({ ...params, [property]: value });
+  }
+
+  return (
+    <ErrorCountAlertTrigger
+      alertParams={params}
+      metadata={metadata}
+      setAlertParams={setAlertParams}
+      setAlertProperty={() => {}}
+    />
+  );
+};
+CreatingInApmFromService.args = {
+  alertParams: {},
+  metadata: {
+    end: '2021-09-10T14:14:04.789Z',
+    environment: 'testEnvironment',
+    serviceName: 'testServiceName',
+    start: '2021-09-10T13:59:00.000Z',
+  },
+};
+
+export const EditingInStackManagement: Story<Args> = ({
+  alertParams,
+  metadata,
+}) => {
+  const [params, setParams] = useState<AlertParams>(alertParams);
+
+  function setAlertParams(property: string, value: any) {
+    setParams({ ...params, [property]: value });
+  }
+
+  return (
+    <ErrorCountAlertTrigger
+      alertParams={params}
+      metadata={metadata}
+      setAlertParams={setAlertParams}
+      setAlertProperty={() => {}}
+    />
+  );
+};
+EditingInStackManagement.args = {
+  alertParams: {
+    environment: 'testEnvironment',
+    serviceName: 'testServiceName',
+    threshold: 25,
+    windowSize: 1,
+    windowUnit: 'm',
+  },
+  metadata: undefined,
+};
+
+export const CreatingInStackManagement: Story<Args> = ({
+  alertParams,
+  metadata,
+}) => {
+  const [params, setParams] = useState<AlertParams>(alertParams);
+
+  function setAlertParams(property: string, value: any) {
+    setParams({ ...params, [property]: value });
+  }
+
+  return (
+    <ErrorCountAlertTrigger
+      alertParams={params}
+      metadata={metadata}
+      setAlertParams={setAlertParams}
+      setAlertProperty={() => {}}
+    />
+  );
+};
+CreatingInStackManagement.args = {
+  alertParams: {},
+  metadata: undefined,
+};
diff --git a/x-pack/plugins/apm/public/components/alerting/error_count_alert_trigger/error_count_alert_trigger.test.tsx b/x-pack/plugins/apm/public/components/alerting/error_count_alert_trigger/error_count_alert_trigger.test.tsx
new file mode 100644
index 00000000000000..26c62b10e6220e
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/alerting/error_count_alert_trigger/error_count_alert_trigger.test.tsx
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { render } from '@testing-library/react';
+import React from 'react';
+import * as stories from './error_count_alert_trigger.stories';
+import { composeStories } from '@storybook/testing-react';
+
+const { CreatingInApmFromService } = composeStories(stories);
+
+describe('ErrorCountAlertTrigger', () => {
+  it('renders', () => {
+    expect(() => render(<CreatingInApmFromService />)).not.toThrowError();
+  });
+});
diff --git a/x-pack/plugins/apm/public/components/alerting/error_count_alert_trigger/index.stories.tsx b/x-pack/plugins/apm/public/components/alerting/error_count_alert_trigger/index.stories.tsx
deleted file mode 100644
index b6ee1a61cea5af..00000000000000
--- a/x-pack/plugins/apm/public/components/alerting/error_count_alert_trigger/index.stories.tsx
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { useState } from 'react';
-import { AlertParams, ErrorCountAlertTrigger } from '.';
-import { CoreStart } from '../../../../../../../src/core/public';
-import { createKibanaReactContext } from '../../../../../../../src/plugins/kibana_react/public';
-
-const KibanaReactContext = createKibanaReactContext({
-  notifications: { toasts: { add: () => {} } },
-} as unknown as Partial<CoreStart>);
-
-export default {
-  title: 'alerting/ErrorCountAlertTrigger',
-  component: ErrorCountAlertTrigger,
-  decorators: [
-    (Story: React.ComponentClass) => (
-      <KibanaReactContext.Provider>
-        <div style={{ width: 400 }}>
-          <Story />
-        </div>
-      </KibanaReactContext.Provider>
-    ),
-  ],
-};
-
-export function Example() {
-  const [params, setParams] = useState<AlertParams>({
-    serviceName: 'testServiceName',
-    environment: 'testEnvironment',
-    threshold: 2,
-    windowSize: 5,
-    windowUnit: 'm',
-  });
-
-  function setAlertParams(property: string, value: any) {
-    setParams({ ...params, [property]: value });
-  }
-
-  return (
-    <ErrorCountAlertTrigger
-      alertParams={params}
-      setAlertParams={setAlertParams}
-      setAlertProperty={() => {}}
-    />
-  );
-}
diff --git a/x-pack/plugins/apm/public/components/alerting/error_count_alert_trigger/index.tsx b/x-pack/plugins/apm/public/components/alerting/error_count_alert_trigger/index.tsx
index dd94cf4b175a69..cb7b367fb390b8 100644
--- a/x-pack/plugins/apm/public/components/alerting/error_count_alert_trigger/index.tsx
+++ b/x-pack/plugins/apm/public/components/alerting/error_count_alert_trigger/index.tsx
@@ -7,29 +7,25 @@
 
 import { i18n } from '@kbn/i18n';
 import { defaults, omit } from 'lodash';
-import React from 'react';
+import React, { useEffect } from 'react';
+import { CoreStart } from '../../../../../../../src/core/public';
+import { useKibana } from '../../../../../../../src/plugins/kibana_react/public';
 import { ForLastExpression } from '../../../../../triggers_actions_ui/public';
 import { ENVIRONMENT_ALL } from '../../../../common/environment_filter_values';
 import { asInteger } from '../../../../common/utils/formatters';
-import { useEnvironmentsFetcher } from '../../../hooks/use_environments_fetcher';
 import { useFetcher } from '../../../hooks/use_fetcher';
+import { createCallApmApi } from '../../../services/rest/createCallApmApi';
 import { ChartPreview } from '../chart_preview';
 import { EnvironmentField, IsAboveField, ServiceField } from '../fields';
-import {
-  AlertMetadata,
-  getIntervalAndTimeRange,
-  isNewApmRuleFromStackManagement,
-  TimeUnit,
-} from '../helper';
-import { NewAlertEmptyPrompt } from '../new_alert_empty_prompt';
+import { AlertMetadata, getIntervalAndTimeRange, TimeUnit } from '../helper';
 import { ServiceAlertTrigger } from '../service_alert_trigger';
 
 export interface AlertParams {
-  windowSize: number;
-  windowUnit: string;
-  threshold: number;
-  serviceName: string;
-  environment: string;
+  windowSize?: number;
+  windowUnit?: TimeUnit;
+  threshold?: number;
+  serviceName?: string;
+  environment?: string;
 }
 
 interface Props {
@@ -40,13 +36,12 @@ interface Props {
 }
 
 export function ErrorCountAlertTrigger(props: Props) {
+  const { services } = useKibana();
   const { alertParams, metadata, setAlertParams, setAlertProperty } = props;
 
-  const { environmentOptions } = useEnvironmentsFetcher({
-    serviceName: metadata?.serviceName,
-    start: metadata?.start,
-    end: metadata?.end,
-  });
+  useEffect(() => {
+    createCallApmApi(services as CoreStart);
+  }, [services]);
 
   const params = defaults(
     { ...omit(metadata, ['start', 'end']), ...alertParams },
@@ -87,16 +82,14 @@ export function ErrorCountAlertTrigger(props: Props) {
     ]
   );
 
-  if (isNewApmRuleFromStackManagement(alertParams, metadata)) {
-    return <NewAlertEmptyPrompt />;
-  }
-
   const fields = [
-    <ServiceField value={params.serviceName} />,
+    <ServiceField
+      currentValue={params.serviceName}
+      onChange={(value) => setAlertParams('serviceName', value)}
+    />,
     <EnvironmentField
       currentValue={params.environment}
-      options={environmentOptions}
-      onChange={(e) => setAlertParams('environment', e.target.value)}
+      onChange={(value) => setAlertParams('environment', value)}
     />,
     <IsAboveField
       value={params.threshold}
diff --git a/x-pack/plugins/apm/public/components/alerting/fields.test.tsx b/x-pack/plugins/apm/public/components/alerting/fields.test.tsx
index 3715fc69cbe9d0..c379418ad03f82 100644
--- a/x-pack/plugins/apm/public/components/alerting/fields.test.tsx
+++ b/x-pack/plugins/apm/public/components/alerting/fields.test.tsx
@@ -7,56 +7,35 @@
 
 import React from 'react';
 import { ServiceField, TransactionTypeField } from './fields';
-import { act, fireEvent, render } from '@testing-library/react';
+import { render } from '@testing-library/react';
 import { expectTextsInDocument } from '../../utils/testHelpers';
 
 describe('alerting fields', () => {
   describe('Service Field', () => {
     it('renders with value', () => {
-      const component = render(<ServiceField value="foo" />);
+      const component = render(
+        <ServiceField currentValue="foo" onChange={() => {}} />
+      );
       expectTextsInDocument(component, ['foo']);
     });
     it('renders with All when value is not defined', () => {
-      const component = render(<ServiceField />);
+      const component = render(<ServiceField onChange={() => {}} />);
       expectTextsInDocument(component, ['All']);
     });
   });
-  describe('Transaction Type Field', () => {
-    it('renders select field when multiple options available', () => {
-      const options = [
-        { text: 'Foo', value: 'foo' },
-        { text: 'Bar', value: 'bar' },
-      ];
-      const { getByText, getByTestId } = render(
-        <TransactionTypeField currentValue="Foo" options={options} />
-      );
 
-      act(() => {
-        fireEvent.click(getByText('Foo'));
-      });
-
-      const selectBar = getByTestId('transactionTypeField');
-      expect(selectBar instanceof HTMLSelectElement).toBeTruthy();
-      const selectOptions = (selectBar as HTMLSelectElement).options;
-      expect(selectOptions.length).toEqual(2);
-      expect(
-        Object.values(selectOptions).map((option) => option.value)
-      ).toEqual(['foo', 'bar']);
-    });
-    it('renders read-only field when single option available', () => {
-      const options = [{ text: 'Bar', value: 'bar' }];
+  describe('TransactionTypeField', () => {
+    it('renders', () => {
       const component = render(
-        <TransactionTypeField currentValue="Bar" options={options} />
+        <TransactionTypeField currentValue="Bar" onChange={() => {}} />
       );
       expectTextsInDocument(component, ['Bar']);
     });
-    it('renders read-only All option when no option available', () => {
-      const component = render(<TransactionTypeField currentValue="" />);
-      expectTextsInDocument(component, ['All']);
-    });
 
     it('renders current value when available', () => {
-      const component = render(<TransactionTypeField currentValue="foo" />);
+      const component = render(
+        <TransactionTypeField currentValue="foo" onChange={() => {}} />
+      );
       expectTextsInDocument(component, ['foo']);
     });
   });
diff --git a/x-pack/plugins/apm/public/components/alerting/fields.tsx b/x-pack/plugins/apm/public/components/alerting/fields.tsx
index e4826351523650..171953ea522eb4 100644
--- a/x-pack/plugins/apm/public/components/alerting/fields.tsx
+++ b/x-pack/plugins/apm/public/components/alerting/fields.tsx
@@ -5,59 +5,96 @@
  * 2.0.
  */
 
-import { EuiSelect, EuiExpression, EuiFieldNumber } from '@elastic/eui';
-import React from 'react';
+import { EuiComboBoxOptionOption, EuiFieldNumber } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import { EuiSelectOption } from '@elastic/eui';
+import React from 'react';
+import {
+  SERVICE_ENVIRONMENT,
+  SERVICE_NAME,
+  TRANSACTION_TYPE,
+} from '../../../common/elasticsearch_fieldnames';
 import {
   ENVIRONMENT_ALL,
   getEnvironmentLabel,
 } from '../../../common/environment_filter_values';
+import { SuggestionsSelect } from '../shared/suggestions_select';
 import { PopoverExpression } from './service_alert_trigger/popover_expression';
 
-const ALL_OPTION = i18n.translate('xpack.apm.alerting.fields.all_option', {
+const allOptionText = i18n.translate('xpack.apm.alerting.fields.allOption', {
   defaultMessage: 'All',
 });
+const allOption: EuiComboBoxOptionOption<string> = {
+  label: allOptionText,
+  value: allOptionText,
+};
+const environmentAllOption: EuiComboBoxOptionOption<string> = {
+  label: ENVIRONMENT_ALL.text,
+  value: ENVIRONMENT_ALL.value,
+};
 
-export function ServiceField({ value }: { value?: string }) {
+export function ServiceField({
+  allowAll = true,
+  currentValue,
+  onChange,
+}: {
+  allowAll?: boolean;
+  currentValue?: string;
+  onChange: (value?: string) => void;
+}) {
   return (
-    <EuiExpression
-      description={i18n.translate('xpack.apm.alerting.fields.service', {
+    <PopoverExpression
+      value={currentValue || allOption.value}
+      title={i18n.translate('xpack.apm.alerting.fields.service', {
         defaultMessage: 'Service',
       })}
-      value={value || ALL_OPTION}
-    />
+    >
+      <SuggestionsSelect
+        allOption={allowAll ? allOption : undefined}
+        customOptionText={i18n.translate(
+          'xpack.apm.serviceNamesSelectCustomOptionText',
+          {
+            defaultMessage: 'Add \\{searchValue\\} as a new service name',
+          }
+        )}
+        defaultValue={currentValue}
+        field={SERVICE_NAME}
+        onChange={onChange}
+        placeholder={i18n.translate('xpack.apm.serviceNamesSelectPlaceholder', {
+          defaultMessage: 'Select service name',
+        })}
+      />
+    </PopoverExpression>
   );
 }
 
 export function EnvironmentField({
   currentValue,
-  options,
   onChange,
 }: {
   currentValue: string;
-  options: EuiSelectOption[];
-  onChange: (event: React.ChangeEvent<HTMLSelectElement>) => void;
+  onChange: (value?: string) => void;
 }) {
-  const title = i18n.translate('xpack.apm.alerting.fields.environment', {
-    defaultMessage: 'Environment',
-  });
-  if (options.length === 1) {
-    return (
-      <EuiExpression
-        description={title}
-        value={currentValue || ENVIRONMENT_ALL.text}
-      />
-    );
-  }
-
   return (
-    <PopoverExpression value={getEnvironmentLabel(currentValue)} title={title}>
-      <EuiSelect
-        defaultValue={currentValue}
-        options={options}
+    <PopoverExpression
+      value={getEnvironmentLabel(currentValue)}
+      title={i18n.translate('xpack.apm.alerting.fields.environment', {
+        defaultMessage: 'Environment',
+      })}
+    >
+      <SuggestionsSelect
+        allOption={environmentAllOption}
+        customOptionText={i18n.translate(
+          'xpack.apm.environmentsSelectCustomOptionText',
+          {
+            defaultMessage: 'Add \\{searchValue\\} as a new environment',
+          }
+        )}
+        defaultValue={getEnvironmentLabel(currentValue)}
+        field={SERVICE_ENVIRONMENT}
         onChange={onChange}
-        compressed
+        placeholder={i18n.translate('xpack.apm.environmentsSelectPlaceholder', {
+          defaultMessage: 'Select environment',
+        })}
       />
     </PopoverExpression>
   );
@@ -65,31 +102,33 @@ export function EnvironmentField({
 
 export function TransactionTypeField({
   currentValue,
-  options,
   onChange,
 }: {
   currentValue?: string;
-  options?: EuiSelectOption[];
-  onChange?: (event: React.ChangeEvent<HTMLSelectElement>) => void;
+  onChange: (value?: string) => void;
 }) {
   const label = i18n.translate('xpack.apm.alerting.fields.type', {
     defaultMessage: 'Type',
   });
-
-  if (!options || options.length <= 1) {
-    return (
-      <EuiExpression description={label} value={currentValue || ALL_OPTION} />
-    );
-  }
-
   return (
-    <PopoverExpression value={currentValue} title={label}>
-      <EuiSelect
-        data-test-subj="transactionTypeField"
+    <PopoverExpression value={currentValue || allOption.value} title={label}>
+      <SuggestionsSelect
+        allOption={allOption}
+        customOptionText={i18n.translate(
+          'xpack.apm.transactionTypesSelectCustomOptionText',
+          {
+            defaultMessage: 'Add \\{searchValue\\} as a new transaction type',
+          }
+        )}
         defaultValue={currentValue}
-        options={options}
+        field={TRANSACTION_TYPE}
         onChange={onChange}
-        compressed
+        placeholder={i18n.translate(
+          'xpack.apm.transactionTypesSelectPlaceholder',
+          {
+            defaultMessage: 'Select transaction type',
+          }
+        )}
       />
     </PopoverExpression>
   );
diff --git a/x-pack/plugins/apm/public/components/alerting/helper.ts b/x-pack/plugins/apm/public/components/alerting/helper.ts
index b3dac5c2643dbb..4032c33fa30b70 100644
--- a/x-pack/plugins/apm/public/components/alerting/helper.ts
+++ b/x-pack/plugins/apm/public/components/alerting/helper.ts
@@ -36,14 +36,3 @@ export function getIntervalAndTimeRange({
     end: new Date(end).toISOString(),
   };
 }
-
-export function isNewApmRuleFromStackManagement(
-  alertParams: any,
-  metadata?: AlertMetadata
-) {
-  return (
-    alertParams !== undefined &&
-    Object.keys(alertParams).length === 0 &&
-    metadata === undefined
-  );
-}
diff --git a/x-pack/plugins/apm/public/components/alerting/new_alert_empty_prompt.tsx b/x-pack/plugins/apm/public/components/alerting/new_alert_empty_prompt.tsx
deleted file mode 100644
index 4777da7871b68c..00000000000000
--- a/x-pack/plugins/apm/public/components/alerting/new_alert_empty_prompt.tsx
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-/* eslint-disable @elastic/eui/href-or-on-click */
-
-import { EuiButton, EuiEmptyPrompt } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import React, { MouseEvent } from 'react';
-import { useKibana } from '../../../../../../src/plugins/kibana_react/public';
-
-export function NewAlertEmptyPrompt() {
-  const { services } = useKibana();
-  const apmUrl = services.http?.basePath.prepend('/app/apm');
-  const navigateToUrl = services.application?.navigateToUrl;
-  const handleClick = (event: MouseEvent<HTMLAnchorElement>) => {
-    event.preventDefault();
-    if (apmUrl && navigateToUrl) {
-      navigateToUrl(apmUrl);
-    }
-  };
-
-  return (
-    <EuiEmptyPrompt
-      iconType="alert"
-      body={i18n.translate('xpack.apm.NewAlertEmptyPrompt.bodyDescription', {
-        defaultMessage:
-          'APM rules cannot be created in Stack Management. Go to APM and use the "Alerts and rules" menu.',
-      })}
-      actions={[
-        <EuiButton
-          color="primary"
-          fill={true}
-          href={apmUrl}
-          onClick={handleClick}
-        >
-          {i18n.translate('xpack.apm.NewAlertEmptyPrompt.goToApmLinkText', {
-            defaultMessage: 'Go to APM',
-          })}
-        </EuiButton>,
-      ]}
-    />
-  );
-}
diff --git a/x-pack/plugins/apm/public/components/alerting/transaction_duration_alert_trigger/index.tsx b/x-pack/plugins/apm/public/components/alerting/transaction_duration_alert_trigger/index.tsx
index dbbb7186de65c8..5327eb561bfc61 100644
--- a/x-pack/plugins/apm/public/components/alerting/transaction_duration_alert_trigger/index.tsx
+++ b/x-pack/plugins/apm/public/components/alerting/transaction_duration_alert_trigger/index.tsx
@@ -8,14 +8,12 @@
 import { EuiSelect } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { defaults, map, omit } from 'lodash';
-import React from 'react';
+import React, { useEffect } from 'react';
 import { CoreStart } from '../../../../../../../src/core/public';
 import { useKibana } from '../../../../../../../src/plugins/kibana_react/public';
 import { ForLastExpression } from '../../../../../triggers_actions_ui/public';
 import { ENVIRONMENT_ALL } from '../../../../common/environment_filter_values';
 import { getDurationFormatter } from '../../../../common/utils/formatters';
-import { useServiceTransactionTypesFetcher } from '../../../context/apm_service/use_service_transaction_types_fetcher';
-import { useEnvironmentsFetcher } from '../../../hooks/use_environments_fetcher';
 import { useFetcher } from '../../../hooks/use_fetcher';
 import { createCallApmApi } from '../../../services/rest/createCallApmApi';
 import {
@@ -29,13 +27,7 @@ import {
   ServiceField,
   TransactionTypeField,
 } from '../fields';
-import {
-  AlertMetadata,
-  getIntervalAndTimeRange,
-  isNewApmRuleFromStackManagement,
-  TimeUnit,
-} from '../helper';
-import { NewAlertEmptyPrompt } from '../new_alert_empty_prompt';
+import { AlertMetadata, getIntervalAndTimeRange, TimeUnit } from '../helper';
 import { ServiceAlertTrigger } from '../service_alert_trigger';
 import { PopoverExpression } from '../service_alert_trigger/popover_expression';
 
@@ -81,13 +73,9 @@ export function TransactionDurationAlertTrigger(props: Props) {
   const { services } = useKibana();
   const { alertParams, metadata, setAlertParams, setAlertProperty } = props;
 
-  createCallApmApi(services as CoreStart);
-
-  const transactionTypes = useServiceTransactionTypesFetcher({
-    serviceName: metadata?.serviceName,
-    start: metadata?.start,
-    end: metadata?.end,
-  });
+  useEffect(() => {
+    createCallApmApi(services as CoreStart);
+  }, [services]);
 
   const params = defaults(
     {
@@ -100,16 +88,9 @@ export function TransactionDurationAlertTrigger(props: Props) {
       windowSize: 5,
       windowUnit: 'm',
       environment: ENVIRONMENT_ALL.value,
-      transactionType: transactionTypes[0],
     }
   );
 
-  const { environmentOptions } = useEnvironmentsFetcher({
-    serviceName: params.serviceName,
-    start: metadata?.start,
-    end: metadata?.end,
-  });
-
   const { data } = useFetcher(
     (callApmApi) => {
       const { interval, start, end } = getIntervalAndTimeRange({
@@ -160,25 +141,19 @@ export function TransactionDurationAlertTrigger(props: Props) {
     />
   );
 
-  if (isNewApmRuleFromStackManagement(alertParams, metadata)) {
-    return <NewAlertEmptyPrompt />;
-  }
-
-  if (!params.serviceName) {
-    return null;
-  }
-
   const fields = [
-    <ServiceField value={params.serviceName} />,
+    <ServiceField
+      allowAll={false}
+      currentValue={params.serviceName}
+      onChange={(value) => setAlertParams('serviceName', value)}
+    />,
     <TransactionTypeField
       currentValue={params.transactionType}
-      options={transactionTypes.map((key) => ({ text: key, value: key }))}
-      onChange={(e) => setAlertParams('transactionType', e.target.value)}
+      onChange={(value) => setAlertParams('transactionType', value)}
     />,
     <EnvironmentField
       currentValue={params.environment}
-      options={environmentOptions}
-      onChange={(e) => setAlertParams('environment', e.target.value)}
+      onChange={(value) => setAlertParams('environment', value)}
     />,
     <PopoverExpression
       value={params.aggregationType}
diff --git a/x-pack/plugins/apm/public/components/alerting/transaction_duration_anomaly_alert_trigger/index.tsx b/x-pack/plugins/apm/public/components/alerting/transaction_duration_anomaly_alert_trigger/index.tsx
index 7b3c30da44c086..0aa00a05df2c36 100644
--- a/x-pack/plugins/apm/public/components/alerting/transaction_duration_anomaly_alert_trigger/index.tsx
+++ b/x-pack/plugins/apm/public/components/alerting/transaction_duration_anomaly_alert_trigger/index.tsx
@@ -7,18 +7,18 @@
 
 import { i18n } from '@kbn/i18n';
 import { defaults, omit } from 'lodash';
-import React from 'react';
+import React, { useEffect } from 'react';
+import { CoreStart } from '../../../../../../../src/core/public';
+import { useKibana } from '../../../../../../../src/plugins/kibana_react/public';
 import { ENVIRONMENT_ALL } from '../../../../common/environment_filter_values';
 import { ANOMALY_SEVERITY } from '../../../../common/ml_constants';
-import { useServiceTransactionTypesFetcher } from '../../../context/apm_service/use_service_transaction_types_fetcher';
-import { useEnvironmentsFetcher } from '../../../hooks/use_environments_fetcher';
+import { createCallApmApi } from '../../../services/rest/createCallApmApi';
 import {
   EnvironmentField,
   ServiceField,
   TransactionTypeField,
 } from '../fields';
-import { AlertMetadata, isNewApmRuleFromStackManagement } from '../helper';
-import { NewAlertEmptyPrompt } from '../new_alert_empty_prompt';
+import { AlertMetadata } from '../helper';
 import { ServiceAlertTrigger } from '../service_alert_trigger';
 import { PopoverExpression } from '../service_alert_trigger/popover_expression';
 import {
@@ -27,16 +27,16 @@ import {
 } from './select_anomaly_severity';
 
 interface AlertParams {
-  anomalySeverityType:
+  anomalySeverityType?:
     | ANOMALY_SEVERITY.CRITICAL
     | ANOMALY_SEVERITY.MAJOR
     | ANOMALY_SEVERITY.MINOR
     | ANOMALY_SEVERITY.WARNING;
-  environment: string;
+  environment?: string;
   serviceName?: string;
   transactionType?: string;
-  windowSize: number;
-  windowUnit: string;
+  windowSize?: number;
+  windowUnit?: string;
 }
 
 interface Props {
@@ -47,13 +47,12 @@ interface Props {
 }
 
 export function TransactionDurationAnomalyAlertTrigger(props: Props) {
+  const { services } = useKibana();
   const { alertParams, metadata, setAlertParams, setAlertProperty } = props;
 
-  const transactionTypes = useServiceTransactionTypesFetcher({
-    serviceName: metadata?.serviceName,
-    start: metadata?.start,
-    end: metadata?.end,
-  });
+  useEffect(() => {
+    createCallApmApi(services as CoreStart);
+  }, [services]);
 
   const params = defaults(
     {
@@ -68,27 +67,18 @@ export function TransactionDurationAnomalyAlertTrigger(props: Props) {
     }
   );
 
-  const { environmentOptions } = useEnvironmentsFetcher({
-    serviceName: params.serviceName,
-    start: metadata?.start,
-    end: metadata?.end,
-  });
-
-  if (isNewApmRuleFromStackManagement(alertParams, metadata)) {
-    return <NewAlertEmptyPrompt />;
-  }
-
   const fields = [
-    <ServiceField value={params.serviceName} />,
+    <ServiceField
+      currentValue={params.serviceName}
+      onChange={(value) => setAlertParams('serviceName', value)}
+    />,
     <TransactionTypeField
       currentValue={params.transactionType}
-      options={transactionTypes.map((key) => ({ text: key, value: key }))}
-      onChange={(e) => setAlertParams('transactionType', e.target.value)}
+      onChange={(value) => setAlertParams('transactionType', value)}
     />,
     <EnvironmentField
       currentValue={params.environment}
-      options={environmentOptions}
-      onChange={(e) => setAlertParams('environment', e.target.value)}
+      onChange={(value) => setAlertParams('environment', value)}
     />,
     <PopoverExpression
       value={<AnomalySeverity type={params.anomalySeverityType} />}
diff --git a/x-pack/plugins/apm/public/components/alerting/transaction_error_rate_alert_trigger/index.tsx b/x-pack/plugins/apm/public/components/alerting/transaction_error_rate_alert_trigger/index.tsx
index 22e8bef9bc7800..3bad7ae15f658c 100644
--- a/x-pack/plugins/apm/public/components/alerting/transaction_error_rate_alert_trigger/index.tsx
+++ b/x-pack/plugins/apm/public/components/alerting/transaction_error_rate_alert_trigger/index.tsx
@@ -6,14 +6,12 @@
  */
 
 import { defaults, omit } from 'lodash';
-import React from 'react';
+import React, { useEffect } from 'react';
 import { CoreStart } from '../../../../../../../src/core/public';
 import { useKibana } from '../../../../../../../src/plugins/kibana_react/public';
 import { ForLastExpression } from '../../../../../triggers_actions_ui/public';
 import { ENVIRONMENT_ALL } from '../../../../common/environment_filter_values';
 import { asPercent } from '../../../../common/utils/formatters';
-import { useServiceTransactionTypesFetcher } from '../../../context/apm_service/use_service_transaction_types_fetcher';
-import { useEnvironmentsFetcher } from '../../../hooks/use_environments_fetcher';
 import { useFetcher } from '../../../hooks/use_fetcher';
 import { createCallApmApi } from '../../../services/rest/createCallApmApi';
 import { ChartPreview } from '../chart_preview';
@@ -23,22 +21,16 @@ import {
   ServiceField,
   TransactionTypeField,
 } from '../fields';
-import {
-  AlertMetadata,
-  getIntervalAndTimeRange,
-  isNewApmRuleFromStackManagement,
-  TimeUnit,
-} from '../helper';
-import { NewAlertEmptyPrompt } from '../new_alert_empty_prompt';
+import { AlertMetadata, getIntervalAndTimeRange, TimeUnit } from '../helper';
 import { ServiceAlertTrigger } from '../service_alert_trigger';
 
 interface AlertParams {
-  windowSize: number;
-  windowUnit: string;
-  threshold: number;
-  serviceName: string;
-  transactionType: string;
-  environment: string;
+  windowSize?: number;
+  windowUnit?: string;
+  threshold?: number;
+  serviceName?: string;
+  transactionType?: string;
+  environment?: string;
 }
 
 interface Props {
@@ -52,12 +44,9 @@ export function TransactionErrorRateAlertTrigger(props: Props) {
   const { services } = useKibana();
   const { alertParams, metadata, setAlertParams, setAlertProperty } = props;
 
-  createCallApmApi(services as CoreStart);
-  const transactionTypes = useServiceTransactionTypesFetcher({
-    serviceName: metadata?.serviceName,
-    start: metadata?.start,
-    end: metadata?.end,
-  });
+  useEffect(() => {
+    createCallApmApi(services as CoreStart);
+  }, [services]);
 
   const params = defaults(
     { ...omit(metadata, ['start', 'end']), ...alertParams },
@@ -69,12 +58,6 @@ export function TransactionErrorRateAlertTrigger(props: Props) {
     }
   );
 
-  const { environmentOptions } = useEnvironmentsFetcher({
-    serviceName: params.serviceName,
-    start: metadata?.start,
-    end: metadata?.end,
-  });
-
   const thresholdAsPercent = (params.threshold ?? 0) / 100;
 
   const { data } = useFetcher(
@@ -108,21 +91,18 @@ export function TransactionErrorRateAlertTrigger(props: Props) {
     ]
   );
 
-  if (isNewApmRuleFromStackManagement(alertParams, metadata)) {
-    return <NewAlertEmptyPrompt />;
-  }
-
   const fields = [
-    <ServiceField value={params.serviceName} />,
+    <ServiceField
+      currentValue={params.serviceName}
+      onChange={(value) => setAlertParams('serviceName', value)}
+    />,
     <TransactionTypeField
       currentValue={params.transactionType}
-      options={transactionTypes.map((key) => ({ text: key, value: key }))}
-      onChange={(e) => setAlertParams('transactionType', e.target.value)}
+      onChange={(value) => setAlertParams('transactionType', value)}
     />,
     <EnvironmentField
       currentValue={params.environment}
-      options={environmentOptions}
-      onChange={(e) => setAlertParams('environment', e.target.value)}
+      onChange={(value) => setAlertParams('environment', value)}
     />,
     <IsAboveField
       value={params.threshold}
diff --git a/x-pack/plugins/apm/public/components/shared/suggestions_select/index.tsx b/x-pack/plugins/apm/public/components/shared/suggestions_select/index.tsx
new file mode 100644
index 00000000000000..e5ad6e2ad64389
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/shared/suggestions_select/index.tsx
@@ -0,0 +1,108 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiComboBox, EuiComboBoxOptionOption } from '@elastic/eui';
+import { debounce } from 'lodash';
+import React, { useCallback, useState } from 'react';
+import { FETCH_STATUS, useFetcher } from '../../../hooks/use_fetcher';
+
+interface SuggestionsSelectProps {
+  allOption?: EuiComboBoxOptionOption<string>;
+  customOptionText: string;
+  defaultValue?: string;
+  field: string;
+  onChange: (value?: string) => void;
+  placeholder: string;
+}
+
+export function SuggestionsSelect({
+  allOption,
+  customOptionText,
+  defaultValue,
+  field,
+  onChange,
+  placeholder,
+}: SuggestionsSelectProps) {
+  const allowAll = !!allOption;
+  let defaultOption: EuiComboBoxOptionOption<string> | undefined;
+
+  if (allowAll && !defaultValue) {
+    defaultOption = allOption;
+  }
+  if (defaultValue) {
+    defaultOption = { label: defaultValue, value: defaultValue };
+  }
+  const [selectedOptions, setSelectedOptions] = useState(
+    defaultOption ? [defaultOption] : []
+  );
+
+  const [searchValue, setSearchValue] = useState('');
+
+  const { data, status } = useFetcher(
+    (callApmApi) => {
+      return callApmApi({
+        endpoint: 'GET /internal/apm/suggestions',
+        params: {
+          query: { field, string: searchValue },
+        },
+      });
+    },
+    [field, searchValue],
+    { preservePreviousData: false }
+  );
+
+  const handleChange = useCallback(
+    (changedOptions: Array<EuiComboBoxOptionOption<string>>) => {
+      setSelectedOptions(changedOptions);
+      if (changedOptions.length === 1) {
+        onChange(
+          changedOptions[0].value
+            ? changedOptions[0].value.trim()
+            : changedOptions[0].value
+        );
+      }
+    },
+    [onChange]
+  );
+
+  const handleCreateOption = useCallback(
+    (value: string) => {
+      handleChange([{ label: value, value }]);
+    },
+    [handleChange]
+  );
+
+  const terms = data?.terms ?? [];
+
+  const options: Array<EuiComboBoxOptionOption<string>> = [
+    ...(allOption &&
+    (searchValue === '' ||
+      searchValue.toLowerCase() === allOption.label.toLowerCase())
+      ? [allOption]
+      : []),
+    ...terms.map((name) => {
+      return { label: name, value: name };
+    }),
+  ];
+
+  return (
+    <EuiComboBox
+      async={true}
+      compressed={true}
+      customOptionText={customOptionText}
+      isLoading={status === FETCH_STATUS.LOADING}
+      onChange={handleChange}
+      onCreateOption={handleCreateOption}
+      onSearchChange={debounce(setSearchValue, 500)}
+      options={options}
+      placeholder={placeholder}
+      selectedOptions={selectedOptions}
+      singleSelection={{ asPlainText: true }}
+      style={{ minWidth: '256px' }}
+    />
+  );
+}
diff --git a/x-pack/plugins/apm/public/components/shared/suggestions_select/suggestions_select.stories.tsx b/x-pack/plugins/apm/public/components/shared/suggestions_select/suggestions_select.stories.tsx
new file mode 100644
index 00000000000000..d83ca13a9bb218
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/shared/suggestions_select/suggestions_select.stories.tsx
@@ -0,0 +1,77 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiComboBoxOptionOption } from '@elastic/eui';
+import { Meta, Story } from '@storybook/react';
+import React from 'react';
+import { CoreStart } from '../../../../../../../src/core/public';
+import { createKibanaReactContext } from '../../../../../../../src/plugins/kibana_react/public';
+import { createCallApmApi } from '../../../services/rest/createCallApmApi';
+import { SuggestionsSelect } from './';
+
+interface Args {
+  allOption: EuiComboBoxOptionOption<string>;
+  customOptionText: string;
+  field: string;
+  placeholder: string;
+  terms: string[];
+}
+
+const stories: Meta<Args> = {
+  title: 'shared/SuggestionsSelect',
+  component: SuggestionsSelect,
+  decorators: [
+    (StoryComponent, { args }) => {
+      const { terms } = args;
+
+      const coreMock = {
+        http: {
+          get: () => {
+            return { terms };
+          },
+        },
+        notifications: { toasts: { add: () => {} } },
+        uiSettings: { get: () => true },
+      } as unknown as CoreStart;
+
+      const KibanaReactContext = createKibanaReactContext(coreMock);
+
+      createCallApmApi(coreMock);
+
+      return (
+        <KibanaReactContext.Provider>
+          <StoryComponent />
+        </KibanaReactContext.Provider>
+      );
+    },
+  ],
+};
+export default stories;
+
+export const Example: Story<Args> = ({
+  allOption,
+  customOptionText,
+  field,
+  placeholder,
+}) => {
+  return (
+    <SuggestionsSelect
+      allOption={allOption}
+      customOptionText={customOptionText}
+      field={field}
+      onChange={() => {}}
+      placeholder={placeholder}
+    />
+  );
+};
+Example.args = {
+  allOption: { label: 'All the things', value: 'ALL_THE_THINGS' },
+  terms: ['thing1', 'thing2'],
+  customOptionText: 'Add {searchValue} as a new thing',
+  field: 'test.field',
+  placeholder: 'Select thing',
+};
diff --git a/x-pack/plugins/apm/public/components/shared/suggestions_select/suggestions_select.test.tsx b/x-pack/plugins/apm/public/components/shared/suggestions_select/suggestions_select.test.tsx
new file mode 100644
index 00000000000000..b1fce1c439f325
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/shared/suggestions_select/suggestions_select.test.tsx
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { composeStories } from '@storybook/testing-react';
+import { render } from '@testing-library/react';
+import React from 'react';
+import * as stories from './suggestions_select.stories';
+
+const { Example } = composeStories(stories);
+
+describe('SuggestionsSelect', () => {
+  it('renders', () => {
+    expect(() => render(<Example />)).not.toThrowError();
+  });
+});
diff --git a/x-pack/plugins/apm/readme.md b/x-pack/plugins/apm/readme.md
index fe7e77d28986cf..b78fd6162e7365 100644
--- a/x-pack/plugins/apm/readme.md
+++ b/x-pack/plugins/apm/readme.md
@@ -27,3 +27,4 @@ All files with a .stories.tsx extension will be loaded. You can access the devel
 - [Routing and Linking](./dev_docs/routing_and_linking.md)
 - [Telemetry](./dev_docs/telemetry.md)
 - [Features flags](./dev_docs/feature_flags.md)
+- [Official APM UI settings docs](https://www.elastic.co/guide/en/kibana/current/apm-settings-in-kibana.html)
diff --git a/x-pack/plugins/apm/server/index.ts b/x-pack/plugins/apm/server/index.ts
index 2c21ff17f779ba..b7002ff7cbe797 100644
--- a/x-pack/plugins/apm/server/index.ts
+++ b/x-pack/plugins/apm/server/index.ts
@@ -7,12 +7,13 @@
 
 import { schema, TypeOf } from '@kbn/config-schema';
 import {
-  PluginInitializerContext,
   PluginConfigDescriptor,
+  PluginInitializerContext,
 } from 'src/core/server';
 import { APMOSSConfig } from 'src/plugins/apm_oss/server';
-import { APMPlugin } from './plugin';
+import { maxSuggestions } from '../../observability/common';
 import { SearchAggregatedTransactionSetting } from '../common/aggregated_transactions';
+import { APMPlugin } from './plugin';
 
 const configSchema = schema.object({
   enabled: schema.boolean({ defaultValue: true }),
@@ -40,8 +41,6 @@ const configSchema = schema.object({
   ),
   telemetryCollectionEnabled: schema.boolean({ defaultValue: true }),
   metricsInterval: schema.number({ defaultValue: 30 }),
-  maxServiceEnvironments: schema.number({ defaultValue: 100 }),
-  maxServiceSelection: schema.number({ defaultValue: 50 }),
   profilingEnabled: schema.boolean({ defaultValue: false }),
   agent: schema.object({
     migrations: schema.object({
@@ -52,7 +51,17 @@ const configSchema = schema.object({
 
 // plugin config
 export const config: PluginConfigDescriptor<APMXPackConfig> = {
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
+  deprecations: ({ deprecate, renameFromRoot }) => [
+    deprecate('enabled', '8.0.0'),
+    renameFromRoot(
+      'xpack.apm.maxServiceEnvironments',
+      `uiSettings.overrides[${maxSuggestions}]`
+    ),
+    renameFromRoot(
+      'xpack.apm.maxServiceSelections',
+      `uiSettings.overrides[${maxSuggestions}]`
+    ),
+  ],
   exposeToBrowser: {
     serviceMapEnabled: true,
     ui: true,
@@ -91,8 +100,6 @@ export function mergeConfigs(
     'xpack.apm.serviceMapMaxTracesPerRequest':
       apmConfig.serviceMapMaxTracesPerRequest,
     'xpack.apm.ui.enabled': apmConfig.ui.enabled,
-    'xpack.apm.maxServiceEnvironments': apmConfig.maxServiceEnvironments,
-    'xpack.apm.maxServiceSelection': apmConfig.maxServiceSelection,
     'xpack.apm.ui.maxTraceItems': apmConfig.ui.maxTraceItems,
     'xpack.apm.ui.transactionGroupBucketSize':
       apmConfig.ui.transactionGroupBucketSize,
diff --git a/x-pack/plugins/apm/server/lib/anomaly_detection/create_anomaly_detection_jobs.ts b/x-pack/plugins/apm/server/lib/anomaly_detection/create_anomaly_detection_jobs.ts
index 1ea9ae6b65ac53..324202b207237e 100644
--- a/x-pack/plugins/apm/server/lib/anomaly_detection/create_anomaly_detection_jobs.ts
+++ b/x-pack/plugins/apm/server/lib/anomaly_detection/create_anomaly_detection_jobs.ts
@@ -5,21 +5,21 @@
  * 2.0.
  */
 
+import Boom from '@hapi/boom';
 import { Logger } from 'kibana/server';
-import uuid from 'uuid/v4';
 import { snakeCase } from 'lodash';
-import Boom from '@hapi/boom';
 import moment from 'moment';
+import uuid from 'uuid/v4';
 import { ML_ERRORS } from '../../../common/anomaly_detection';
-import { ProcessorEvent } from '../../../common/processor_event';
-import { environmentQuery } from '../../../common/utils/environment_query';
-import { Setup } from '../helpers/setup_request';
 import {
-  TRANSACTION_DURATION,
+  METRICSET_NAME,
   PROCESSOR_EVENT,
 } from '../../../common/elasticsearch_fieldnames';
-import { APM_ML_JOB_GROUP, ML_MODULE_ID_APM_TRANSACTION } from './constants';
+import { ProcessorEvent } from '../../../common/processor_event';
+import { environmentQuery } from '../../../common/utils/environment_query';
 import { withApmSpan } from '../../utils/with_apm_span';
+import { Setup } from '../helpers/setup_request';
+import { APM_ML_JOB_GROUP, ML_MODULE_ID_APM_TRANSACTION } from './constants';
 import { getAnomalyDetectionJobs } from './get_anomaly_detection_jobs';
 
 export async function createAnomalyDetectionJobs(
@@ -50,7 +50,7 @@ export async function createAnomalyDetectionJobs(
       `Creating ML anomaly detection jobs for environments: [${uniqueMlJobEnvs}].`
     );
 
-    const indexPatternName = indices['apm_oss.transactionIndices'];
+    const indexPatternName = indices['apm_oss.metricsIndices'];
     const responses = await Promise.all(
       uniqueMlJobEnvs.map((environment) =>
         createAnomalyDetectionJob({ ml, environment, indexPatternName })
@@ -92,8 +92,8 @@ async function createAnomalyDetectionJob({
       query: {
         bool: {
           filter: [
-            { term: { [PROCESSOR_EVENT]: ProcessorEvent.transaction } },
-            { exists: { field: TRANSACTION_DURATION } },
+            { term: { [PROCESSOR_EVENT]: ProcessorEvent.metric } },
+            { term: { [METRICSET_NAME]: 'transaction' } },
             ...environmentQuery(environment),
           ],
         },
@@ -105,7 +105,7 @@ async function createAnomalyDetectionJob({
             job_tags: {
               environment,
               // identifies this as an APM ML job & facilitates future migrations
-              apm_ml_version: 2,
+              apm_ml_version: 3,
             },
           },
         },
diff --git a/x-pack/plugins/apm/server/lib/environments/__snapshots__/get_all_environments.test.ts.snap b/x-pack/plugins/apm/server/lib/environments/__snapshots__/get_all_environments.test.ts.snap
index da2309afa07cf7..61f5b575a5200c 100644
--- a/x-pack/plugins/apm/server/lib/environments/__snapshots__/get_all_environments.test.ts.snap
+++ b/x-pack/plugins/apm/server/lib/environments/__snapshots__/get_all_environments.test.ts.snap
@@ -15,7 +15,7 @@ Object {
         "terms": Object {
           "field": "service.environment",
           "missing": undefined,
-          "size": 100,
+          "size": 50,
         },
       },
     },
@@ -50,7 +50,7 @@ Object {
         "terms": Object {
           "field": "service.environment",
           "missing": "ENVIRONMENT_NOT_DEFINED",
-          "size": 100,
+          "size": 50,
         },
       },
     },
diff --git a/x-pack/plugins/apm/server/lib/environments/__snapshots__/get_environments.test.ts.snap b/x-pack/plugins/apm/server/lib/environments/__snapshots__/get_environments.test.ts.snap
index 47c5e9033eb0ca..d35aeda9e8681b 100644
--- a/x-pack/plugins/apm/server/lib/environments/__snapshots__/get_environments.test.ts.snap
+++ b/x-pack/plugins/apm/server/lib/environments/__snapshots__/get_environments.test.ts.snap
@@ -15,7 +15,7 @@ Object {
         "terms": Object {
           "field": "service.environment",
           "missing": "ENVIRONMENT_NOT_DEFINED",
-          "size": 100,
+          "size": 50,
         },
       },
     },
@@ -59,7 +59,7 @@ Object {
         "terms": Object {
           "field": "service.environment",
           "missing": "ENVIRONMENT_NOT_DEFINED",
-          "size": 100,
+          "size": 50,
         },
       },
     },
diff --git a/x-pack/plugins/apm/server/lib/environments/get_all_environments.test.ts b/x-pack/plugins/apm/server/lib/environments/get_all_environments.test.ts
index 2c1772cc5800a8..0f27839d940486 100644
--- a/x-pack/plugins/apm/server/lib/environments/get_all_environments.test.ts
+++ b/x-pack/plugins/apm/server/lib/environments/get_all_environments.test.ts
@@ -21,9 +21,10 @@ describe('getAllEnvironments', () => {
   it('fetches all environments', async () => {
     mock = await inspectSearchParams((setup) =>
       getAllEnvironments({
-        serviceName: 'test',
         searchAggregatedTransactions: false,
+        serviceName: 'test',
         setup,
+        size: 50,
       })
     );
 
@@ -33,10 +34,11 @@ describe('getAllEnvironments', () => {
   it('fetches all environments with includeMissing', async () => {
     mock = await inspectSearchParams((setup) =>
       getAllEnvironments({
+        includeMissing: true,
+        searchAggregatedTransactions: false,
         serviceName: 'test',
         setup,
-        searchAggregatedTransactions: false,
-        includeMissing: true,
+        size: 50,
       })
     );
 
diff --git a/x-pack/plugins/apm/server/lib/environments/get_all_environments.ts b/x-pack/plugins/apm/server/lib/environments/get_all_environments.ts
index f6a19879748532..1ddc3f7ed888c9 100644
--- a/x-pack/plugins/apm/server/lib/environments/get_all_environments.ts
+++ b/x-pack/plugins/apm/server/lib/environments/get_all_environments.ts
@@ -19,22 +19,23 @@ import { getProcessorEventForAggregatedTransactions } from '../helpers/aggregate
  * It's used in places where we get the list of all possible environments.
  */
 export async function getAllEnvironments({
+  includeMissing = false,
+  searchAggregatedTransactions,
   serviceName,
   setup,
-  searchAggregatedTransactions,
-  includeMissing = false,
+  size,
 }: {
+  includeMissing?: boolean;
+  searchAggregatedTransactions: boolean;
   serviceName?: string;
   setup: Setup;
-  searchAggregatedTransactions: boolean;
-  includeMissing?: boolean;
+  size: number;
 }) {
   const operationName = serviceName
     ? 'get_all_environments_for_service'
     : 'get_all_environments_for_all_services';
 
-  const { apmEventClient, config } = setup;
-  const maxServiceEnvironments = config['xpack.apm.maxServiceEnvironments'];
+  const { apmEventClient } = setup;
 
   // omit filter for service.name if "All" option is selected
   const serviceNameFilter = serviceName
@@ -65,7 +66,7 @@ export async function getAllEnvironments({
         environments: {
           terms: {
             field: SERVICE_ENVIRONMENT,
-            size: maxServiceEnvironments,
+            size,
             ...(!serviceName ? { min_doc_count: 0 } : {}),
             missing: includeMissing ? ENVIRONMENT_NOT_DEFINED.value : undefined,
           },
diff --git a/x-pack/plugins/apm/server/lib/environments/get_environments.test.ts b/x-pack/plugins/apm/server/lib/environments/get_environments.test.ts
index 26c4ee85e7d8b9..472fd9d226e354 100644
--- a/x-pack/plugins/apm/server/lib/environments/get_environments.test.ts
+++ b/x-pack/plugins/apm/server/lib/environments/get_environments.test.ts
@@ -24,6 +24,7 @@ describe('getEnvironments', () => {
         setup,
         serviceName: 'foo',
         searchAggregatedTransactions: false,
+        size: 50,
         start: 0,
         end: 50000,
       })
@@ -37,6 +38,7 @@ describe('getEnvironments', () => {
       getEnvironments({
         setup,
         searchAggregatedTransactions: false,
+        size: 50,
         start: 0,
         end: 50000,
       })
diff --git a/x-pack/plugins/apm/server/lib/environments/get_environments.ts b/x-pack/plugins/apm/server/lib/environments/get_environments.ts
index d87cdbe85e73fa..08f6f089e8d083 100644
--- a/x-pack/plugins/apm/server/lib/environments/get_environments.ts
+++ b/x-pack/plugins/apm/server/lib/environments/get_environments.ts
@@ -20,15 +20,17 @@ import { Setup } from '../helpers/setup_request';
  * filtered by range.
  */
 export async function getEnvironments({
-  setup,
-  serviceName,
   searchAggregatedTransactions,
+  serviceName,
+  setup,
+  size,
   start,
   end,
 }: {
   setup: Setup;
   serviceName?: string;
   searchAggregatedTransactions: boolean;
+  size: number;
   start: number;
   end: number;
 }) {
@@ -36,7 +38,7 @@ export async function getEnvironments({
     ? 'get_environments_for_service'
     : 'get_environments';
 
-  const { apmEventClient, config } = setup;
+  const { apmEventClient } = setup;
 
   const filter = rangeQuery(start, end);
 
@@ -46,8 +48,6 @@ export async function getEnvironments({
     });
   }
 
-  const maxServiceEnvironments = config['xpack.apm.maxServiceEnvironments'];
-
   const params = {
     apm: {
       events: [
@@ -70,7 +70,7 @@ export async function getEnvironments({
           terms: {
             field: SERVICE_ENVIRONMENT,
             missing: ENVIRONMENT_NOT_DEFINED.value,
-            size: maxServiceEnvironments,
+            size,
           },
         },
       },
diff --git a/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/index.ts b/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/index.ts
index 3fed3c92c440c6..b2b2a0b869c801 100644
--- a/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/index.ts
+++ b/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/index.ts
@@ -5,6 +5,10 @@
  * 2.0.
  */
 
+import type {
+  TermsEnumRequest,
+  TermsEnumResponse,
+} from '@elastic/elasticsearch/api/types';
 import { ValuesType } from 'utility-types';
 import { withApmSpan } from '../../../../utils/with_apm_span';
 import { Profile } from '../../../../../typings/es_schemas/ui/profile';
@@ -39,6 +43,10 @@ export type APMEventESSearchRequest = Omit<ESSearchRequest, 'index'> & {
   };
 };
 
+export type APMEventESTermsEnumRequest = Omit<TermsEnumRequest, 'index'> & {
+  apm: { events: ProcessorEvent[] };
+};
+
 // These keys shoul all be `ProcessorEvent.x`, but until TypeScript 4.2 we're inlining them here.
 // See https://github.com/microsoft/TypeScript/issues/37888
 type TypeOfProcessorEvent<T extends ProcessorEvent> = {
@@ -124,5 +132,44 @@ export function createApmEventClient({
         requestParams: searchParams,
       });
     },
+
+    async termsEnum(
+      operationName: string,
+      params: APMEventESTermsEnumRequest
+    ): Promise<TermsEnumResponse> {
+      const requestType = 'terms_enum';
+      const { index } = unpackProcessorEvents(params, indices);
+
+      return callAsyncWithDebug({
+        cb: () => {
+          const { apm, ...rest } = params;
+          const termsEnumPromise = withApmSpan(operationName, () =>
+            cancelEsRequestOnAbort(
+              esClient.termsEnum({
+                index: Array.isArray(index) ? index.join(',') : index,
+                ...rest,
+              }),
+              request
+            )
+          );
+
+          return unwrapEsResponse(termsEnumPromise);
+        },
+        getDebugMessage: () => ({
+          body: getDebugBody({
+            params,
+            requestType,
+            operationName,
+          }),
+          title: getDebugTitle(request),
+        }),
+        isCalledWithInternalUser: false,
+        debug,
+        request,
+        requestType,
+        operationName,
+        requestParams: params,
+      });
+    },
   };
 }
diff --git a/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/unpack_processor_events.ts b/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/unpack_processor_events.ts
index 8732ba81f9ae64..47a2b3fe7e5c8a 100644
--- a/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/unpack_processor_events.ts
+++ b/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/unpack_processor_events.ts
@@ -12,7 +12,7 @@ import {
   ESSearchRequest,
   ESFilter,
 } from '../../../../../../../../src/core/types/elasticsearch';
-import { APMEventESSearchRequest } from '.';
+import { APMEventESSearchRequest, APMEventESTermsEnumRequest } from '.';
 import {
   ApmIndicesConfig,
   ApmIndicesName,
@@ -28,7 +28,7 @@ const processorEventIndexMap: Record<ProcessorEvent, ApmIndicesName> = {
 };
 
 export function unpackProcessorEvents(
-  request: APMEventESSearchRequest,
+  request: APMEventESSearchRequest | APMEventESTermsEnumRequest,
   indices: ApmIndicesConfig
 ) {
   const { apm, ...params } = request;
diff --git a/x-pack/plugins/apm/server/lib/service_map/get_service_anomalies.ts b/x-pack/plugins/apm/server/lib/service_map/get_service_anomalies.ts
index 9b2d79dc726eea..97c95e4e40045c 100644
--- a/x-pack/plugins/apm/server/lib/service_map/get_service_anomalies.ts
+++ b/x-pack/plugins/apm/server/lib/service_map/get_service_anomalies.ts
@@ -11,7 +11,11 @@ import { estypes } from '@elastic/elasticsearch';
 import { ESSearchResponse } from '../../../../../../src/core/types/elasticsearch';
 import { MlPluginSetup } from '../../../../ml/server';
 import { PromiseReturnType } from '../../../../observability/typings/common';
-import { getSeverity, ML_ERRORS } from '../../../common/anomaly_detection';
+import {
+  getSeverity,
+  ML_ERRORS,
+  ML_TRANSACTION_LATENCY_DETECTOR_INDEX,
+} from '../../../common/anomaly_detection';
 import { ENVIRONMENT_ALL } from '../../../common/environment_filter_values';
 import { getServiceHealthStatus } from '../../../common/service_health_status';
 import {
@@ -22,6 +26,7 @@ import { rangeQuery } from '../../../../observability/server';
 import { withApmSpan } from '../../utils/with_apm_span';
 import { getMlJobsWithAPMGroup } from '../anomaly_detection/get_ml_jobs_with_apm_group';
 import { Setup } from '../helpers/setup_request';
+import { apmMlAnomalyQuery } from '../../../common/utils/apm_ml_anomaly_query';
 
 export const DEFAULT_ANOMALIES: ServiceAnomaliesResponse = {
   mlJobIds: [],
@@ -56,7 +61,7 @@ export async function getServiceAnomalies({
         query: {
           bool: {
             filter: [
-              { terms: { result_type: ['model_plot', 'record'] } },
+              ...apmMlAnomalyQuery(ML_TRANSACTION_LATENCY_DETECTOR_INDEX),
               ...rangeQuery(
                 Math.min(end - 30 * 60 * 1000, start),
                 end,
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/__snapshots__/queries.test.ts.snap b/x-pack/plugins/apm/server/lib/settings/agent_configuration/__snapshots__/queries.test.ts.snap
index 18ef3f44331d98..b6b4f2208d04f5 100644
--- a/x-pack/plugins/apm/server/lib/settings/agent_configuration/__snapshots__/queries.test.ts.snap
+++ b/x-pack/plugins/apm/server/lib/settings/agent_configuration/__snapshots__/queries.test.ts.snap
@@ -99,7 +99,7 @@ Object {
         "terms": Object {
           "field": "service.environment",
           "missing": undefined,
-          "size": 100,
+          "size": 50,
         },
       },
     },
@@ -127,7 +127,7 @@ Object {
         "terms": Object {
           "field": "service.environment",
           "missing": "ALL_OPTION_VALUE",
-          "size": 100,
+          "size": 50,
         },
       },
     },
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_environments/get_existing_environments_for_service.ts b/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_environments/get_existing_environments_for_service.ts
index 124a373d3cf070..4fd351f8708a2f 100644
--- a/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_environments/get_existing_environments_for_service.ts
+++ b/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_environments/get_existing_environments_for_service.ts
@@ -15,12 +15,13 @@ import { ALL_OPTION_VALUE } from '../../../../../common/agent_configuration/all_
 export async function getExistingEnvironmentsForService({
   serviceName,
   setup,
+  size,
 }: {
   serviceName: string | undefined;
   setup: Setup;
+  size: number;
 }) {
-  const { internalClient, indices, config } = setup;
-  const maxServiceEnvironments = config['xpack.apm.maxServiceEnvironments'];
+  const { internalClient, indices } = setup;
 
   const bool = serviceName
     ? { filter: [{ term: { [SERVICE_NAME]: serviceName } }] }
@@ -36,7 +37,7 @@ export async function getExistingEnvironmentsForService({
           terms: {
             field: SERVICE_ENVIRONMENT,
             missing: ALL_OPTION_VALUE,
-            size: maxServiceEnvironments,
+            size,
           },
         },
       },
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_environments/index.ts b/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_environments/index.ts
index 0ab56ac372706e..dadb29d156e0bb 100644
--- a/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_environments/index.ts
+++ b/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_environments/index.ts
@@ -20,15 +20,22 @@ export async function getEnvironments({
   serviceName,
   setup,
   searchAggregatedTransactions,
+  size,
 }: {
   serviceName: string | undefined;
   setup: Setup;
   searchAggregatedTransactions: boolean;
+  size: number;
 }) {
   return withApmSpan('get_environments_for_agent_configuration', async () => {
     const [allEnvironments, existingEnvironments] = await Promise.all([
-      getAllEnvironments({ serviceName, setup, searchAggregatedTransactions }),
-      getExistingEnvironmentsForService({ serviceName, setup }),
+      getAllEnvironments({
+        searchAggregatedTransactions,
+        serviceName,
+        setup,
+        size,
+      }),
+      getExistingEnvironmentsForService({ serviceName, setup, size }),
     ]);
 
     return [ALL_OPTION_VALUE, ...allEnvironments].map((environment) => {
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_service_names.ts b/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_service_names.ts
index 0786bc6bc27714..282eacbec66d1b 100644
--- a/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_service_names.ts
+++ b/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_service_names.ts
@@ -15,15 +15,17 @@ import { getProcessorEventForAggregatedTransactions } from '../../helpers/aggreg
 export type AgentConfigurationServicesAPIResponse = PromiseReturnType<
   typeof getServiceNames
 >;
+
 export async function getServiceNames({
   setup,
   searchAggregatedTransactions,
+  size,
 }: {
   setup: Setup;
   searchAggregatedTransactions: boolean;
+  size: number;
 }) {
-  const { apmEventClient, config } = setup;
-  const maxServiceSelection = config['xpack.apm.maxServiceSelection'];
+  const { apmEventClient } = setup;
 
   const params = {
     apm: {
@@ -42,8 +44,8 @@ export async function getServiceNames({
         services: {
           terms: {
             field: SERVICE_NAME,
-            size: maxServiceSelection,
             min_doc_count: 0,
+            size,
           },
         },
       },
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/queries.test.ts b/x-pack/plugins/apm/server/lib/settings/agent_configuration/queries.test.ts
index 17f51e8826d9d5..4ffc8ed98184bb 100644
--- a/x-pack/plugins/apm/server/lib/settings/agent_configuration/queries.test.ts
+++ b/x-pack/plugins/apm/server/lib/settings/agent_configuration/queries.test.ts
@@ -27,9 +27,10 @@ describe('agent configuration queries', () => {
     it('fetches all environments', async () => {
       mock = await inspectSearchParams((setup) =>
         getAllEnvironments({
+          searchAggregatedTransactions: false,
           serviceName: 'foo',
           setup,
-          searchAggregatedTransactions: false,
+          size: 50,
         })
       );
 
@@ -43,6 +44,7 @@ describe('agent configuration queries', () => {
         getExistingEnvironmentsForService({
           serviceName: 'foo',
           setup,
+          size: 50,
         })
       );
 
@@ -56,6 +58,7 @@ describe('agent configuration queries', () => {
         getServiceNames({
           setup,
           searchAggregatedTransactions: false,
+          size: 50,
         })
       );
 
diff --git a/x-pack/plugins/apm/server/lib/suggestions/get_suggestions.ts b/x-pack/plugins/apm/server/lib/suggestions/get_suggestions.ts
new file mode 100644
index 00000000000000..acd44366ef4c36
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/suggestions/get_suggestions.ts
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ProcessorEvent } from '../../../common/processor_event';
+import { getProcessorEventForAggregatedTransactions } from '../helpers/aggregated_transactions';
+import { Setup } from '../helpers/setup_request';
+
+export async function getSuggestions({
+  field,
+  searchAggregatedTransactions,
+  setup,
+  size,
+  string,
+}: {
+  field: string;
+  searchAggregatedTransactions: boolean;
+  setup: Setup;
+  size: number;
+  string: string;
+}) {
+  const { apmEventClient } = setup;
+
+  const response = await apmEventClient.termsEnum('get_suggestions', {
+    apm: {
+      events: [
+        getProcessorEventForAggregatedTransactions(
+          searchAggregatedTransactions
+        ),
+        ProcessorEvent.error,
+        ProcessorEvent.metric,
+      ],
+    },
+    body: {
+      case_insensitive: true,
+      field,
+      size,
+      string,
+    },
+  });
+
+  return { terms: response.terms };
+}
diff --git a/x-pack/plugins/apm/server/lib/transactions/get_anomaly_data/fetcher.ts b/x-pack/plugins/apm/server/lib/transactions/get_anomaly_data/fetcher.ts
index a61e0614f5b1ad..a7357bbc1dd348 100644
--- a/x-pack/plugins/apm/server/lib/transactions/get_anomaly_data/fetcher.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/get_anomaly_data/fetcher.ts
@@ -12,6 +12,8 @@ import { rangeQuery } from '../../../../../observability/server';
 import { asMutableArray } from '../../../../common/utils/as_mutable_array';
 import { withApmSpan } from '../../../utils/with_apm_span';
 import { Setup } from '../../helpers/setup_request';
+import { apmMlAnomalyQuery } from '../../../../common/utils/apm_ml_anomaly_query';
+import { ML_TRANSACTION_LATENCY_DETECTOR_INDEX } from '../../../../common/anomaly_detection';
 
 export type ESResponse = Exclude<
   PromiseReturnType<typeof anomalySeriesFetcher>,
@@ -40,7 +42,7 @@ export function anomalySeriesFetcher({
         query: {
           bool: {
             filter: [
-              { terms: { result_type: ['model_plot', 'record'] } },
+              ...apmMlAnomalyQuery(ML_TRANSACTION_LATENCY_DETECTOR_INDEX),
               { term: { partition_field_value: serviceName } },
               { term: { by_field_value: transactionType } },
               ...rangeQuery(start, end, 'timestamp'),
diff --git a/x-pack/plugins/apm/server/routes/environments.ts b/x-pack/plugins/apm/server/routes/environments.ts
index 95ebb2bf134316..4b00320009e27b 100644
--- a/x-pack/plugins/apm/server/routes/environments.ts
+++ b/x-pack/plugins/apm/server/routes/environments.ts
@@ -6,6 +6,7 @@
  */
 
 import * as t from 'io-ts';
+import { maxSuggestions } from '../../../observability/common';
 import { getSearchAggregatedTransactions } from '../lib/helpers/aggregated_transactions';
 import { setupRequest } from '../lib/helpers/setup_request';
 import { getEnvironments } from '../lib/environments/get_environments';
@@ -26,7 +27,7 @@ const environmentsRoute = createApmServerRoute({
   options: { tags: ['access:apm'] },
   handler: async (resources) => {
     const setup = await setupRequest(resources);
-    const { params } = resources;
+    const { context, params } = resources;
     const { serviceName, start, end } = params.query;
     const searchAggregatedTransactions = await getSearchAggregatedTransactions({
       apmEventClient: setup.apmEventClient,
@@ -35,11 +36,14 @@ const environmentsRoute = createApmServerRoute({
       end,
       kuery: '',
     });
-
+    const size = await context.core.uiSettings.client.get<number>(
+      maxSuggestions
+    );
     const environments = await getEnvironments({
       setup,
       serviceName,
       searchAggregatedTransactions,
+      size,
       start,
       end,
     });
diff --git a/x-pack/plugins/apm/server/routes/get_global_apm_server_route_repository.ts b/x-pack/plugins/apm/server/routes/get_global_apm_server_route_repository.ts
index 09756e30d96825..7aa520dd5b8a26 100644
--- a/x-pack/plugins/apm/server/routes/get_global_apm_server_route_repository.ts
+++ b/x-pack/plugins/apm/server/routes/get_global_apm_server_route_repository.ts
@@ -33,6 +33,7 @@ import { traceRouteRepository } from './traces';
 import { transactionRouteRepository } from './transactions';
 import { APMRouteHandlerResources } from './typings';
 import { historicalDataRouteRepository } from './historical_data';
+import { suggestionsRouteRepository } from './suggestions';
 
 const getTypedGlobalApmServerRouteRepository = () => {
   const repository = createApmServerRouteRepository()
@@ -45,6 +46,7 @@ const getTypedGlobalApmServerRouteRepository = () => {
     .merge(serviceMapRouteRepository)
     .merge(serviceNodeRouteRepository)
     .merge(serviceRouteRepository)
+    .merge(suggestionsRouteRepository)
     .merge(traceRouteRepository)
     .merge(transactionRouteRepository)
     .merge(alertsChartPreviewRouteRepository)
diff --git a/x-pack/plugins/apm/server/routes/settings/agent_configuration.ts b/x-pack/plugins/apm/server/routes/settings/agent_configuration.ts
index 589ae41bfdc6a8..a904e5e03b5310 100644
--- a/x-pack/plugins/apm/server/routes/settings/agent_configuration.ts
+++ b/x-pack/plugins/apm/server/routes/settings/agent_configuration.ts
@@ -8,6 +8,7 @@
 import * as t from 'io-ts';
 import Boom from '@hapi/boom';
 import { toBooleanRt } from '@kbn/io-ts-utils';
+import { maxSuggestions } from '../../../../observability/common';
 import { setupRequest } from '../../lib/helpers/setup_request';
 import { getServiceNames } from '../../lib/settings/agent_configuration/get_service_names';
 import { createOrUpdateConfiguration } from '../../lib/settings/agent_configuration/create_or_update_configuration';
@@ -251,9 +252,13 @@ const listAgentConfigurationServicesRoute = createApmServerRoute({
       start,
       end,
     });
+    const size = await resources.context.core.uiSettings.client.get<number>(
+      maxSuggestions
+    );
     const serviceNames = await getServiceNames({
-      setup,
       searchAggregatedTransactions,
+      setup,
+      size,
     });
 
     return { serviceNames };
@@ -269,7 +274,7 @@ const listAgentConfigurationEnvironmentsRoute = createApmServerRoute({
   options: { tags: ['access:apm'] },
   handler: async (resources) => {
     const setup = await setupRequest(resources);
-    const { params } = resources;
+    const { context, params } = resources;
 
     const { serviceName, start, end } = params.query;
     const searchAggregatedTransactions = await getSearchAggregatedTransactions({
@@ -279,11 +284,14 @@ const listAgentConfigurationEnvironmentsRoute = createApmServerRoute({
       start,
       end,
     });
-
+    const size = await context.core.uiSettings.client.get<number>(
+      maxSuggestions
+    );
     const environments = await getEnvironments({
       serviceName,
       setup,
       searchAggregatedTransactions,
+      size,
     });
 
     return { environments };
diff --git a/x-pack/plugins/apm/server/routes/settings/anomaly_detection.ts b/x-pack/plugins/apm/server/routes/settings/anomaly_detection.ts
index d15f2324118106..c7e45eb8c32e57 100644
--- a/x-pack/plugins/apm/server/routes/settings/anomaly_detection.ts
+++ b/x-pack/plugins/apm/server/routes/settings/anomaly_detection.ts
@@ -7,6 +7,7 @@
 
 import * as t from 'io-ts';
 import Boom from '@hapi/boom';
+import { maxSuggestions } from '../../../../observability/common';
 import { isActivePlatinumLicense } from '../../../common/license_check';
 import { ML_ERRORS } from '../../../common/anomaly_detection';
 import { createApmServerRoute } from '../create_apm_server_route';
@@ -92,11 +93,14 @@ const anomalyDetectionEnvironmentsRoute = createApmServerRoute({
       config: setup.config,
       kuery: '',
     });
-
+    const size = await resources.context.core.uiSettings.client.get<number>(
+      maxSuggestions
+    );
     const environments = await getAllEnvironments({
-      setup,
-      searchAggregatedTransactions,
       includeMissing: true,
+      searchAggregatedTransactions,
+      setup,
+      size,
     });
 
     return { environments };
diff --git a/x-pack/plugins/apm/server/routes/suggestions.ts b/x-pack/plugins/apm/server/routes/suggestions.ts
new file mode 100644
index 00000000000000..8b82601650a481
--- /dev/null
+++ b/x-pack/plugins/apm/server/routes/suggestions.ts
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as t from 'io-ts';
+import { maxSuggestions } from '../../../observability/common';
+import { getSuggestions } from '../lib/suggestions/get_suggestions';
+import { getSearchAggregatedTransactions } from '../lib/helpers/aggregated_transactions';
+import { setupRequest } from '../lib/helpers/setup_request';
+import { createApmServerRoute } from './create_apm_server_route';
+import { createApmServerRouteRepository } from './create_apm_server_route_repository';
+
+const suggestionsRoute = createApmServerRoute({
+  endpoint: 'GET /internal/apm/suggestions',
+  params: t.partial({
+    query: t.type({ field: t.string, string: t.string }),
+  }),
+  options: { tags: ['access:apm'] },
+  handler: async (resources) => {
+    const setup = await setupRequest(resources);
+    const { context, params } = resources;
+    const { field, string } = params.query;
+    const searchAggregatedTransactions = await getSearchAggregatedTransactions({
+      apmEventClient: setup.apmEventClient,
+      config: setup.config,
+      kuery: '',
+    });
+    const size = await context.core.uiSettings.client.get<number>(
+      maxSuggestions
+    );
+    const suggestions = await getSuggestions({
+      field,
+      searchAggregatedTransactions,
+      setup,
+      size,
+      string,
+    });
+
+    return suggestions;
+  },
+});
+
+export const suggestionsRouteRepository =
+  createApmServerRouteRepository().add(suggestionsRoute);
diff --git a/x-pack/plugins/apm/server/utils/test_helpers.tsx b/x-pack/plugins/apm/server/utils/test_helpers.tsx
index 171af609c25622..7b6b549e07c8d1 100644
--- a/x-pack/plugins/apm/server/utils/test_helpers.tsx
+++ b/x-pack/plugins/apm/server/utils/test_helpers.tsx
@@ -79,12 +79,6 @@ export async function inspectSearchParams(
 
             case 'xpack.apm.metricsInterval':
               return 30;
-
-            case 'xpack.apm.maxServiceEnvironments':
-              return 100;
-
-            case 'xpack.apm.maxServiceSelection':
-              return 50;
           }
         },
       }
diff --git a/x-pack/plugins/canvas/public/components/home/__snapshots__/home.stories.storyshot b/x-pack/plugins/canvas/public/components/home/__snapshots__/home.stories.storyshot
index 8359b186e4afd1..d3ab369dcc32cb 100644
--- a/x-pack/plugins/canvas/public/components/home/__snapshots__/home.stories.storyshot
+++ b/x-pack/plugins/canvas/public/components/home/__snapshots__/home.stories.storyshot
@@ -13,7 +13,7 @@ exports[`Storyshots Home Home Page 1`] = `
     className="euiPageBody euiPageBody--borderRadiusNone"
   >
     <header
-      className="euiPageHeader euiPageHeader--paddingLarge euiPageHeader--responsive euiPageHeader--tabsAtBottom euiPage--restrictWidth-default euiPageHeader--center"
+      className="euiPageHeader euiPageHeader--paddingLarge euiPageHeader--restrictWidth-default euiPageHeader--responsive euiPageHeader--tabsAtBottom euiPageHeader--center"
     >
       <div
         className="euiPageHeaderContent"
@@ -78,7 +78,7 @@ exports[`Storyshots Home Home Page 1`] = `
             className="euiSpacer euiSpacer--l"
           />
           <div
-            className="euiTabs euiTabs--condensed euiTabs--large"
+            className="euiTabs euiTabs--large euiTabs--condensed"
             role="tablist"
           >
             <button
diff --git a/x-pack/plugins/discover_enhanced/kibana.json b/x-pack/plugins/discover_enhanced/kibana.json
index cb05cbd3e724de..426da33ae64f1e 100644
--- a/x-pack/plugins/discover_enhanced/kibana.json
+++ b/x-pack/plugins/discover_enhanced/kibana.json
@@ -5,7 +5,7 @@
   "server": true,
   "ui": true,
   "requiredPlugins": ["uiActions", "embeddable", "discover"],
-  "optionalPlugins": ["share", "kibanaLegacy", "usageCollection"],
+  "optionalPlugins": ["share", "usageCollection"],
   "configPath": ["xpack", "discoverEnhanced"],
   "requiredBundles": ["kibanaUtils", "data"],
   "owner": {
diff --git a/x-pack/plugins/discover_enhanced/public/plugin.ts b/x-pack/plugins/discover_enhanced/public/plugin.ts
index 3b437ead81d789..63a7e1b6c1c6b8 100644
--- a/x-pack/plugins/discover_enhanced/public/plugin.ts
+++ b/x-pack/plugins/discover_enhanced/public/plugin.ts
@@ -12,7 +12,6 @@ import { APPLY_FILTER_TRIGGER } from '../../../../src/plugins/data/public';
 import { createStartServicesGetter } from '../../../../src/plugins/kibana_utils/public';
 import { DiscoverSetup, DiscoverStart } from '../../../../src/plugins/discover/public';
 import { SharePluginSetup, SharePluginStart } from '../../../../src/plugins/share/public';
-import { KibanaLegacySetup, KibanaLegacyStart } from '../../../../src/plugins/kibana_legacy/public';
 import {
   EmbeddableSetup,
   EmbeddableStart,
@@ -24,7 +23,6 @@ import { Config } from '../common';
 export interface DiscoverEnhancedSetupDependencies {
   discover: DiscoverSetup;
   embeddable: EmbeddableSetup;
-  kibanaLegacy?: KibanaLegacySetup;
   share?: SharePluginSetup;
   uiActions: UiActionsSetup;
 }
@@ -32,7 +30,6 @@ export interface DiscoverEnhancedSetupDependencies {
 export interface DiscoverEnhancedStartDependencies {
   discover: DiscoverStart;
   embeddable: EmbeddableStart;
-  kibanaLegacy?: KibanaLegacyStart;
   share?: SharePluginStart;
   uiActions: UiActionsStart;
 }
diff --git a/x-pack/plugins/discover_enhanced/tsconfig.json b/x-pack/plugins/discover_enhanced/tsconfig.json
index f372b7a7539ac8..8ce3e5bf9f63a2 100644
--- a/x-pack/plugins/discover_enhanced/tsconfig.json
+++ b/x-pack/plugins/discover_enhanced/tsconfig.json
@@ -12,7 +12,6 @@
     { "path": "../../../src/plugins/data/tsconfig.json" },
     { "path": "../../../src/plugins/discover/tsconfig.json" },
     { "path": "../../../src/plugins/share/tsconfig.json" },
-    { "path": "../../../src/plugins/kibana_legacy/tsconfig.json" },
     { "path": "../../../src/plugins/kibana_utils/tsconfig.json" },
     { "path": "../../../src/plugins/url_forwarding/tsconfig.json" },
     { "path": "../../../src/plugins/usage_collection/tsconfig.json" },
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_logic.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_logic.test.tsx
new file mode 100644
index 00000000000000..5afbce3661da3b
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_logic.test.tsx
@@ -0,0 +1,152 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  LogicMounter,
+  mockFlashMessageHelpers,
+  mockHttpValues,
+} from '../../../../__mocks__/kea_logic';
+import '../../../__mocks__/engine_logic.mock';
+
+import { nextTick } from '@kbn/test/jest';
+
+import { DEFAULT_META } from '../../../../shared/constants';
+
+import { SuggestionsLogic } from './suggestions_logic';
+
+const DEFAULT_VALUES = {
+  dataLoading: true,
+  suggestions: [],
+  meta: {
+    ...DEFAULT_META,
+    page: {
+      ...DEFAULT_META.page,
+      size: 10,
+    },
+  },
+};
+
+const MOCK_RESPONSE = {
+  meta: {
+    page: {
+      current: 1,
+      size: 10,
+      total_results: 1,
+      total_pages: 1,
+    },
+  },
+  results: [
+    {
+      query: 'foo',
+      updated_at: '2021-07-08T14:35:50Z',
+      promoted: ['1', '2'],
+    },
+  ],
+};
+
+describe('SuggestionsLogic', () => {
+  const { mount } = new LogicMounter(SuggestionsLogic);
+  const { flashAPIErrors } = mockFlashMessageHelpers;
+  const { http } = mockHttpValues;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('has expected default values', () => {
+    mount();
+    expect(SuggestionsLogic.values).toEqual(DEFAULT_VALUES);
+  });
+
+  describe('actions', () => {
+    describe('onSuggestionsLoaded', () => {
+      it('should set suggestion, meta state, & dataLoading to false', () => {
+        mount();
+
+        SuggestionsLogic.actions.onSuggestionsLoaded(MOCK_RESPONSE);
+
+        expect(SuggestionsLogic.values).toEqual({
+          ...DEFAULT_VALUES,
+          suggestions: MOCK_RESPONSE.results,
+          meta: MOCK_RESPONSE.meta,
+          dataLoading: false,
+        });
+      });
+    });
+
+    describe('onPaginate', () => {
+      it('should update meta', () => {
+        mount();
+
+        SuggestionsLogic.actions.onPaginate(2);
+
+        expect(SuggestionsLogic.values).toEqual({
+          ...DEFAULT_VALUES,
+          meta: {
+            ...DEFAULT_META,
+            page: {
+              ...DEFAULT_META.page,
+              current: 2,
+            },
+          },
+        });
+      });
+    });
+  });
+
+  describe('listeners', () => {
+    describe('loadSuggestions', () => {
+      it('should set dataLoading state', () => {
+        mount({ dataLoading: false });
+
+        SuggestionsLogic.actions.loadSuggestions();
+
+        expect(SuggestionsLogic.values).toEqual({
+          ...DEFAULT_VALUES,
+          dataLoading: true,
+        });
+      });
+
+      it('should make an API call and set suggestions & meta state', async () => {
+        http.post.mockReturnValueOnce(Promise.resolve(MOCK_RESPONSE));
+        mount();
+        jest.spyOn(SuggestionsLogic.actions, 'onSuggestionsLoaded');
+
+        SuggestionsLogic.actions.loadSuggestions();
+        await nextTick();
+
+        expect(http.post).toHaveBeenCalledWith(
+          '/internal/app_search/engines/some-engine/search_relevance_suggestions',
+          {
+            body: JSON.stringify({
+              page: {
+                current: 1,
+                size: 10,
+              },
+              filters: {
+                status: ['pending'],
+                type: 'curation',
+              },
+            }),
+          }
+        );
+
+        expect(SuggestionsLogic.actions.onSuggestionsLoaded).toHaveBeenCalledWith(MOCK_RESPONSE);
+      });
+
+      it('handles errors', async () => {
+        http.post.mockReturnValueOnce(Promise.reject('error'));
+        mount();
+
+        SuggestionsLogic.actions.loadSuggestions();
+        await nextTick();
+
+        expect(flashAPIErrors).toHaveBeenCalledWith('error');
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_logic.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_logic.tsx
new file mode 100644
index 00000000000000..9352bdab51edda
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_logic.tsx
@@ -0,0 +1,98 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { kea, MakeLogicType } from 'kea';
+
+import { Meta } from '../../../../../../common/types';
+import { DEFAULT_META } from '../../../../shared/constants';
+import { flashAPIErrors } from '../../../../shared/flash_messages';
+import { HttpLogic } from '../../../../shared/http';
+import { updateMetaPageIndex } from '../../../../shared/table_pagination';
+import { EngineLogic } from '../../engine';
+import { CurationSuggestion } from '../types';
+
+interface SuggestionsAPIResponse {
+  results: CurationSuggestion[];
+  meta: Meta;
+}
+
+interface SuggestionsValues {
+  dataLoading: boolean;
+  suggestions: CurationSuggestion[];
+  meta: Meta;
+}
+
+interface SuggestionActions {
+  loadSuggestions(): void;
+  onPaginate(newPageIndex: number): { newPageIndex: number };
+  onSuggestionsLoaded(response: SuggestionsAPIResponse): SuggestionsAPIResponse;
+}
+
+export const SuggestionsLogic = kea<MakeLogicType<SuggestionsValues, SuggestionActions>>({
+  path: ['enterprise_search', 'app_search', 'curations', 'suggestions_logic'],
+  actions: () => ({
+    onPaginate: (newPageIndex) => ({ newPageIndex }),
+    onSuggestionsLoaded: ({ results, meta }) => ({ results, meta }),
+    loadSuggestions: true,
+  }),
+  reducers: () => ({
+    dataLoading: [
+      true,
+      {
+        loadSuggestions: () => true,
+        onSuggestionsLoaded: () => false,
+      },
+    ],
+    suggestions: [
+      [],
+      {
+        onSuggestionsLoaded: (_, { results }) => results,
+      },
+    ],
+    meta: [
+      {
+        ...DEFAULT_META,
+        page: {
+          ...DEFAULT_META.page,
+          size: 10,
+        },
+      },
+      {
+        onSuggestionsLoaded: (_, { meta }) => meta,
+        onPaginate: (state, { newPageIndex }) => updateMetaPageIndex(state, newPageIndex),
+      },
+    ],
+  }),
+  listeners: ({ actions, values }) => ({
+    loadSuggestions: async () => {
+      const { meta } = values;
+      const { http } = HttpLogic.values;
+      const { engineName } = EngineLogic.values;
+
+      try {
+        const response = await http.post(
+          `/internal/app_search/engines/${engineName}/search_relevance_suggestions`,
+          {
+            body: JSON.stringify({
+              page: {
+                current: meta.page.current,
+                size: meta.page.size,
+              },
+              filters: {
+                status: ['pending'],
+                type: 'curation',
+              },
+            }),
+          }
+        );
+        actions.onSuggestionsLoaded(response);
+      } catch (e) {
+        flashAPIErrors(e);
+      }
+    },
+  }),
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.test.tsx
index f12224908bd781..b49cea2519edae 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.test.tsx
@@ -5,7 +5,8 @@
  * 2.0.
  */
 
-import { mockKibanaValues, setMockValues } from '../../../../__mocks__/kea_logic';
+import '../../../../__mocks__/shallow_useeffect.mock';
+import { mockKibanaValues, setMockActions, setMockValues } from '../../../../__mocks__/kea_logic';
 import '../../../__mocks__/engine_logic.mock';
 
 import React from 'react';
@@ -21,10 +22,31 @@ describe('SuggestionsTable', () => {
 
   const values = {
     engineName: 'some-engine',
+    dataLoading: false,
+    suggestions: [
+      {
+        query: 'foo',
+        updated_at: '2021-07-08T14:35:50Z',
+        promoted: ['1', '2'],
+      },
+    ],
+    meta: {
+      page: {
+        current: 1,
+        size: 10,
+        total_results: 2,
+      },
+    },
+  };
+
+  const mockActions = {
+    loadSuggestions: jest.fn(),
+    onPaginate: jest.fn(),
   };
 
   beforeAll(() => {
     setMockValues(values);
+    setMockActions(mockActions);
   });
 
   beforeEach(() => {
@@ -79,4 +101,17 @@ describe('SuggestionsTable', () => {
     });
     expect(navigateToUrl).toHaveBeenCalledWith('/engines/some-engine/curations/suggestions/foo');
   });
+
+  it('fetches data on load', () => {
+    shallow(<SuggestionsTable />);
+
+    expect(mockActions.loadSuggestions).toHaveBeenCalled();
+  });
+
+  it('supports pagination', () => {
+    const wrapper = shallow(<SuggestionsTable />);
+    wrapper.find(EuiBasicTable).simulate('change', { page: { index: 0 } });
+
+    expect(mockActions.onPaginate).toHaveBeenCalledWith(1);
+  });
 });
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.tsx
index 7dc664f39f0ff3..779b86ce5156ea 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.tsx
@@ -5,7 +5,9 @@
  * 2.0.
  */
 
-import React from 'react';
+import React, { useEffect } from 'react';
+
+import { useActions, useValues } from 'kea';
 
 import { EuiBasicTable, EuiBasicTableColumn } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
@@ -22,6 +24,8 @@ import { generateEnginePath } from '../../engine';
 import { CurationSuggestion } from '../types';
 import { convertToDate } from '../utils';
 
+import { SuggestionsLogic } from './suggestions_logic';
+
 const getSuggestionRoute = (query: string) => {
   return generateEnginePath(ENGINE_CURATION_SUGGESTION_PATH, { query });
 };
@@ -74,32 +78,14 @@ const columns: Array<EuiBasicTableColumn<CurationSuggestion>> = [
 ];
 
 export const SuggestionsTable: React.FC = () => {
-  // TODO wire up this data
-  const items: CurationSuggestion[] = [
-    {
-      query: 'foo',
-      updated_at: '2021-07-08T14:35:50Z',
-      promoted: ['1', '2'],
-    },
-  ];
-  const meta = {
-    page: {
-      current: 1,
-      size: 10,
-      total_results: 100,
-      total_pages: 10,
-    },
-  };
+  const { loadSuggestions, onPaginate } = useActions(SuggestionsLogic);
+  const { meta, suggestions, dataLoading } = useValues(SuggestionsLogic);
+
+  useEffect(() => {
+    loadSuggestions();
+  }, [meta.page.current]);
+
   const totalSuggestions = meta.page.total_results;
-  // TODO
-  // @ts-ignore
-  const onPaginate = (...params) => {
-    // eslint-disable-next-line no-console
-    console.log('paging...');
-    // eslint-disable-next-line no-console
-    console.log(params);
-  };
-  const isLoading = false;
 
   return (
     <DataPanel
@@ -126,10 +112,10 @@ export const SuggestionsTable: React.FC = () => {
     >
       <EuiBasicTable
         columns={columns}
-        items={items}
+        items={suggestions}
         responsive
         hasActions
-        loading={isLoading}
+        loading={dataLoading}
         pagination={{
           ...convertMetaToPagination(meta),
           hidePerPageOptions: true,
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations.test.tsx
index effd03e2e7437f..7e357cae4343c0 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations.test.tsx
@@ -6,6 +6,7 @@
  */
 
 import { setMockActions, setMockValues } from '../../../../__mocks__/kea_logic';
+import '../../../../__mocks__/shallow_useeffect.mock';
 import '../../../../__mocks__/react_router';
 import '../../../__mocks__/engine_logic.mock';
 
@@ -15,7 +16,7 @@ import { shallow } from 'enzyme';
 
 import { EuiTab } from '@elastic/eui';
 
-import { mountWithIntl, getPageHeaderTabs, getPageTitle } from '../../../../test_helpers';
+import { getPageHeaderTabs, getPageTitle } from '../../../../test_helpers';
 
 import { Curations } from './curations';
 import { CurationsOverview } from './curations_overview';
@@ -109,8 +110,7 @@ describe('Curations', () => {
   });
 
   it('calls loadCurations on page load', () => {
-    setMockValues({ ...values, myRole: {} }); // Required for AppSearchPageTemplate to load
-    mountWithIntl(<Curations />);
+    shallow(<Curations />);
 
     expect(actions.loadCurations).toHaveBeenCalledTimes(1);
   });
diff --git a/x-pack/plugins/enterprise_search/server/routes/app_search/index.ts b/x-pack/plugins/enterprise_search/server/routes/app_search/index.ts
index f6979bce0e780c..737b21e6f5a929 100644
--- a/x-pack/plugins/enterprise_search/server/routes/app_search/index.ts
+++ b/x-pack/plugins/enterprise_search/server/routes/app_search/index.ts
@@ -22,6 +22,7 @@ import { registerResultSettingsRoutes } from './result_settings';
 import { registerRoleMappingsRoutes } from './role_mappings';
 import { registerSchemaRoutes } from './schema';
 import { registerSearchRoutes } from './search';
+import { registerSearchRelevanceSuggestionsRoutes } from './search_relevance_suggestions';
 import { registerSearchSettingsRoutes } from './search_settings';
 import { registerSearchUIRoutes } from './search_ui';
 import { registerSettingsRoutes } from './settings';
@@ -50,4 +51,5 @@ export const registerAppSearchRoutes = (dependencies: RouteDependencies) => {
   registerCrawlerEntryPointRoutes(dependencies);
   registerCrawlerCrawlRulesRoutes(dependencies);
   registerCrawlerSitemapRoutes(dependencies);
+  registerSearchRelevanceSuggestionsRoutes(dependencies);
 };
diff --git a/x-pack/plugins/enterprise_search/server/routes/app_search/search_relevance_suggestions.test.ts b/x-pack/plugins/enterprise_search/server/routes/app_search/search_relevance_suggestions.test.ts
new file mode 100644
index 00000000000000..555a66cedc85e7
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/server/routes/app_search/search_relevance_suggestions.test.ts
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { MockRouter, mockRequestHandler, mockDependencies } from '../../__mocks__';
+
+import { registerSearchRelevanceSuggestionsRoutes } from './search_relevance_suggestions';
+
+describe('search relevance insights routes', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('POST /internal/app_search/engines/{name}/search_relevance_suggestions', () => {
+    const mockRouter = new MockRouter({
+      method: 'post',
+      path: '/internal/app_search/engines/{engineName}/search_relevance_suggestions',
+    });
+
+    beforeEach(() => {
+      registerSearchRelevanceSuggestionsRoutes({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+    });
+
+    it('creates a request to enterprise search', () => {
+      mockRouter.callRoute({
+        params: { engineName: 'some-engine' },
+      });
+
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/api/as/v0/engines/:engineName/search_relevance_suggestions',
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/server/routes/app_search/search_relevance_suggestions.ts b/x-pack/plugins/enterprise_search/server/routes/app_search/search_relevance_suggestions.ts
new file mode 100644
index 00000000000000..147f68f0476eef
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/server/routes/app_search/search_relevance_suggestions.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { schema } from '@kbn/config-schema';
+
+import { RouteDependencies } from '../../plugin';
+
+export function registerSearchRelevanceSuggestionsRoutes({
+  router,
+  enterpriseSearchRequestHandler,
+}: RouteDependencies) {
+  router.post(
+    {
+      path: '/internal/app_search/engines/{engineName}/search_relevance_suggestions',
+      validate: {
+        params: schema.object({
+          engineName: schema.string(),
+        }),
+        body: schema.object({
+          page: schema.object({
+            current: schema.number(),
+            size: schema.number(),
+          }),
+          filters: schema.object({
+            status: schema.arrayOf(schema.string()),
+            type: schema.string(),
+          }),
+        }),
+      },
+    },
+    enterpriseSearchRequestHandler.createRequest({
+      path: '/api/as/v0/engines/:engineName/search_relevance_suggestions',
+    })
+  );
+}
diff --git a/x-pack/plugins/fleet/common/types/models/epm.ts b/x-pack/plugins/fleet/common/types/models/epm.ts
index 371304765a5f88..06e3d13c2394be 100644
--- a/x-pack/plugins/fleet/common/types/models/epm.ts
+++ b/x-pack/plugins/fleet/common/types/models/epm.ts
@@ -19,6 +19,8 @@ import type {
 } from '../../constants';
 import type { ValueOf } from '../../types';
 
+import type { CustomIntegrationIcon } from '../../../../../../src/plugins/custom_integrations/common';
+
 import type {
   PackageSpecManifest,
   PackageSpecIcon,
@@ -368,7 +370,7 @@ export interface IntegrationCardItem {
   name: string;
   title: string;
   version: string;
-  icons: PackageSpecIcon[];
+  icons: Array<PackageSpecIcon | CustomIntegrationIcon>;
   integration: string;
   id: string;
 }
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/detail.stories.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/detail.stories.tsx
new file mode 100644
index 00000000000000..67369c2f24cb3c
--- /dev/null
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/detail.stories.tsx
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { MemoryRouter, Route } from 'react-router-dom';
+
+import { INTEGRATIONS_ROUTING_PATHS } from '../../../../constants';
+
+import { Detail as Component } from '.';
+
+export default {
+  component: Component,
+  title: 'Sections/EPM/Detail',
+};
+
+export const nginx = () => (
+  <MemoryRouter initialEntries={['/detail/nginx-1.1.0/overview']}>
+    <Route path={INTEGRATIONS_ROUTING_PATHS.integration_details_overview}>
+      <Component />
+    </Route>
+  </MemoryRouter>
+);
+
+export const okta = () => (
+  <MemoryRouter initialEntries={['/detail/okta-1.2.0/overview']}>
+    <Route path={INTEGRATIONS_ROUTING_PATHS.integration_details_overview}>
+      <Component />
+    </Route>
+  </MemoryRouter>
+);
diff --git a/x-pack/plugins/fleet/public/components/package_icon.tsx b/x-pack/plugins/fleet/public/components/package_icon.tsx
index 85ae7971f46c2d..7a2a9f10913019 100644
--- a/x-pack/plugins/fleet/public/components/package_icon.tsx
+++ b/x-pack/plugins/fleet/public/components/package_icon.tsx
@@ -24,6 +24,8 @@ export const CardIcon: React.FunctionComponent<UsePackageIconType & Omit<EuiIcon
   const { icons } = props;
   if (icons && icons.length === 1 && icons[0].type === 'eui') {
     return <EuiIcon size={'xl'} type={icons[0].src} />;
+  } else if (icons && icons.length === 1 && icons[0].type === 'svg') {
+    return <EuiIcon size={'xl'} type={icons[0].src} />;
   } else {
     return <PackageIcon {...props} />;
   }
diff --git a/x-pack/plugins/fleet/server/index.ts b/x-pack/plugins/fleet/server/index.ts
index accd5e040f4f0b..897f160810e291 100644
--- a/x-pack/plugins/fleet/server/index.ts
+++ b/x-pack/plugins/fleet/server/index.ts
@@ -26,6 +26,7 @@ export {
   AgentPolicyServiceInterface,
   ArtifactsClientInterface,
   Artifact,
+  ListArtifactsProps,
 } from './services';
 
 export { FleetSetupContract, FleetSetupDeps, FleetStartContract } from './plugin';
diff --git a/x-pack/plugins/fleet/storybook/context/application.ts b/x-pack/plugins/fleet/storybook/context/application.ts
index 9a35514e21c67a..7503de562427f5 100644
--- a/x-pack/plugins/fleet/storybook/context/application.ts
+++ b/x-pack/plugins/fleet/storybook/context/application.ts
@@ -22,7 +22,14 @@ export const getApplication = () => {
       action(`Navigate to: ${app}`);
     },
     getUrlForApp: (url: string) => url,
-    capabilities: {} as ApplicationStart['capabilities'],
+    capabilities: {
+      catalogue: {},
+      management: {},
+      navLinks: {},
+      fleet: {
+        write: true,
+      },
+    },
     applications$: of(applications),
   };
 
diff --git a/x-pack/plugins/fleet/storybook/context/fixtures/integration.nginx.ts b/x-pack/plugins/fleet/storybook/context/fixtures/integration.nginx.ts
new file mode 100644
index 00000000000000..50262b73a6a417
--- /dev/null
+++ b/x-pack/plugins/fleet/storybook/context/fixtures/integration.nginx.ts
@@ -0,0 +1,664 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import type { GetInfoResponse } from '../../../public/types';
+import { KibanaAssetType, ElasticsearchAssetType } from '../../../common/types';
+
+export const response: GetInfoResponse['response'] = {
+  name: 'nginx',
+  title: 'Nginx',
+  version: '0.7.0',
+  release: 'experimental',
+  description: 'Nginx Integration',
+  type: 'integration',
+  download: '/epr/nginx/nginx-0.7.0.zip',
+  path: '/package/nginx/0.7.0',
+  icons: [
+    {
+      src: '/img/logo_nginx.svg',
+      path: '/package/nginx/0.7.0/img/logo_nginx.svg',
+      title: 'logo nginx',
+      size: '32x32',
+      type: 'image/svg+xml',
+    },
+  ],
+  format_version: '1.0.0',
+  readme: '/package/nginx/0.7.0/docs/README.md',
+  license: 'basic',
+  categories: ['web', 'security'],
+  conditions: {
+    kibana: { version: '^7.14.0' },
+  },
+  screenshots: [
+    {
+      src: '/img/nginx-metrics-overview.png',
+      path: '/package/nginx/0.7.0/img/nginx-metrics-overview.png',
+      title: 'Nginx metrics overview',
+      size: '3360x2302',
+      type: 'image/png',
+    },
+    {
+      src: '/img/nginx-logs-access-error.png',
+      path: '/package/nginx/0.7.0/img/nginx-logs-access-error.png',
+      title: 'Nginx access and error logs',
+      size: '3360x3590',
+      type: 'image/png',
+    },
+    {
+      src: '/img/nginx-logs-overview.png',
+      path: '/package/nginx/0.7.0/img/nginx-logs-overview.png',
+      title: 'Nginx logs overview',
+      size: '3360x3590',
+      type: 'image/png',
+    },
+  ],
+  assets: {
+    kibana: {
+      dashboard: [
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.dashboard,
+          file: 'nginx-023d2930-f1a5-11e7-a9ef-93c69af7b129.json',
+          // path: '-0.7.0/kibana/dashboard/nginx-023d2930-f1a5-11e7-a9ef-93c69af7b129.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.dashboard,
+          file: 'nginx-046212a0-a2a1-11e7-928f-5dbe6f6f5519.json',
+          // path: 'nginx-0.7.0/kibana/dashboard/nginx-046212a0-a2a1-11e7-928f-5dbe6f6f5519.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.dashboard,
+          file: 'nginx-55a9e6e0-a29e-11e7-928f-5dbe6f6f5519.json',
+          // path: 'nginx-0.7.0/kibana/dashboard/nginx-55a9e6e0-a29e-11e7-928f-5dbe6f6f5519.json',
+        },
+      ],
+      ml_module: [
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.mlModule,
+          file: 'nginx-Logs-ml.json',
+          // path: 'nginx-0.7.0/kibana/ml_module/nginx-Logs-ml.json',
+        },
+      ],
+      search: [
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.search,
+          file: 'nginx-6d9e66d0-a1f0-11e7-928f-5dbe6f6f5519.json',
+          // path: 'nginx-0.7.0/kibana/search/nginx-6d9e66d0-a1f0-11e7-928f-5dbe6f6f5519.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.search,
+          file: 'nginx-9eb25600-a1f0-11e7-928f-5dbe6f6f5519.json',
+          // path: 'nginx-0.7.0/kibana/search/nginx-9eb25600-a1f0-11e7-928f-5dbe6f6f5519.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.search,
+          file: 'nginx-Logs-Nginx-integration.json',
+          // path: 'nginx-0.7.0/kibana/search/nginx-Logs-Nginx-integration.json',
+        },
+      ],
+      visualization: [
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'nginx-0dd6f320-a29f-11e7-928f-5dbe6f6f5519.json',
+          // path: 'nginx-0.7.0/kibana/visualization/nginx-0dd6f320-a29f-11e7-928f-5dbe6f6f5519.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'nginx-1cfb1a80-a1f4-11e7-928f-5dbe6f6f5519.json',
+          // path: 'nginx-0.7.0/kibana/visualization/nginx-1cfb1a80-a1f4-11e7-928f-5dbe6f6f5519.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'nginx-46322e50-a1f6-11e7-928f-5dbe6f6f5519.json',
+          // path: 'nginx-0.7.0/kibana/visualization/nginx-46322e50-a1f6-11e7-928f-5dbe6f6f5519.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'nginx-47a8e0f0-f1a4-11e7-a9ef-93c69af7b129.json',
+          // path: 'nginx-0.7.0/kibana/visualization/nginx-47a8e0f0-f1a4-11e7-a9ef-93c69af7b129.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'nginx-555df8a0-f1a1-11e7-a9ef-93c69af7b129.json',
+          // path: 'nginx-0.7.0/kibana/visualization/nginx-555df8a0-f1a1-11e7-a9ef-93c69af7b129.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'nginx-7cc9ea40-3af8-11eb-94b7-0dab91df36a6.json',
+          // path: 'nginx-0.7.0/kibana/visualization/nginx-7cc9ea40-3af8-11eb-94b7-0dab91df36a6.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'nginx-823b3c80-3af9-11eb-94b7-0dab91df36a6.json',
+          // path: 'nginx-0.7.0/kibana/visualization/nginx-823b3c80-3af9-11eb-94b7-0dab91df36a6.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'nginx-9184fa00-a1f5-11e7-928f-5dbe6f6f5519.json',
+          // path: 'nginx-0.7.0/kibana/visualization/nginx-9184fa00-a1f5-11e7-928f-5dbe6f6f5519.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'nginx-9484ecf0-3af5-11eb-94b7-0dab91df36a6.json',
+          // path: 'nginx-0.7.0/kibana/visualization/nginx-9484ecf0-3af5-11eb-94b7-0dab91df36a6.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'nginx-97109780-a2a5-11e7-928f-5dbe6f6f5519.json',
+          // path: 'nginx-0.7.0/kibana/visualization/nginx-97109780-a2a5-11e7-928f-5dbe6f6f5519.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'nginx-Access-Browsers.json',
+          // path: 'nginx-0.7.0/kibana/visualization/nginx-Access-Browsers.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'nginx-Access-Map.json',
+          // path: 'nginx-0.7.0/kibana/visualization/nginx-Access-Map.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'nginx-Access-OSes.json',
+          // path: 'nginx-0.7.0/kibana/visualization/nginx-Access-OSes.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'nginx-a1d92240-f1a1-11e7-a9ef-93c69af7b129.json',
+          // path: 'nginx-0.7.0/kibana/visualization/nginx-a1d92240-f1a1-11e7-a9ef-93c69af7b129.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'nginx-b70b1b20-a1f4-11e7-928f-5dbe6f6f5519.json',
+          // path: 'nginx-0.7.0/kibana/visualization/nginx-b70b1b20-a1f4-11e7-928f-5dbe6f6f5519.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'nginx-d763a570-f1a1-11e7-a9ef-93c69af7b129.json',
+          // path: 'nginx-0.7.0/kibana/visualization/nginx-d763a570-f1a1-11e7-a9ef-93c69af7b129.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'nginx-dcbffe30-f1a4-11e7-a9ef-93c69af7b129.json',
+          // path: 'nginx-0.7.0/kibana/visualization/nginx-dcbffe30-f1a4-11e7-a9ef-93c69af7b129.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'nginx-e302b5a0-3afb-11eb-94b7-0dab91df36a6.json',
+          // path: 'nginx-0.7.0/kibana/visualization/nginx-e302b5a0-3afb-11eb-94b7-0dab91df36a6.json',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'nginx-ea7f9e10-3af6-11eb-94b7-0dab91df36a6.json',
+          // path: 'nginx-0.7.0/kibana/visualization/nginx-ea7f9e10-3af6-11eb-94b7-0dab91df36a6.json',
+        },
+      ],
+      //  TODO: These were missing from the response, but typed to be required.
+      index_pattern: [],
+      lens: [],
+      map: [],
+      security_rule: [],
+    },
+    elasticsearch: {
+      ingest_pipeline: [
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'elasticsearch',
+          type: ElasticsearchAssetType.ingestPipeline,
+          file: 'default.yml',
+          dataset: 'access',
+          // path: 'nginx-0.7.0/data_stream/access/elasticsearch/ingest_pipeline/default.yml',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'elasticsearch',
+          type: ElasticsearchAssetType.ingestPipeline,
+          file: 'third-party.yml',
+          dataset: 'access',
+          // path: 'nginx-0.7.0/data_stream/access/elasticsearch/ingest_pipeline/third-party.yml',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'elasticsearch',
+          type: ElasticsearchAssetType.ingestPipeline,
+          file: 'default.yml',
+          dataset: 'error',
+          // path: 'nginx-0.7.0/data_stream/error/elasticsearch/ingest_pipeline/default.yml',
+        },
+        {
+          pkgkey: 'nginx-0.7.0',
+          service: 'elasticsearch',
+          type: ElasticsearchAssetType.ingestPipeline,
+          file: 'third-party.yml',
+          dataset: 'error',
+          // path: 'nginx-0.7.0/data_stream/error/elasticsearch/ingest_pipeline/third-party.yml',
+        },
+      ],
+      // TODO: These were missing from the response, but typed to be required.
+      component_template: [],
+      data_stream_ilm_policy: [],
+      ilm_policy: [],
+      index_template: [],
+      transform: [],
+    },
+  },
+  policy_templates: [
+    {
+      name: 'nginx',
+      title: 'Nginx logs and metrics',
+      description: 'Collect logs and metrics from Nginx instances',
+      inputs: [
+        {
+          type: 'logfile',
+          title: 'Collect logs from Nginx instances',
+          description: 'Collecting Nginx access and error logs',
+        },
+        {
+          type: 'httpjson',
+          vars: [
+            {
+              name: 'url',
+              type: 'text',
+              title: 'URL of Splunk Enterprise Server',
+              description: 'i.e. scheme://host:port, path is automatic',
+              multi: false,
+              required: true,
+              show_user: true,
+              default: 'https://server.example.com:8089',
+            },
+            {
+              name: 'username',
+              type: 'text',
+              title: 'Splunk REST API Username',
+              multi: false,
+              required: false,
+              show_user: true,
+            },
+            {
+              name: 'password',
+              type: 'password',
+              title: 'Splunk REST API Password',
+              multi: false,
+              required: false,
+              show_user: true,
+            },
+            {
+              name: 'token',
+              type: 'password',
+              title: 'Splunk Authorization Token',
+              description:
+                'Bearer Token or Session Key, e.g. "Bearer eyJFd3e46..."\nor "Splunk 192fd3e...".  Cannot be used with username\nand password.\n',
+              multi: false,
+              required: false,
+              show_user: true,
+            },
+            {
+              name: 'ssl',
+              type: 'yaml',
+              title: 'SSL Configuration',
+              description:
+                'i.e. certificate_authorities, supported_protocols, verification_mode etc.',
+              multi: false,
+              required: false,
+              show_user: false,
+              default:
+                '#certificate_authorities:\n#  - |\n#    -----BEGIN CERTIFICATE-----\n#    MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n#    ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n#    MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n#    BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n#    fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n#    94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n#    /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n#    PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n#    CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n#    BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n#    8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n#    874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n#    3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n#    H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n#    8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n#    yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n#    sxSmbIUfc2SGJGCJD4I=\n#    -----END CERTIFICATE-----\n',
+            },
+          ],
+          title: 'Collect logs from third-party REST API (experimental)',
+          description: 'Collect logs from third-party REST API (experimental)',
+        },
+        {
+          type: 'nginx/metrics',
+          vars: [
+            {
+              name: 'hosts',
+              type: 'text',
+              title: 'Hosts',
+              multi: true,
+              required: true,
+              show_user: true,
+              default: ['http://127.0.0.1:80'],
+            },
+          ],
+          title: 'Collect metrics from Nginx instances',
+          description: 'Collecting Nginx stub status metrics',
+        },
+      ],
+      multiple: true,
+    },
+  ],
+  data_streams: [
+    {
+      type: 'logs',
+      dataset: 'nginx.access',
+      title: 'Nginx access logs',
+      release: 'experimental',
+      ingest_pipeline: 'default',
+      streams: [
+        {
+          input: 'logfile',
+          vars: [
+            {
+              name: 'paths',
+              type: 'text',
+              title: 'Paths',
+              multi: true,
+              required: true,
+              show_user: true,
+              default: ['/var/log/nginx/access.log*'],
+            },
+            {
+              name: 'tags',
+              type: 'text',
+              title: 'Tags',
+              multi: true,
+              required: true,
+              show_user: false,
+              default: ['nginx-access'],
+            },
+            {
+              name: 'preserve_original_event',
+              type: 'bool',
+              title: 'Preserve original event',
+              description:
+                'Preserves a raw copy of the original event, added to the field `event.original`',
+              multi: false,
+              required: true,
+              show_user: true,
+              default: false,
+            },
+            {
+              name: 'processors',
+              type: 'yaml',
+              title: 'Processors',
+              description:
+                'Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n',
+              multi: false,
+              required: false,
+              show_user: false,
+            },
+          ],
+          template_path: 'stream.yml.hbs',
+          title: 'Nginx access logs',
+          description: 'Collect Nginx access logs',
+          enabled: true,
+        },
+        {
+          input: 'httpjson',
+          vars: [
+            {
+              name: 'interval',
+              type: 'text',
+              title: 'Interval to query Splunk Enterprise REST API',
+              description: 'Go Duration syntax (eg. 10s)',
+              multi: false,
+              required: true,
+              show_user: true,
+              default: '10s',
+            },
+            {
+              name: 'search',
+              type: 'text',
+              title: 'Splunk search string',
+              multi: false,
+              required: true,
+              show_user: true,
+              default: 'search sourcetype=nginx:plus:access',
+            },
+            {
+              name: 'tags',
+              type: 'text',
+              title: 'Tags',
+              multi: true,
+              required: false,
+              show_user: false,
+              default: ['forwarded', 'nginx-access'],
+            },
+            {
+              name: 'preserve_original_event',
+              type: 'bool',
+              title: 'Preserve original event',
+              description:
+                'Preserves a raw copy of the original event, added to the field `event.original`',
+              multi: false,
+              required: true,
+              show_user: true,
+              default: false,
+            },
+            {
+              name: 'processors',
+              type: 'yaml',
+              title: 'Processors',
+              description:
+                'Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.',
+              multi: false,
+              required: false,
+              show_user: false,
+            },
+          ],
+          template_path: 'httpjson.yml.hbs',
+          title: 'Nginx access logs via Splunk Enterprise REST API',
+          description: 'Collect Nginx access logs via Splunk Enterprise REST API',
+          enabled: false,
+        },
+      ],
+      package: 'nginx',
+      path: 'access',
+    },
+    {
+      type: 'logs',
+      dataset: 'nginx.error',
+      title: 'Nginx error logs',
+      release: 'experimental',
+      ingest_pipeline: 'default',
+      streams: [
+        {
+          input: 'logfile',
+          vars: [
+            {
+              name: 'paths',
+              type: 'text',
+              title: 'Paths',
+              multi: true,
+              required: true,
+              show_user: true,
+              default: ['/var/log/nginx/error.log*'],
+            },
+            {
+              name: 'tags',
+              type: 'text',
+              title: 'Tags',
+              multi: true,
+              required: true,
+              show_user: false,
+              default: ['nginx-error'],
+            },
+            {
+              name: 'preserve_original_event',
+              type: 'bool',
+              title: 'Preserve original event',
+              description:
+                'Preserves a raw copy of the original event, added to the field `event.original`',
+              multi: false,
+              required: true,
+              show_user: true,
+              default: false,
+            },
+            {
+              name: 'processors',
+              type: 'yaml',
+              title: 'Processors',
+              description:
+                'Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n',
+              multi: false,
+              required: false,
+              show_user: false,
+            },
+          ],
+          template_path: 'stream.yml.hbs',
+          title: 'Nginx error logs',
+          description: 'Collect Nginx error logs',
+          enabled: true,
+        },
+        {
+          input: 'httpjson',
+          vars: [
+            {
+              name: 'interval',
+              type: 'text',
+              title: 'Interval to query REST API',
+              description: 'Go Duration syntax (eg. 10s)',
+              multi: false,
+              required: true,
+              show_user: true,
+              default: '10s',
+            },
+            {
+              name: 'search',
+              type: 'text',
+              title: 'Search String',
+              multi: false,
+              required: true,
+              show_user: true,
+              default: 'search sourcetype=nginx:plus:error',
+            },
+            {
+              name: 'tags',
+              type: 'text',
+              title: 'Tags',
+              multi: true,
+              required: false,
+              show_user: false,
+              default: ['forwarded', 'nginx-error'],
+            },
+            {
+              name: 'preserve_original_event',
+              type: 'bool',
+              title: 'Preserve original event',
+              description:
+                'Preserves a raw copy of the original event, added to the field `event.original`',
+              multi: false,
+              required: true,
+              show_user: true,
+              default: false,
+            },
+            {
+              name: 'processors',
+              type: 'yaml',
+              title: 'Processors',
+              description:
+                'Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.',
+              multi: false,
+              required: false,
+              show_user: false,
+            },
+          ],
+          template_path: 'httpjson.yml.hbs',
+          title: 'Nginx error logs via Splunk REST API',
+          description: 'Collect Nginx error logs via Splunk REST API',
+          enabled: false,
+        },
+      ],
+      package: 'nginx',
+      path: 'error',
+    },
+    {
+      type: 'metrics',
+      dataset: 'nginx.stubstatus',
+      title: 'Nginx stubstatus metrics',
+      release: 'experimental',
+      streams: [
+        {
+          input: 'nginx/metrics',
+          vars: [
+            {
+              name: 'period',
+              type: 'text',
+              title: 'Period',
+              multi: false,
+              required: true,
+              show_user: true,
+              default: '10s',
+            },
+            {
+              name: 'server_status_path',
+              type: 'text',
+              title: 'Server Status Path',
+              multi: false,
+              required: true,
+              show_user: false,
+              default: '/nginx_status',
+            },
+          ],
+          template_path: 'stream.yml.hbs',
+          title: 'Nginx stub status metrics',
+          description: 'Collect Nginx stub status metrics',
+          enabled: true,
+        },
+      ],
+      package: 'nginx',
+      path: 'stubstatus',
+    },
+  ],
+  owner: {
+    github: 'elastic/integrations',
+  },
+  latestVersion: '0.7.0',
+  removable: true,
+  status: 'not_installed',
+};
diff --git a/x-pack/plugins/fleet/storybook/context/fixtures/integration.okta.ts b/x-pack/plugins/fleet/storybook/context/fixtures/integration.okta.ts
new file mode 100644
index 00000000000000..efef00579f4bd0
--- /dev/null
+++ b/x-pack/plugins/fleet/storybook/context/fixtures/integration.okta.ts
@@ -0,0 +1,263 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import type { GetInfoResponse } from '../../../public/types';
+import { KibanaAssetType, ElasticsearchAssetType } from '../../../common/types';
+
+export const response: GetInfoResponse['response'] = {
+  name: 'okta',
+  title: 'Okta',
+  version: '1.2.0',
+  release: 'ga',
+  description: 'This Elastic integration collects events from Okta',
+  type: 'integration',
+  download: '/epr/okta/okta-1.2.0.zip',
+  // path: '/package/okta/1.2.0',
+  icons: [
+    {
+      src: '/img/okta-logo.svg',
+      // path: '/package/okta/1.2.0/img/okta-logo.svg',
+      title: 'Okta',
+      size: '216x216',
+      type: 'image/svg+xml',
+    },
+  ],
+  format_version: '1.0.0',
+  readme: '/package/okta/1.2.0/docs/README.md',
+  license: 'basic',
+  categories: ['security'],
+  conditions: {
+    kibana: { version: '^7.14.0' },
+  },
+  screenshots: [
+    {
+      src: '/img/filebeat-okta-dashboard.png',
+      // path: '/package/okta/1.2.0/img/filebeat-okta-dashboard.png',
+      title: 'Okta Dashboard',
+      size: '1024x662',
+      type: 'image/png',
+    },
+  ],
+  assets: {
+    kibana: {
+      dashboard: [
+        {
+          pkgkey: 'okta-1.2.0',
+          service: 'kibana',
+          type: KibanaAssetType.dashboard,
+          file: 'okta-749203a0-67b1-11ea-a76f-bf44814e437d.json',
+          // path: 'okta-1.2.0/kibana/dashboard/okta-749203a0-67b1-11ea-a76f-bf44814e437d.json',
+        },
+      ],
+      map: [
+        {
+          pkgkey: 'okta-1.2.0',
+          service: 'kibana',
+          type: KibanaAssetType.map,
+          file: 'okta-281ca660-67b1-11ea-a76f-bf44814e437d.json',
+          // path: 'okta-1.2.0/kibana/map/okta-281ca660-67b1-11ea-a76f-bf44814e437d.json',
+        },
+      ],
+      search: [
+        {
+          pkgkey: 'okta-1.2.0',
+          service: 'kibana',
+          type: KibanaAssetType.search,
+          file: 'okta-21028750-67ca-11ea-a76f-bf44814e437d.json',
+          // path: 'okta-1.2.0/kibana/search/okta-21028750-67ca-11ea-a76f-bf44814e437d.json',
+        },
+      ],
+      visualization: [
+        {
+          pkgkey: 'okta-1.2.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'okta-0a784b30-67c7-11ea-a76f-bf44814e437d.json',
+          // path: 'okta-1.2.0/kibana/visualization/okta-0a784b30-67c7-11ea-a76f-bf44814e437d.json',
+        },
+        {
+          pkgkey: 'okta-1.2.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'okta-545d6a00-67ae-11ea-a76f-bf44814e437d.json',
+          // path: 'okta-1.2.0/kibana/visualization/okta-545d6a00-67ae-11ea-a76f-bf44814e437d.json',
+        },
+        {
+          pkgkey: 'okta-1.2.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'okta-7c6ec080-67c6-11ea-a76f-bf44814e437d.json',
+          // path: 'okta-1.2.0/kibana/visualization/okta-7c6ec080-67c6-11ea-a76f-bf44814e437d.json',
+        },
+        {
+          pkgkey: 'okta-1.2.0',
+          service: 'kibana',
+          type: KibanaAssetType.visualization,
+          file: 'okta-cda883a0-67c6-11ea-a76f-bf44814e437d.json',
+          // path: 'okta-1.2.0/kibana/visualization/okta-cda883a0-67c6-11ea-a76f-bf44814e437d.json',
+        },
+      ],
+      //  TODO: These were missing from the response, but typed to be required.
+      index_pattern: [],
+      lens: [],
+      ml_module: [],
+      security_rule: [],
+    },
+    elasticsearch: {
+      ingest_pipeline: [
+        {
+          pkgkey: 'okta-1.2.0',
+          service: 'elasticsearch',
+          type: ElasticsearchAssetType.ingestPipeline,
+          file: 'default.yml',
+          dataset: 'system',
+          // path: 'okta-1.2.0/data_stream/system/elasticsearch/ingest_pipeline/default.yml',
+        },
+      ],
+      //  TODO: These were missing from the response, but typed to be required.
+      component_template: [],
+      data_stream_ilm_policy: [],
+      ilm_policy: [],
+      index_template: [],
+      transform: [],
+    },
+  },
+  policy_templates: [
+    {
+      name: 'okta',
+      title: 'Okta logs',
+      description: 'Collect logs from Okta',
+      inputs: [
+        {
+          type: 'httpjson',
+          vars: [
+            {
+              name: 'api_key',
+              type: 'text',
+              title: 'API Key',
+              multi: false,
+              required: false,
+              show_user: true,
+            },
+            {
+              name: 'http_client_timeout',
+              type: 'text',
+              title: 'HTTP Client Timeout',
+              multi: false,
+              required: false,
+              show_user: true,
+            },
+            {
+              name: 'interval',
+              type: 'text',
+              title: 'Interval',
+              multi: false,
+              required: true,
+              show_user: true,
+              default: '60s',
+            },
+            {
+              name: 'initial_interval',
+              type: 'text',
+              title: 'Initial Interval',
+              multi: false,
+              required: true,
+              show_user: true,
+              default: '24h',
+            },
+            {
+              name: 'ssl',
+              type: 'yaml',
+              title: 'SSL',
+              multi: false,
+              required: false,
+              show_user: true,
+            },
+            {
+              name: 'url',
+              type: 'text',
+              title: 'Okta System Log API Url',
+              multi: false,
+              required: false,
+              show_user: true,
+            },
+            {
+              name: 'proxy_url',
+              type: 'text',
+              title: 'Proxy URL',
+              description:
+                'URL to proxy connections in the form of http[s]://<user>:<password>@<server name/ip>:<port>',
+              multi: false,
+              required: false,
+              show_user: false,
+            },
+          ],
+          title: 'Collect Okta logs via API',
+          description: 'Collecting logs from Okta via API',
+        },
+      ],
+      multiple: true,
+    },
+  ],
+  data_streams: [
+    {
+      type: 'logs',
+      dataset: 'okta.system',
+      title: 'Okta system logs',
+      release: 'experimental',
+      ingest_pipeline: 'default',
+      streams: [
+        {
+          input: 'httpjson',
+          vars: [
+            {
+              name: 'tags',
+              type: 'text',
+              title: 'Tags',
+              multi: true,
+              required: true,
+              show_user: false,
+              default: ['forwarded', 'okta-system'],
+            },
+            {
+              name: 'preserve_original_event',
+              type: 'bool',
+              title: 'Preserve original event',
+              description:
+                'Preserves a raw copy of the original event, added to the field `event.original`',
+              multi: false,
+              required: true,
+              show_user: true,
+              default: false,
+            },
+            {
+              name: 'processors',
+              type: 'yaml',
+              title: 'Processors',
+              description:
+                'Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n',
+              multi: false,
+              required: false,
+              show_user: false,
+            },
+          ],
+          template_path: 'httpjson.yml.hbs',
+          title: 'Okta system logs',
+          description: 'Collect Okta system logs',
+          enabled: true,
+        },
+      ],
+      package: 'okta',
+      path: 'system',
+    },
+  ],
+  owner: {
+    github: 'elastic/security-external-integrations',
+  },
+  latestVersion: '1.2.0',
+  removable: true,
+  status: 'not_installed',
+};
diff --git a/x-pack/plugins/fleet/storybook/context/fixtures/readme.nginx.ts b/x-pack/plugins/fleet/storybook/context/fixtures/readme.nginx.ts
new file mode 100644
index 00000000000000..34f6bbffa0217e
--- /dev/null
+++ b/x-pack/plugins/fleet/storybook/context/fixtures/readme.nginx.ts
@@ -0,0 +1,515 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const readme = `# Nginx Integration
+
+This integration periodically fetches metrics from [Nginx](https://nginx.org/) servers. It can parse access and error
+logs created by the HTTP server.
+
+## Compatibility
+
+The Nginx \`stubstatus\` metrics was tested with Nginx 1.19.5 and are expected to work with all version >= 1.9.
+The logs were tested with version 1.19.5.
+On Windows, the module was tested with Nginx installed from the Chocolatey repository.
+
+## Logs
+
+**Timezone support**
+
+This datasource parses logs that don’t contain timezone information. For these logs, the Elastic Agent reads the local
+timezone and uses it when parsing to convert the timestamp to UTC. The timezone to be used for parsing is included
+in the event in the \`event.timezone\` field.
+
+To disable this conversion, the event.timezone field can be removed with the drop_fields processor.
+
+If logs are originated from systems or applications with a different timezone to the local one, the \`event.timezone\`
+field can be overwritten with the original timezone using the add_fields processor.
+
+### Access Logs
+
+Access logs collects the nginx access logs.
+
+An example event for \`access\` looks as following:
+
+\`\`\`json
+{
+    "agent": {
+        "hostname": "a73e7856c209",
+        "name": "a73e7856c209",
+        "id": "3987d2b3-b40a-4aa0-99fc-478f9d7079ea",
+        "ephemeral_id": "6d41da1c-5f71-4bd4-b326-a8913bfaa884",
+        "type": "filebeat",
+        "version": "7.11.0"
+    },
+    "nginx": {
+        "access": {
+            "remote_ip_list": [
+                "127.0.0.1"
+            ]
+        }
+    },
+    "log": {
+        "file": {
+            "path": "/tmp/service_logs/access.log"
+        },
+        "offset": 0
+    },
+    "elastic_agent": {
+        "id": "5ca3af72-37c3-48b6-92e8-176d154bb66f",
+        "version": "7.11.0",
+        "snapshot": true
+    },
+    "source": {
+        "address": "127.0.0.1",
+        "ip": "127.0.0.1"
+    },
+    "url": {
+        "original": "/server-status"
+    },
+    "input": {
+        "type": "log"
+    },
+    "@timestamp": "2020-12-03T11:41:57.000Z",
+    "ecs": {
+        "version": "1.6.0"
+    },
+    "related": {
+        "ip": [
+            "127.0.0.1"
+        ]
+    },
+    "data_stream": {
+        "namespace": "ep",
+        "type": "logs",
+        "dataset": "nginx.access"
+    },
+    "host": {
+        "hostname": "a73e7856c209",
+        "os": {
+            "kernel": "4.9.184-linuxkit",
+            "codename": "Core",
+            "name": "CentOS Linux",
+            "family": "redhat",
+            "version": "7 (Core)",
+            "platform": "centos"
+        },
+        "containerized": true,
+        "ip": [
+            "192.168.80.6"
+        ],
+        "name": "a73e7856c209",
+        "id": "06c26569966fd125c15acac5d7feffb6",
+        "mac": [
+            "02:42:c0:a8:50:06"
+        ],
+        "architecture": "x86_64"
+    },
+    "http": {
+        "request": {
+            "method": "get"
+        },
+        "response": {
+            "status_code": 200,
+            "body": {
+                "bytes": 97
+            }
+        },
+        "version": "1.1"
+    },
+    "event": {
+        "timezone": "+00:00",
+        "created": "2020-12-03T11:42:17.116Z",
+        "kind": "event",
+        "category": [
+            "web"
+        ],
+        "type": [
+            "access"
+        ],
+        "dataset": "nginx.access",
+        "outcome": "success"
+    },
+    "user_agent": {
+        "original": "curl/7.64.0",
+        "name": "curl",
+        "device": {
+            "name": "Other"
+        },
+        "version": "7.64.0"
+    }
+}
+\`\`\`
+
+**Exported fields**
+
+| Field                       | Description                                                                                                                                                                                                                                                                                                                                                 | Type             |
+| --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- |
+| @timestamp                  | Event timestamp.                                                                                                                                                                                                                                                                                                                                            | date             |
+| cloud.account.id            | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.                                                                                                                                                                          | keyword          |
+| cloud.availability_zone     | Availability zone in which this host is running.                                                                                                                                                                                                                                                                                                            | keyword          |
+| cloud.image.id              | Image ID for the cloud instance.                                                                                                                                                                                                                                                                                                                            | keyword          |
+| cloud.instance.id           | Instance ID of the host machine.                                                                                                                                                                                                                                                                                                                            | keyword          |
+| cloud.instance.name         | Instance name of the host machine.                                                                                                                                                                                                                                                                                                                          | keyword          |
+| cloud.machine.type          | Machine type of the host machine.                                                                                                                                                                                                                                                                                                                           | keyword          |
+| cloud.project.id            | Name of the project in Google Cloud.                                                                                                                                                                                                                                                                                                                        | keyword          |
+| cloud.provider              | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.                                                                                                                                                                                                                                                                            | keyword          |
+| cloud.region                | Region in which this host is running.                                                                                                                                                                                                                                                                                                                       | keyword          |
+| container.id                | Unique container id.                                                                                                                                                                                                                                                                                                                                        | keyword          |
+| container.image.name        | Name of the image the container was built on.                                                                                                                                                                                                                                                                                                               | keyword          |
+| container.labels            | Image labels.                                                                                                                                                                                                                                                                                                                                               | object           |
+| container.name              | Container name.                                                                                                                                                                                                                                                                                                                                             | keyword          |
+| data_stream.dataset         | Data stream dataset.                                                                                                                                                                                                                                                                                                                                        | constant_keyword |
+| data_stream.namespace       | Data stream namespace.                                                                                                                                                                                                                                                                                                                                      | constant_keyword |
+| data_stream.type            | Data stream type.                                                                                                                                                                                                                                                                                                                                           | constant_keyword |
+| destination.domain          | Destination domain.                                                                                                                                                                                                                                                                                                                                         | keyword          |
+| destination.ip              | IP address of the destination.                                                                                                                                                                                                                                                                                                                              | ip               |
+| destination.port            | Port of the destination.                                                                                                                                                                                                                                                                                                                                    | long             |
+| ecs.version                 | ECS version                                                                                                                                                                                                                                                                                                                                                 | keyword          |
+| event.created               | Date/time when the event was first read by an agent, or by your pipeline.                                                                                                                                                                                                                                                                                   | date             |
+| event.dataset               | Event dataset                                                                                                                                                                                                                                                                                                                                               | constant_keyword |
+| event.module                | Event module                                                                                                                                                                                                                                                                                                                                                | constant_keyword |
+| host.architecture           | Operating system architecture.                                                                                                                                                                                                                                                                                                                              | keyword          |
+| host.containerized          | If the host is a container.                                                                                                                                                                                                                                                                                                                                 | boolean          |
+| host.domain                 | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.                                                                                                                                          | keyword          |
+| host.hostname               | Hostname of the host. It normally contains what the \`hostname\` command returns on the host machine.                                                                                                                                                                                                                                                         | keyword          |
+| host.id                     | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of \`beat.name\`.                                                                                                                                                                                                            | keyword          |
+| host.ip                     | Host ip addresses.                                                                                                                                                                                                                                                                                                                                          | ip               |
+| host.mac                    | Host mac addresses.                                                                                                                                                                                                                                                                                                                                         | keyword          |
+| host.name                   | Name of the host. It can contain what \`hostname\` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.                                                                                                                                                                          | keyword          |
+| host.os.build               | OS build information.                                                                                                                                                                                                                                                                                                                                       | keyword          |
+| host.os.codename            | OS codename, if any.                                                                                                                                                                                                                                                                                                                                        | keyword          |
+| host.os.family              | OS family (such as redhat, debian, freebsd, windows).                                                                                                                                                                                                                                                                                                       | keyword          |
+| host.os.kernel              | Operating system kernel version as a raw string.                                                                                                                                                                                                                                                                                                            | keyword          |
+| host.os.name                | Operating system name, without the version.                                                                                                                                                                                                                                                                                                                 | keyword          |
+| host.os.platform            | Operating system platform (such centos, ubuntu, windows).                                                                                                                                                                                                                                                                                                   | keyword          |
+| host.os.version             | Operating system version as a raw string.                                                                                                                                                                                                                                                                                                                   | keyword          |
+| host.type                   | Type of host. For Cloud providers this can be the machine type like \`t2.medium\`. If vm, this could be the container, for example, or other information meaningful in your environment.                                                                                                                                                                      | keyword          |
+| http.request.method         | HTTP request method. The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".                                                                                                                                                                                                                        | keyword          |
+| http.request.referrer       | Referrer for this HTTP request.                                                                                                                                                                                                                                                                                                                             | keyword          |
+| http.response.body.bytes    | Size in bytes of the response body.                                                                                                                                                                                                                                                                                                                         | long             |
+| http.response.status_code   | HTTP response status code.                                                                                                                                                                                                                                                                                                                                  | long             |
+| http.version                | HTTP version.                                                                                                                                                                                                                                                                                                                                               | keyword          |
+| input.type                  | Input type                                                                                                                                                                                                                                                                                                                                                  | keyword          |
+| log.file.path               | Log path                                                                                                                                                                                                                                                                                                                                                    | keyword          |
+| log.offset                  | Log offset                                                                                                                                                                                                                                                                                                                                                  | long             |
+| nginx.access.remote_ip_list | An array of remote IP addresses. It is a list because it is common to include, besides the client IP address, IP addresses from headers like \`X-Forwarded-For\`. Real source IP is restored to \`source.ip\`.                                                                                                                                                  | array            |
+| related.ip                  | All of the IPs seen on your event.                                                                                                                                                                                                                                                                                                                          | ip               |
+| source.address              | An IP address, a domain, a unix socket                                                                                                                                                                                                                                                                                                                      | keyword          |
+| source.as.number            | Unique number allocated to the autonomous system.                                                                                                                                                                                                                                                                                                           | long             |
+| source.as.organization.name | Organization name.                                                                                                                                                                                                                                                                                                                                          | keyword          |
+| source.geo.city_name        | City name.                                                                                                                                                                                                                                                                                                                                                  | keyword          |
+| source.geo.continent_name   | Name of the continent.                                                                                                                                                                                                                                                                                                                                      | keyword          |
+| source.geo.country_iso_code | Country ISO code.                                                                                                                                                                                                                                                                                                                                           | keyword          |
+| source.geo.country_name     | Country name.                                                                                                                                                                                                                                                                                                                                               | keyword          |
+| source.geo.location         | Longitude and latitude.                                                                                                                                                                                                                                                                                                                                     | geo_point        |
+| source.geo.region_iso_code  | Region ISO code.                                                                                                                                                                                                                                                                                                                                            | keyword          |
+| source.geo.region_name      | Region name.                                                                                                                                                                                                                                                                                                                                                | keyword          |
+| source.ip                   | IP address of the source                                                                                                                                                                                                                                                                                                                                    | ip               |
+| tags                        | List of keywords used to tag each event.                                                                                                                                                                                                                                                                                                                    | keyword          |
+| url.domain                  | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the \`domain\` field. If the URL contains a literal IPv6 address enclosed by \`[\` and \`]\` (IETF RFC 2732), the \`[\` and \`]\` characters should also be captured in the \`domain\` field. | keyword          |
+| url.extension               | The field contains the file extension from the original request url. The file extension is only set if it exists, as not every url has a file extension. The leading period must not be included. For example, the value must be "png", not ".png".                                                                                                         | keyword          |
+| url.fragment                | Portion of the url after the \`#\`, such as "top". The \`#\` is not part of the fragment.                                                                                                                                                                                                                                                                       | keyword          |
+| url.original                | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not.                                                                                | keyword          |
+| url.path                    | Path of the request, such as "/search".                                                                                                                                                                                                                                                                                                                     | keyword          |
+| url.scheme                  | Scheme of the request, such as "https". Note: The \`:\` is not part of the scheme.                                                                                                                                                                                                                                                                            | keyword          |
+| user.name                   | Short name or login of the user.                                                                                                                                                                                                                                                                                                                            | keyword          |
+| user_agent.device.name      | Name of the device.                                                                                                                                                                                                                                                                                                                                         | keyword          |
+| user_agent.name             | Name of the user agent.                                                                                                                                                                                                                                                                                                                                     | keyword          |
+| user_agent.original         | Unparsed user_agent string.                                                                                                                                                                                                                                                                                                                                 | keyword          |
+| user_agent.os.full          | Operating system name, including the version or code name.                                                                                                                                                                                                                                                                                                  | keyword          |
+| user_agent.os.name          | Operating system name, without the version.                                                                                                                                                                                                                                                                                                                 | keyword          |
+| user_agent.os.version       | Operating system version as a raw string.                                                                                                                                                                                                                                                                                                                   | keyword          |
+| user_agent.version          | Version of the user agent.                                                                                                                                                                                                                                                                                                                                  | keyword          |
+
+
+### Error Logs
+
+Error logs collects the nginx error logs.
+
+An example event for \`error\` looks as following:
+
+\`\`\`json
+{
+    "agent": {
+        "hostname": "a73e7856c209",
+        "name": "a73e7856c209",
+        "id": "3987d2b3-b40a-4aa0-99fc-478f9d7079ea",
+        "ephemeral_id": "6d41da1c-5f71-4bd4-b326-a8913bfaa884",
+        "type": "filebeat",
+        "version": "7.11.0"
+    },
+    "process": {
+        "pid": 1,
+        "thread": {
+            "id": 1
+        }
+    },
+    "nginx": {
+        "error": {}
+    },
+    "log": {
+        "file": {
+            "path": "/tmp/service_logs/error.log"
+        },
+        "offset": 0,
+        "level": "warn"
+    },
+    "elastic_agent": {
+        "id": "5ca3af72-37c3-48b6-92e8-176d154bb66f",
+        "version": "7.11.0",
+        "snapshot": true
+    },
+    "message": "conflicting server name \"localhost\" on 0.0.0.0:80, ignored",
+    "input": {
+        "type": "log"
+    },
+    "@timestamp": "2020-12-03T11:44:39.000Z",
+    "ecs": {
+        "version": "1.6.0"
+    },
+    "data_stream": {
+        "namespace": "ep",
+        "type": "logs",
+        "dataset": "nginx.error"
+    },
+    "host": {
+        "hostname": "a73e7856c209",
+        "os": {
+            "kernel": "4.9.184-linuxkit",
+            "codename": "Core",
+            "name": "CentOS Linux",
+            "family": "redhat",
+            "version": "7 (Core)",
+            "platform": "centos"
+        },
+        "containerized": true,
+        "ip": [
+            "192.168.80.6"
+        ],
+        "name": "a73e7856c209",
+        "id": "06c26569966fd125c15acac5d7feffb6",
+        "mac": [
+            "02:42:c0:a8:50:06"
+        ],
+        "architecture": "x86_64"
+    },
+    "event": {
+        "timezone": "+00:00",
+        "created": "2020-12-03T11:44:52.803Z",
+        "kind": "event",
+        "category": [
+            "web"
+        ],
+        "type": [
+            "error"
+        ],
+        "dataset": "nginx.error"
+    }
+}
+\`\`\`
+
+**Exported fields**
+
+| Field                     | Description                                                                                                                                                                                                                                                                                                             | Type             |
+| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- |
+| @timestamp                | Event timestamp.                                                                                                                                                                                                                                                                                                        | date             |
+| cloud.account.id          | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.                                                                                                                                      | keyword          |
+| cloud.availability_zone   | Availability zone in which this host is running.                                                                                                                                                                                                                                                                        | keyword          |
+| cloud.image.id            | Image ID for the cloud instance.                                                                                                                                                                                                                                                                                        | keyword          |
+| cloud.instance.id         | Instance ID of the host machine.                                                                                                                                                                                                                                                                                        | keyword          |
+| cloud.instance.name       | Instance name of the host machine.                                                                                                                                                                                                                                                                                      | keyword          |
+| cloud.machine.type        | Machine type of the host machine.                                                                                                                                                                                                                                                                                       | keyword          |
+| cloud.project.id          | Name of the project in Google Cloud.                                                                                                                                                                                                                                                                                    | keyword          |
+| cloud.provider            | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.                                                                                                                                                                                                                                        | keyword          |
+| cloud.region              | Region in which this host is running.                                                                                                                                                                                                                                                                                   | keyword          |
+| container.id              | Unique container id.                                                                                                                                                                                                                                                                                                    | keyword          |
+| container.image.name      | Name of the image the container was built on.                                                                                                                                                                                                                                                                           | keyword          |
+| container.labels          | Image labels.                                                                                                                                                                                                                                                                                                           | object           |
+| container.name            | Container name.                                                                                                                                                                                                                                                                                                         | keyword          |
+| data_stream.dataset       | Data stream dataset.                                                                                                                                                                                                                                                                                                    | constant_keyword |
+| data_stream.namespace     | Data stream namespace.                                                                                                                                                                                                                                                                                                  | constant_keyword |
+| data_stream.type          | Data stream type.                                                                                                                                                                                                                                                                                                       | constant_keyword |
+| ecs.version               | ECS version                                                                                                                                                                                                                                                                                                             | keyword          |
+| event.created             | Date/time when the event was first read by an agent, or by your pipeline.                                                                                                                                                                                                                                               | date             |
+| event.dataset             | Event dataset                                                                                                                                                                                                                                                                                                           | constant_keyword |
+| event.module              | Event module                                                                                                                                                                                                                                                                                                            | constant_keyword |
+| host.architecture         | Operating system architecture.                                                                                                                                                                                                                                                                                          | keyword          |
+| host.containerized        | If the host is a container.                                                                                                                                                                                                                                                                                             | boolean          |
+| host.domain               | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.                                                                                                      | keyword          |
+| host.hostname             | Hostname of the host. It normally contains what the \`hostname\` command returns on the host machine.                                                                                                                                                                                                                     | keyword          |
+| host.id                   | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of \`beat.name\`.                                                                                                                                                                        | keyword          |
+| host.ip                   | Host ip addresses.                                                                                                                                                                                                                                                                                                      | ip               |
+| host.mac                  | Host mac addresses.                                                                                                                                                                                                                                                                                                     | keyword          |
+| host.name                 | Name of the host. It can contain what \`hostname\` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.                                                                                                                                      | keyword          |
+| host.os.build             | OS build information.                                                                                                                                                                                                                                                                                                   | keyword          |
+| host.os.codename          | OS codename, if any.                                                                                                                                                                                                                                                                                                    | keyword          |
+| host.os.family            | OS family (such as redhat, debian, freebsd, windows).                                                                                                                                                                                                                                                                   | keyword          |
+| host.os.kernel            | Operating system kernel version as a raw string.                                                                                                                                                                                                                                                                        | keyword          |
+| host.os.name              | Operating system name, without the version.                                                                                                                                                                                                                                                                             | keyword          |
+| host.os.platform          | Operating system platform (such centos, ubuntu, windows).                                                                                                                                                                                                                                                               | keyword          |
+| host.os.version           | Operating system version as a raw string.                                                                                                                                                                                                                                                                               | keyword          |
+| host.type                 | Type of host. For Cloud providers this can be the machine type like \`t2.medium\`. If vm, this could be the container, for example, or other information meaningful in your environment.                                                                                                                                  | keyword          |
+| input.type                | Input type                                                                                                                                                                                                                                                                                                              | keyword          |
+| log.file.path             | Log path                                                                                                                                                                                                                                                                                                                | keyword          |
+| log.level                 | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in \`log.level\`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are \`warn\`, \`err\`, \`i\`, \`informational\`. | keyword          |
+| log.offset                | Log offset                                                                                                                                                                                                                                                                                                              | long             |
+| message                   | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message.             | text             |
+| nginx.error.connection_id | Connection identifier.                                                                                                                                                                                                                                                                                                  | long             |
+| process.pid               | Process id.                                                                                                                                                                                                                                                                                                             | long             |
+| process.thread.id         | Thread ID.                                                                                                                                                                                                                                                                                                              | long             |
+| tags                      | List of keywords used to tag each event.                                                                                                                                                                                                                                                                                | keyword          |
+
+
+## Metrics
+
+### Stub Status Metrics
+
+The Nginx \`stubstatus\` stream collects data from the Nginx \`ngx_http_stub_status\` module. It scrapes the server status
+data from the web page generated by \`ngx_http_stub_status\`. Please verify that your Nginx distribution comes with the mentioned
+module and it's enabled in the Nginx configuration file:
+
+\`\`\`
+location /nginx_status {
+    stub_status;
+    allow 127.0.0.1; # only allow requests from localhost
+    deny all;        # deny all other hosts
+}
+\`\`\`
+
+It's highly recommended to replace \`127.0.0.1\` with your server’s IP address and make sure that this page accessible to only you.
+
+An example event for \`stubstatus\` looks as following:
+
+\`\`\`json
+{
+    "@timestamp": "2020-12-03T11:47:31.996Z",
+    "host": {
+        "hostname": "a73e7856c209",
+        "architecture": "x86_64",
+        "os": {
+            "codename": "Core",
+            "platform": "centos",
+            "version": "7 (Core)",
+            "family": "redhat",
+            "name": "CentOS Linux",
+            "kernel": "4.9.184-linuxkit"
+        },
+        "name": "a73e7856c209",
+        "id": "06c26569966fd125c15acac5d7feffb6",
+        "containerized": true,
+        "ip": [
+            "192.168.80.6"
+        ],
+        "mac": [
+            "02:42:c0:a8:50:06"
+        ]
+    },
+    "service": {
+        "type": "nginx",
+        "address": "http://elastic-package-service_nginx_1:80/server-status"
+    },
+    "nginx": {
+        "stubstatus": {
+            "requests": 13,
+            "waiting": 0,
+            "hostname": "elastic-package-service_nginx_1:80",
+            "accepts": 13,
+            "handled": 13,
+            "current": 13,
+            "dropped": 0,
+            "writing": 1,
+            "active": 1,
+            "reading": 0
+        }
+    },
+    "elastic_agent": {
+        "snapshot": true,
+        "version": "7.11.0",
+        "id": "5ca3af72-37c3-48b6-92e8-176d154bb66f"
+    },
+    "ecs": {
+        "version": "1.6.0"
+    },
+    "event": {
+        "dataset": "nginx.stubstatus",
+        "module": "nginx",
+        "duration": 2231100
+    },
+    "metricset": {
+        "period": 10000,
+        "name": "stubstatus"
+    },
+    "data_stream": {
+        "type": "metrics",
+        "dataset": "nginx.stubstatus",
+        "namespace": "ep"
+    },
+    "agent": {
+        "type": "metricbeat",
+        "version": "7.11.0",
+        "hostname": "a73e7856c209",
+        "ephemeral_id": "1fbb4215-4ba3-42fa-9984-244b112c9a17",
+        "id": "2689a72c-6e18-45fe-b493-af1ec86af2b3",
+        "name": "a73e7856c209"
+    }
+}
+\`\`\`
+
+**Exported fields**
+
+| Field                     | Description                                                                                                                                                                                                        | Type             |
+| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------- |
+| @timestamp                | Event timestamp.                                                                                                                                                                                                   | date             |
+| cloud.account.id          | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.                                 | keyword          |
+| cloud.availability_zone   | Availability zone in which this host is running.                                                                                                                                                                   | keyword          |
+| cloud.image.id            | Image ID for the cloud instance.                                                                                                                                                                                   | keyword          |
+| cloud.instance.id         | Instance ID of the host machine.                                                                                                                                                                                   | keyword          |
+| cloud.instance.name       | Instance name of the host machine.                                                                                                                                                                                 | keyword          |
+| cloud.machine.type        | Machine type of the host machine.                                                                                                                                                                                  | keyword          |
+| cloud.project.id          | Name of the project in Google Cloud.                                                                                                                                                                               | keyword          |
+| cloud.provider            | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.                                                                                                                                   | keyword          |
+| cloud.region              | Region in which this host is running.                                                                                                                                                                              | keyword          |
+| container.id              | Unique container id.                                                                                                                                                                                               | keyword          |
+| container.image.name      | Name of the image the container was built on.                                                                                                                                                                      | keyword          |
+| container.labels          | Image labels.                                                                                                                                                                                                      | object           |
+| container.name            | Container name.                                                                                                                                                                                                    | keyword          |
+| data_stream.dataset       | Data stream dataset.                                                                                                                                                                                               | constant_keyword |
+| data_stream.namespace     | Data stream namespace.                                                                                                                                                                                             | constant_keyword |
+| data_stream.type          | Data stream type.                                                                                                                                                                                                  | constant_keyword |
+| ecs.version               | ECS version                                                                                                                                                                                                        | keyword          |
+| event.dataset             | Event dataset                                                                                                                                                                                                      | constant_keyword |
+| event.module              | Event module                                                                                                                                                                                                       | constant_keyword |
+| host.architecture         | Operating system architecture.                                                                                                                                                                                     | keyword          |
+| host.containerized        | If the host is a container.                                                                                                                                                                                        | boolean          |
+| host.domain               | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword          |
+| host.hostname             | Hostname of the host. It normally contains what the \`hostname\` command returns on the host machine.                                                                                                                | keyword          |
+| host.id                   | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of \`beat.name\`.                                                                   | keyword          |
+| host.ip                   | Host ip addresses.                                                                                                                                                                                                 | ip               |
+| host.mac                  | Host mac addresses.                                                                                                                                                                                                | keyword          |
+| host.name                 | Name of the host. It can contain what \`hostname\` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.                                 | keyword          |
+| host.os.build             | OS build information.                                                                                                                                                                                              | keyword          |
+| host.os.codename          | OS codename, if any.                                                                                                                                                                                               | keyword          |
+| host.os.family            | OS family (such as redhat, debian, freebsd, windows).                                                                                                                                                              | keyword          |
+| host.os.kernel            | Operating system kernel version as a raw string.                                                                                                                                                                   | keyword          |
+| host.os.name              | Operating system name, without the version.                                                                                                                                                                        | keyword          |
+| host.os.platform          | Operating system platform (such centos, ubuntu, windows).                                                                                                                                                          | keyword          |
+| host.os.version           | Operating system version as a raw string.                                                                                                                                                                          | keyword          |
+| host.type                 | Type of host. For Cloud providers this can be the machine type like \`t2.medium\`. If vm, this could be the container, for example, or other information meaningful in your environment.                             | keyword          |
+| nginx.stubstatus.accepts  | The total number of accepted client connections.                                                                                                                                                                   | long             |
+| nginx.stubstatus.active   | The current number of active client connections including Waiting connections.                                                                                                                                     | long             |
+| nginx.stubstatus.current  | The current number of client requests.                                                                                                                                                                             | long             |
+| nginx.stubstatus.dropped  | The total number of dropped client connections.                                                                                                                                                                    | long             |
+| nginx.stubstatus.handled  | The total number of handled client connections.                                                                                                                                                                    | long             |
+| nginx.stubstatus.hostname | Nginx hostname.                                                                                                                                                                                                    | keyword          |
+| nginx.stubstatus.reading  | The current number of connections where Nginx is reading the request header.                                                                                                                                       | long             |
+| nginx.stubstatus.requests | The total number of client requests.                                                                                                                                                                               | long             |
+| nginx.stubstatus.waiting  | The current number of idle client connections waiting for a request.                                                                                                                                               | long             |
+| nginx.stubstatus.writing  | The current number of connections where Nginx is writing the response back to the client.                                                                                                                          | long             |
+| service.address           | Service address                                                                                                                                                                                                    | keyword          |
+| service.type              | Service type                                                                                                                                                                                                       | keyword          |
+
+`;
diff --git a/x-pack/plugins/fleet/storybook/context/fixtures/readme.okta.ts b/x-pack/plugins/fleet/storybook/context/fixtures/readme.okta.ts
new file mode 100644
index 00000000000000..cdb9b708425a65
--- /dev/null
+++ b/x-pack/plugins/fleet/storybook/context/fixtures/readme.okta.ts
@@ -0,0 +1,343 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const readme = `# Okta Integration
+
+The Okta integration collects events from the Okta API, specifically reading from the Okta System Log API.
+
+## Logs
+
+### System
+
+The Okta System Log records system events related to your organization in order to provide an audit trail that can be used to understand platform activity and to diagnose problems. This module is implemented using the httpjson input and is configured to paginate through the logs while honoring any rate-limiting headers sent by Okta.
+
+An example event for \`system\` looks as following:
+
+\`\`\`json
+{
+    "@timestamp": "2020-02-14T20:18:57.718Z",
+    "agent": {
+        "ephemeral_id": "c8d18964-83d3-4be1-809c-201de8688e6b",
+        "hostname": "docker-fleet-agent",
+        "id": "62554406-4558-40ed-9cd2-c68d978882ff",
+        "name": "docker-fleet-agent",
+        "type": "filebeat",
+        "version": "7.13.0"
+    },
+    "client": {
+        "geo": {
+            "city_name": "Dublin",
+            "country_name": "United States",
+            "location": {
+                "lat": 37.7201,
+                "lon": -121.919
+            },
+            "region_name": "California"
+        },
+        "ip": "108.255.197.247",
+        "user": {
+            "full_name": "xxxxxx",
+            "id": "00u1abvz4pYqdM8ms4x6"
+        }
+    },
+    "data_stream": {
+        "dataset": "okta.system",
+        "namespace": "ep",
+        "type": "logs"
+    },
+    "ecs": {
+        "version": "1.9.0"
+    },
+    "elastic_agent": {
+        "id": "52c5ef7a-f604-488a-b39c-4ab431eb930e",
+        "snapshot": true,
+        "version": "7.13.0"
+    },
+    "event": {
+        "action": "user.session.start",
+        "category": [
+            "authentication",
+            "session"
+        ],
+        "created": "2021-05-31T10:31:04.833Z",
+        "dataset": "okta.system",
+        "id": "3aeede38-4f67-11ea-abd3-1f5d113f2546",
+        "ingested": "2021-05-31T10:31:05.861084700Z",
+        "kind": "event",
+        "original": "{\"actor\":{\"alternateId\":\"xxxxxx@elastic.co\",\"detailEntry\":null,\"displayName\":\"xxxxxx\",\"id\":\"00u1abvz4pYqdM8ms4x6\",\"type\":\"User\"},\"authenticationContext\":{\"authenticationProvider\":null,\"authenticationStep\":0,\"credentialProvider\":null,\"credentialType\":null,\"externalSessionId\":\"102bZDNFfWaQSyEZQuDgWt-uQ\",\"interface\":null,\"issuer\":null},\"client\":{\"device\":\"Computer\",\"geographicalContext\":{\"city\":\"Dublin\",\"country\":\"United States\",\"geolocation\":{\"lat\":37.7201,\"lon\":-121.919},\"postalCode\":\"94568\",\"state\":\"California\"},\"id\":null,\"ipAddress\":\"108.255.197.247\",\"userAgent\":{\"browser\":\"FIREFOX\",\"os\":\"Mac OS X\",\"rawUserAgent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0\"},\"zone\":\"null\"},\"debugContext\":{\"debugData\":{\"deviceFingerprint\":\"541daf91d15bef64a7e08c946fd9a9d0\",\"requestId\":\"XkcAsWb8WjwDP76xh@1v8wAABp0\",\"requestUri\":\"/api/v1/authn\",\"threatSuspected\":\"false\",\"url\":\"/api/v1/authn?\"}},\"displayMessage\":\"User login to Okta\",\"eventType\":\"user.session.start\",\"legacyEventType\":\"core.user_auth.login_success\",\"outcome\":{\"reason\":null,\"result\":\"SUCCESS\"},\"published\":\"2020-02-14T20:18:57.718Z\",\"request\":{\"ipChain\":[{\"geographicalContext\":{\"city\":\"Dublin\",\"country\":\"United States\",\"geolocation\":{\"lat\":37.7201,\"lon\":-121.919},\"postalCode\":\"94568\",\"state\":\"California\"},\"ip\":\"108.255.197.247\",\"source\":null,\"version\":\"V4\"}]},\"securityContext\":{\"asNumber\":null,\"asOrg\":null,\"domain\":null,\"isProxy\":null,\"isp\":null},\"severity\":\"INFO\",\"target\":null,\"transaction\":{\"detail\":{},\"id\":\"XkcAsWb8WjwDP76xh@1v8wAABp0\",\"type\":\"WEB\"},\"uuid\":\"3aeede38-4f67-11ea-abd3-1f5d113f2546\",\"version\":\"0\"}",
+        "outcome": "success",
+        "type": [
+            "start",
+            "user"
+        ]
+    },
+    "host": {
+        "name": "docker-fleet-agent"
+    },
+    "input": {
+        "type": "httpjson"
+    },
+    "okta": {
+        "actor": {
+            "alternate_id": "xxxxxx@elastic.co",
+            "display_name": "xxxxxx",
+            "id": "00u1abvz4pYqdM8ms4x6",
+            "type": "User"
+        },
+        "authentication_context": {
+            "authentication_step": 0,
+            "external_session_id": "102bZDNFfWaQSyEZQuDgWt-uQ"
+        },
+        "client": {
+            "device": "Computer",
+            "ip": "108.255.197.247",
+            "user_agent": {
+                "browser": "FIREFOX",
+                "os": "Mac OS X",
+                "raw_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
+            },
+            "zone": "null"
+        },
+        "debug_context": {
+            "debug_data": {
+                "device_fingerprint": "541daf91d15bef64a7e08c946fd9a9d0",
+                "request_id": "XkcAsWb8WjwDP76xh@1v8wAABp0",
+                "request_uri": "/api/v1/authn",
+                "threat_suspected": "false",
+                "url": "/api/v1/authn?"
+            }
+        },
+        "display_message": "User login to Okta",
+        "event_type": "user.session.start",
+        "outcome": {
+            "result": "SUCCESS"
+        },
+        "transaction": {
+            "id": "XkcAsWb8WjwDP76xh@1v8wAABp0",
+            "type": "WEB"
+        },
+        "uuid": "3aeede38-4f67-11ea-abd3-1f5d113f2546"
+    },
+    "related": {
+        "ip": [
+            "108.255.197.247"
+        ],
+        "user": [
+            "xxxxxx"
+        ]
+    },
+    "source": {
+        "as": {
+            "number": 7018,
+            "organization": {
+                "name": "AT\u0026T Services, Inc."
+            }
+        },
+        "geo": {
+            "city_name": "Dublin",
+            "continent_name": "North America",
+            "country_iso_code": "US",
+            "country_name": "United States",
+            "location": {
+                "lat": 37.7201,
+                "lon": -121.919
+            },
+            "region_iso_code": "US-CA",
+            "region_name": "California"
+        },
+        "ip": "108.255.197.247",
+        "user": {
+            "full_name": "xxxxxx",
+            "id": "00u1abvz4pYqdM8ms4x6"
+        }
+    },
+    "tags": [
+        "forwarded",
+        "preserve_original_event"
+    ],
+    "user": {
+        "full_name": "xxxxxx"
+    },
+    "user_agent": {
+        "device": {
+            "name": "Mac"
+        },
+        "name": "Firefox",
+        "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0",
+        "os": {
+            "full": "Mac OS X 10.15",
+            "name": "Mac OS X",
+            "version": "10.15"
+        },
+        "version": "72.0."
+    }
+}
+\`\`\`
+
+**Exported fields**
+
+| Field                                                  | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | Type             |
+| ------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- |
+| @timestamp                                             | Event timestamp.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | date             |
+| client.as.number                                       | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | long             |
+| client.as.organization.name                            | Organization name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | keyword          |
+| client.domain                                          | Client domain.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | keyword          |
+| client.geo.city_name                                   | City name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | keyword          |
+| client.geo.country_name                                | Country name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | keyword          |
+| client.geo.location                                    | Longitude and latitude.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | geo_point        |
+| client.geo.region_name                                 | Region name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | keyword          |
+| client.ip                                              | IP address of the client (IPv4 or IPv6).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | ip               |
+| client.user.full_name                                  | User's full name, if available.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | keyword          |
+| client.user.id                                         | Unique identifier of the user.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | keyword          |
+| cloud.account.id                                       | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | keyword          |
+| cloud.availability_zone                                | Availability zone in which this host is running.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | keyword          |
+| cloud.image.id                                         | Image ID for the cloud instance.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | keyword          |
+| cloud.instance.id                                      | Instance ID of the host machine.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | keyword          |
+| cloud.instance.name                                    | Instance name of the host machine.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | keyword          |
+| cloud.machine.type                                     | Machine type of the host machine.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | keyword          |
+| cloud.project.id                                       | Name of the project in Google Cloud.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | keyword          |
+| cloud.provider                                         | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | keyword          |
+| cloud.region                                           | Region in which this host is running.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | keyword          |
+| container.id                                           | Unique container id.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | keyword          |
+| container.image.name                                   | Name of the image the container was built on.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | keyword          |
+| container.labels                                       | Image labels.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | object           |
+| container.name                                         | Container name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | keyword          |
+| data_stream.dataset                                    | Data stream dataset name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | constant_keyword |
+| data_stream.namespace                                  | Data stream namespace.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | constant_keyword |
+| data_stream.type                                       | Data stream type.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | constant_keyword |
+| destination.as.number                                  | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | long             |
+| destination.as.organization.name                       | Organization name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | keyword          |
+| destination.geo.city_name                              | City name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | keyword          |
+| destination.geo.continent_name                         | Name of the continent.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | keyword          |
+| destination.geo.country_iso_code                       | Country ISO code.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | keyword          |
+| destination.geo.country_name                           | Country name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | keyword          |
+| destination.geo.location                               | Longitude and latitude.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | geo_point        |
+| destination.geo.name                                   | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | keyword          |
+| destination.geo.region_iso_code                        | Region ISO code.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | keyword          |
+| destination.geo.region_name                            | Region name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | keyword          |
+| destination.ip                                         | IP address of the destination (IPv4 or IPv6).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | ip               |
+| ecs.version                                            | ECS version this event conforms to. \`ecs.version\` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | keyword          |
+| error.message                                          | Error message.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | match_only_text  |
+| event.action                                           | The action captured by the event. This describes the information in the event. It is more specific than \`event.category\`. Examples are \`group-add\`, \`process-started\`, \`file-created\`. The value is normally defined by the implementer.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | keyword          |
+| event.category                                         | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. \`event.category\` represents the "big buckets" of ECS categories. For example, filtering on \`event.category:process\` yields all events relating to process activity. This field is closely related to \`event.type\`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories.                                                                                                                                                                                                                                                                                                                                                                                                                                          | keyword          |
+| event.dataset                                          | Event dataset                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | constant_keyword |
+| event.id                                               | Unique ID to describe the event.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | keyword          |
+| event.ingested                                         | Timestamp when an event arrived in the central data store. This is different from \`@timestamp\`, which is when the event originally occurred.  It's also different from \`event.created\`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: \`@timestamp\` \< \`event.created\` \< \`event.ingested\`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | date             |
+| event.kind                                             | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. \`event.kind\` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not.                                                                                                                                                                                                                                                                                                                          | keyword          |
+| event.module                                           | Event module                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | constant_keyword |
+| event.original                                         | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from \`_source\`. If users wish to override this and index this field, please see \`Field data types\` in the \`Elasticsearch Reference\`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | keyword          |
+| event.outcome                                          | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. \`event.outcome\` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of \`event.outcome\`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with \`event.type:info\`, or any events for which an outcome does not make logical sense. | keyword          |
+| event.type                                             | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. \`event.type\` represents a categorization "sub-bucket" that, when used along with the \`event.category\` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | keyword          |
+| host.architecture                                      | Operating system architecture.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | keyword          |
+| host.containerized                                     | If the host is a container.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | boolean          |
+| host.domain                                            | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | keyword          |
+| host.hostname                                          | Hostname of the host. It normally contains what the \`hostname\` command returns on the host machine.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | keyword          |
+| host.id                                                | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of \`beat.name\`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | keyword          |
+| host.ip                                                | Host ip addresses.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | ip               |
+| host.mac                                               | Host mac addresses.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | keyword          |
+| host.name                                              | Name of the host. It can contain what \`hostname\` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | keyword          |
+| host.os.build                                          | OS build information.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | keyword          |
+| host.os.codename                                       | OS codename, if any.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | keyword          |
+| host.os.family                                         | OS family (such as redhat, debian, freebsd, windows).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | keyword          |
+| host.os.kernel                                         | Operating system kernel version as a raw string.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | keyword          |
+| host.os.name                                           | Operating system name, without the version.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | keyword          |
+| host.os.platform                                       | Operating system platform (such centos, ubuntu, windows).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | keyword          |
+| host.os.version                                        | Operating system version as a raw string.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | keyword          |
+| host.type                                              | Type of host. For Cloud providers this can be the machine type like \`t2.medium\`. If vm, this could be the container, for example, or other information meaningful in your environment.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | keyword          |
+| input.type                                             | Type of Filebeat input.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | keyword          |
+| log.file.path                                          | Path to the log file.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | keyword          |
+| log.flags                                              | Flags for the log file.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | keyword          |
+| log.offset                                             | Offset of the entry in the log file.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | long             |
+| message                                                | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | match_only_text  |
+| okta.actor.alternate_id                                | Alternate identifier of the actor.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | keyword          |
+| okta.actor.display_name                                | Display name of the actor.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | keyword          |
+| okta.actor.id                                          | Identifier of the actor.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | keyword          |
+| okta.actor.type                                        | Type of the actor.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | keyword          |
+| okta.authentication_context.authentication_provider    | The information about the authentication provider. Must be one of OKTA_AUTHENTICATION_PROVIDER, ACTIVE_DIRECTORY, LDAP, FEDERATION, SOCIAL, FACTOR_PROVIDER.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | keyword          |
+| okta.authentication_context.authentication_step        | The authentication step.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | integer          |
+| okta.authentication_context.credential_provider        | The information about credential provider. Must be one of OKTA_CREDENTIAL_PROVIDER, RSA, SYMANTEC, GOOGLE, DUO, YUBIKEY.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | keyword          |
+| okta.authentication_context.credential_type            | The information about credential type. Must be one of OTP, SMS, PASSWORD, ASSERTION, IWA, EMAIL, OAUTH2, JWT, CERTIFICATE, PRE_SHARED_SYMMETRIC_KEY, OKTA_CLIENT_SESSION, DEVICE_UDID.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | keyword          |
+| okta.authentication_context.external_session_id        | The session identifer of the external session if any.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | keyword          |
+| okta.authentication_context.interface                  | The interface used. e.g., Outlook, Office365, wsTrust                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | keyword          |
+| okta.authentication_context.issuer.id                  | The identifier of the issuer.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | keyword          |
+| okta.authentication_context.issuer.type                | The type of the issuer.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | keyword          |
+| okta.client.device                                     | The information of the client device.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | keyword          |
+| okta.client.id                                         | The identifier of the client.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | keyword          |
+| okta.client.ip                                         | The IP address of the client.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | ip               |
+| okta.client.user_agent.browser                         | The browser informaton of the client.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | keyword          |
+| okta.client.user_agent.os                              | The OS informaton.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | keyword          |
+| okta.client.user_agent.raw_user_agent                  | The raw informaton of the user agent.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | keyword          |
+| okta.client.zone                                       | The zone information of the client.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | keyword          |
+| okta.debug_context.debug_data.device_fingerprint       | The fingerprint of the device.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | keyword          |
+| okta.debug_context.debug_data.request_id               | The identifier of the request.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | keyword          |
+| okta.debug_context.debug_data.request_uri              | The request URI.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | keyword          |
+| okta.debug_context.debug_data.threat_suspected         | Threat suspected.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | keyword          |
+| okta.debug_context.debug_data.url                      | The URL.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | keyword          |
+| okta.display_message                                   | The display message of the LogEvent.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | keyword          |
+| okta.event_type                                        | The type of the LogEvent.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | keyword          |
+| okta.outcome.reason                                    | The reason of the outcome.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | keyword          |
+| okta.outcome.result                                    | The result of the outcome. Must be one of: SUCCESS, FAILURE, SKIPPED, ALLOW, DENY, CHALLENGE, UNKNOWN.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | keyword          |
+| okta.request.ip_chain.geographical_context.city        | The city.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | keyword          |
+| okta.request.ip_chain.geographical_context.country     | The country.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | keyword          |
+| okta.request.ip_chain.geographical_context.geolocation | Geolocation information.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | geo_point        |
+| okta.request.ip_chain.geographical_context.postal_code | The postal code.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | keyword          |
+| okta.request.ip_chain.geographical_context.state       | The state.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | keyword          |
+| okta.request.ip_chain.ip                               | IP address.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | ip               |
+| okta.request.ip_chain.source                           | Source information.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | keyword          |
+| okta.request.ip_chain.version                          | IP version. Must be one of V4, V6.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | keyword          |
+| okta.security_context.as.number                        | The AS number.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | integer          |
+| okta.security_context.as.organization.name             | The organization name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | keyword          |
+| okta.security_context.domain                           | The domain name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | keyword          |
+| okta.security_context.is_proxy                         | Whether it is a proxy or not.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | boolean          |
+| okta.security_context.isp                              | The Internet Service Provider.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | keyword          |
+| okta.severity                                          | The severity of the LogEvent. Must be one of DEBUG, INFO, WARN, or ERROR.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | keyword          |
+| okta.target.alternate_id                               | Alternate identifier of the actor.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | keyword          |
+| okta.target.display_name                               | Display name of the actor.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | keyword          |
+| okta.target.id                                         | Identifier of the actor.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | keyword          |
+| okta.target.type                                       | Type of the actor.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | keyword          |
+| okta.transaction.id                                    | Identifier of the transaction.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | keyword          |
+| okta.transaction.type                                  | The type of transaction. Must be one of "WEB", "JOB".                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | keyword          |
+| okta.uuid                                              | The unique identifier of the Okta LogEvent.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | keyword          |
+| okta.version                                           | The version of the LogEvent.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | keyword          |
+| related.ip                                             | All of the IPs seen on your event.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | ip               |
+| related.user                                           | All the user names or other user identifiers seen on the event.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | keyword          |
+| source.as.number                                       | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | long             |
+| source.as.organization.name                            | Organization name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | keyword          |
+| source.domain                                          | Source domain.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | keyword          |
+| source.geo.city_name                                   | City name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | keyword          |
+| source.geo.continent_name                              | Name of the continent.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | keyword          |
+| source.geo.country_iso_code                            | Country ISO code.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | keyword          |
+| source.geo.country_name                                | Country name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | keyword          |
+| source.geo.location                                    | Longitude and latitude.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | geo_point        |
+| source.geo.name                                        | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | keyword          |
+| source.geo.region_iso_code                             | Region ISO code.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | keyword          |
+| source.geo.region_name                                 | Region name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | keyword          |
+| source.ip                                              | IP address of the source (IPv4 or IPv6).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | ip               |
+| source.user.full_name                                  | User's full name, if available.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | keyword          |
+| source.user.id                                         | Unique identifier of the user.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | keyword          |
+| tags                                                   | List of keywords used to tag each event.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | keyword          |
+| user.domain                                            | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | keyword          |
+| user.email                                             | User email address.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | keyword          |
+| user.full_name                                         | User's full name, if available.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | keyword          |
+| user.id                                                | Unique identifier of the user.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | keyword          |
+| user.name                                              | Short name or login of the user.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | keyword          |
+| user.target.domain                                     | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | keyword          |
+| user.target.email                                      | User email address.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | keyword          |
+| user.target.full_name                                  | User's full name, if available.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | keyword          |
+| user.target.group.domain                               | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | keyword          |
+| user.target.group.id                                   | Unique identifier for the group on the system/platform.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | keyword          |
+| user.target.group.name                                 | Name of the group.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | keyword          |
+| user.target.id                                         | Unique identifier of the user.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | keyword          |
+| user.target.name                                       | Short name or login of the user.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | keyword          |
+| user_agent.device.name                                 | Name of the device.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | keyword          |
+| user_agent.name                                        | Name of the user agent.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | keyword          |
+| user_agent.original                                    | Unparsed user_agent string.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | keyword          |
+| user_agent.os.full                                     | Operating system name, including the version or code name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | keyword          |
+| user_agent.os.name                                     | Operating system name, without the version.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | keyword          |
+| user_agent.os.version                                  | Operating system version as a raw string.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | keyword          |
+| user_agent.version                                     | Version of the user agent.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | keyword          |
+`;
diff --git a/x-pack/plugins/fleet/storybook/context/http.ts b/x-pack/plugins/fleet/storybook/context/http.ts
index 3f2f46c8331beb..c52429c243ba92 100644
--- a/x-pack/plugins/fleet/storybook/context/http.ts
+++ b/x-pack/plugins/fleet/storybook/context/http.ts
@@ -27,6 +27,8 @@ export const getHttp = (basepath = BASE_PATH) => {
       serverBasePath: basepath,
     },
     get: (async (path: string, options: HttpFetchOptions) => {
+      // TODO: all of this needs revision, as it's far too clunky... but it works for now,
+      // with the few paths we're supporting.
       if (path === '/api/fleet/agents/setup') {
         if (!isReady) {
           isReady = true;
@@ -50,6 +52,28 @@ export const getHttp = (basepath = BASE_PATH) => {
         return await import('./fixtures/packages');
       }
 
+      // Ideally, this would be a markdown file instead of a ts file, but we don't have
+      // markdown-loader in our package.json, so we'll make do with what we have.
+      if (path.startsWith('/api/fleet/epm/packages/nginx/')) {
+        const { readme } = await import('./fixtures/readme.nginx');
+        return readme;
+      }
+
+      if (path.startsWith('/api/fleet/epm/packages/nginx')) {
+        return await import('./fixtures/integration.nginx');
+      }
+
+      // Ideally, this would be a markdown file instead of a ts file, but we don't have
+      // markdown-loader in our package.json, so we'll make do with what we have.
+      if (path.startsWith('/api/fleet/epm/packages/okta/')) {
+        const { readme } = await import('./fixtures/readme.okta');
+        return readme;
+      }
+
+      if (path.startsWith('/api/fleet/epm/packages/okta')) {
+        return await import('./fixtures/integration.okta');
+      }
+
       return {};
     }) as HttpHandler,
   } as unknown as HttpStart;
diff --git a/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.tsx b/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.tsx
index c6fbbb2481ea1d..b1a37caf149d9d 100644
--- a/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.tsx
+++ b/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.tsx
@@ -236,6 +236,13 @@ export const Expressions: React.FC<Props> = (props) => {
     if (!alertParams.sourceId) {
       setAlertParams('sourceId', source?.id || 'default');
     }
+
+    if (typeof alertParams.alertOnNoData === 'undefined') {
+      setAlertParams('alertOnNoData', true);
+    }
+    if (typeof alertParams.alertOnGroupDisappear === 'undefined') {
+      setAlertParams('alertOnGroupDisappear', true);
+    }
   }, [metadata, source]); // eslint-disable-line react-hooks/exhaustive-deps
 
   const handleFieldSearchChange = useCallback(
@@ -248,6 +255,11 @@ export const Expressions: React.FC<Props> = (props) => {
     [alertParams.criteria]
   );
 
+  const hasGroupBy = useMemo(
+    () => alertParams.groupBy && alertParams.groupBy.length > 0,
+    [alertParams.groupBy]
+  );
+
   return (
     <>
       <EuiSpacer size={'m'} />
@@ -397,7 +409,7 @@ export const Expressions: React.FC<Props> = (props) => {
       <EuiSpacer size={'m'} />
       <EuiFormRow
         label={i18n.translate('xpack.infra.metrics.alertFlyout.createAlertPerText', {
-          defaultMessage: 'Create alert per (optional)',
+          defaultMessage: 'Group alerts by (optional)',
         })}
         helpText={i18n.translate('xpack.infra.metrics.alertFlyout.createAlertPerHelpText', {
           defaultMessage:
@@ -415,7 +427,28 @@ export const Expressions: React.FC<Props> = (props) => {
           }}
         />
       </EuiFormRow>
-
+      <EuiSpacer size={'s'} />
+      <EuiCheckbox
+        id="metrics-alert-group-disappear-toggle"
+        label={
+          <>
+            {i18n.translate('xpack.infra.metrics.alertFlyout.alertOnGroupDisappear', {
+              defaultMessage: 'Alert me if a group stops reporting data',
+            })}{' '}
+            <EuiToolTip
+              content={i18n.translate('xpack.infra.metrics.alertFlyout.groupDisappearHelpText', {
+                defaultMessage:
+                  'Enable this to trigger the action if a previously detected group begins to report no results. This is not recommended for dynamically scaling infrastructures that may rapidly start and stop nodes automatically.',
+              })}
+            >
+              <EuiIcon type="questionInCircle" color="subdued" />
+            </EuiToolTip>
+          </>
+        }
+        disabled={!hasGroupBy}
+        checked={Boolean(hasGroupBy && alertParams.alertOnGroupDisappear)}
+        onChange={(e) => setAlertParams('alertOnGroupDisappear', e.target.checked)}
+      />
       <EuiSpacer size={'m'} />
     </>
   );
diff --git a/x-pack/plugins/infra/public/alerting/metric_threshold/types.ts b/x-pack/plugins/infra/public/alerting/metric_threshold/types.ts
index a679579e57235a..dd15faf2b11c33 100644
--- a/x-pack/plugins/infra/public/alerting/metric_threshold/types.ts
+++ b/x-pack/plugins/infra/public/alerting/metric_threshold/types.ts
@@ -61,5 +61,6 @@ export interface AlertParams {
   sourceId: string;
   filterQueryText?: string;
   alertOnNoData?: boolean;
+  alertOnGroupDisappear?: boolean;
   shouldDropPartialBuckets?: boolean;
 }
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/evaluate_alert.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/evaluate_alert.ts
index 45eef3cc85a57d..5bd7a4947b4399 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/evaluate_alert.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/evaluate_alert.ts
@@ -232,10 +232,14 @@ const getMetric: (
         aggType,
         dropPartialBucketsOptions,
         calculatedTimerange,
-        isNumber(result.hits.total) ? result.hits.total : result.hits.total.value
+        result.hits
+          ? isNumber(result.hits.total)
+            ? result.hits.total
+            : result.hits.total.value
+          : 0
       ),
     };
-  } catch (e) {
+  } catch (e: any) {
     if (timeframe) {
       // This code should only ever be reached when previewing the alert, not executing it
       const causedByType = e.body?.error?.caused_by?.type;
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
index 869d0afd523671..bd9c0afefa3fcc 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
@@ -112,41 +112,41 @@ describe('The metric threshold alert type', () => {
       });
     test('alerts as expected with the > comparator', async () => {
       await execute(Comparator.GT, [0.75]);
-      expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
+      expect(mostRecentAction(instanceID)).toBeAlertAction();
       await execute(Comparator.GT, [1.5]);
       expect(mostRecentAction(instanceID)).toBe(undefined);
     });
     test('alerts as expected with the < comparator', async () => {
       await execute(Comparator.LT, [1.5]);
-      expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
+      expect(mostRecentAction(instanceID)).toBeAlertAction();
       await execute(Comparator.LT, [0.75]);
       expect(mostRecentAction(instanceID)).toBe(undefined);
     });
     test('alerts as expected with the >= comparator', async () => {
       await execute(Comparator.GT_OR_EQ, [0.75]);
-      expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
+      expect(mostRecentAction(instanceID)).toBeAlertAction();
       await execute(Comparator.GT_OR_EQ, [1.0]);
-      expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
+      expect(mostRecentAction(instanceID)).toBeAlertAction();
       await execute(Comparator.GT_OR_EQ, [1.5]);
       expect(mostRecentAction(instanceID)).toBe(undefined);
     });
     test('alerts as expected with the <= comparator', async () => {
       await execute(Comparator.LT_OR_EQ, [1.5]);
-      expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
+      expect(mostRecentAction(instanceID)).toBeAlertAction();
       await execute(Comparator.LT_OR_EQ, [1.0]);
-      expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
+      expect(mostRecentAction(instanceID)).toBeAlertAction();
       await execute(Comparator.LT_OR_EQ, [0.75]);
       expect(mostRecentAction(instanceID)).toBe(undefined);
     });
     test('alerts as expected with the between comparator', async () => {
       await execute(Comparator.BETWEEN, [0, 1.5]);
-      expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
+      expect(mostRecentAction(instanceID)).toBeAlertAction();
       await execute(Comparator.BETWEEN, [0, 0.75]);
       expect(mostRecentAction(instanceID)).toBe(undefined);
     });
     test('alerts as expected with the outside range comparator', async () => {
       await execute(Comparator.OUTSIDE_RANGE, [0, 0.75]);
-      expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
+      expect(mostRecentAction(instanceID)).toBeAlertAction();
       await execute(Comparator.OUTSIDE_RANGE, [0, 1.5]);
       expect(mostRecentAction(instanceID)).toBe(undefined);
     });
@@ -189,12 +189,12 @@ describe('The metric threshold alert type', () => {
     const instanceIdB = 'b';
     test('sends an alert when all groups pass the threshold', async () => {
       await execute(Comparator.GT, [0.75]);
-      expect(mostRecentAction(instanceIdA).id).toBe(FIRED_ACTIONS.id);
-      expect(mostRecentAction(instanceIdB).id).toBe(FIRED_ACTIONS.id);
+      expect(mostRecentAction(instanceIdA)).toBeAlertAction();
+      expect(mostRecentAction(instanceIdB)).toBeAlertAction();
     });
     test('sends an alert when only some groups pass the threshold', async () => {
       await execute(Comparator.LT, [1.5]);
-      expect(mostRecentAction(instanceIdA).id).toBe(FIRED_ACTIONS.id);
+      expect(mostRecentAction(instanceIdA)).toBeAlertAction();
       expect(mostRecentAction(instanceIdB)).toBe(undefined);
     });
     test('sends no alert when no groups pass the threshold', async () => {
@@ -267,7 +267,7 @@ describe('The metric threshold alert type', () => {
     test('sends an alert when all criteria cross the threshold', async () => {
       const instanceID = '*';
       await execute(Comparator.GT_OR_EQ, [1.0], [3.0]);
-      expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
+      expect(mostRecentAction(instanceID)).toBeAlertAction();
     });
     test('sends no alert when some, but not all, criteria cross the threshold', async () => {
       const instanceID = '*';
@@ -278,7 +278,7 @@ describe('The metric threshold alert type', () => {
       const instanceIdA = 'a';
       const instanceIdB = 'b';
       await execute(Comparator.GT_OR_EQ, [1.0], [3.0], 'something');
-      expect(mostRecentAction(instanceIdA).id).toBe(FIRED_ACTIONS.id);
+      expect(mostRecentAction(instanceIdA)).toBeAlertAction();
       expect(mostRecentAction(instanceIdB)).toBe(undefined);
     });
     test('sends all criteria to the action context', async () => {
@@ -315,7 +315,7 @@ describe('The metric threshold alert type', () => {
       });
     test('alerts based on the doc_count value instead of the aggregatedValue', async () => {
       await execute(Comparator.GT, [0.9]);
-      expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
+      expect(mostRecentAction(instanceID)).toBeAlertAction();
       await execute(Comparator.LT, [0.5]);
       expect(mostRecentAction(instanceID)).toBe(undefined);
     });
@@ -350,8 +350,8 @@ describe('The metric threshold alert type', () => {
         expect(mostRecentAction(instanceIdA)).toBe(undefined);
         expect(mostRecentAction(instanceIdB)).toBe(undefined);
         await executeGroupBy(Comparator.LT_OR_EQ, [0], 'empty-response', resultState);
-        expect(mostRecentAction(instanceIdA).id).toBe(FIRED_ACTIONS.id);
-        expect(mostRecentAction(instanceIdB).id).toBe(FIRED_ACTIONS.id);
+        expect(mostRecentAction(instanceIdA)).toBeAlertAction();
+        expect(mostRecentAction(instanceIdB)).toBeAlertAction();
         await executeGroupBy(Comparator.LT_OR_EQ, [0]);
         expect(mostRecentAction(instanceIdA)).toBe(undefined);
         expect(mostRecentAction(instanceIdB)).toBe(undefined);
@@ -379,7 +379,7 @@ describe('The metric threshold alert type', () => {
       });
     test('alerts based on the p99 values', async () => {
       await execute(Comparator.GT, [1]);
-      expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
+      expect(mostRecentAction(instanceID)).toBeAlertAction();
       await execute(Comparator.LT, [1]);
       expect(mostRecentAction(instanceID)).toBe(undefined);
     });
@@ -406,7 +406,7 @@ describe('The metric threshold alert type', () => {
       });
     test('alerts based on the p95 values', async () => {
       await execute(Comparator.GT, [0.25]);
-      expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
+      expect(mostRecentAction(instanceID)).toBeAlertAction();
       await execute(Comparator.LT, [0.95]);
       expect(mostRecentAction(instanceID)).toBe(undefined);
     });
@@ -433,7 +433,7 @@ describe('The metric threshold alert type', () => {
       });
     test('sends a No Data alert when configured to do so', async () => {
       await execute(true);
-      expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
+      expect(mostRecentAction(instanceID)).toBeNoDataAction();
     });
     test('does not send a No Data alert when not configured to do so', async () => {
       await execute(false);
@@ -446,7 +446,8 @@ describe('The metric threshold alert type', () => {
     const instanceID = '*';
     const instanceIdA = 'a';
     const instanceIdB = 'b';
-    const execute = (metric: string, state?: any) =>
+    const instanceIdC = 'c';
+    const execute = (metric: string, alertOnGroupDisappear: boolean = true, state?: any) =>
       executor({
         ...mockOptions,
         services,
@@ -462,25 +463,98 @@ describe('The metric threshold alert type', () => {
             },
           ],
           alertOnNoData: true,
+          alertOnGroupDisappear,
         },
         state: state ?? mockOptions.state.wrapped,
       });
-    const resultState: any[] = [];
+
+    const executeEmptyResponse = (...args: [boolean?, any?]) => execute('test.metric.3', ...args);
+    const execute3GroupsABCResponse = (...args: [boolean?, any?]) =>
+      execute('test.metric.2', ...args);
+    const execute2GroupsABResponse = (...args: [boolean?, any?]) =>
+      execute('test.metric.1', ...args);
+
+    // Store state between tests. Jest won't preserve reassigning a let so use an array instead.
+    const interTestStateStorage: any[] = [];
+
     test('first sends a No Data alert with the * group, but then reports groups when data is available', async () => {
-      resultState.push(await execute('test.metric.3'));
-      expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
-      resultState.push(await execute('test.metric.3', resultState.pop()));
-      expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
-      resultState.push(await execute('test.metric.1', resultState.pop()));
+      let resultState = await executeEmptyResponse();
+      expect(mostRecentAction(instanceID)).toBeNoDataAction();
+      resultState = await executeEmptyResponse(true, resultState);
+      expect(mostRecentAction(instanceID)).toBeNoDataAction();
+      resultState = await execute2GroupsABResponse(true, resultState);
       expect(mostRecentAction(instanceID)).toBe(undefined);
-      expect(mostRecentAction(instanceIdA).id).toBe(FIRED_ACTIONS.id);
-      expect(mostRecentAction(instanceIdB).id).toBe(FIRED_ACTIONS.id);
+      expect(mostRecentAction(instanceIdA)).toBeAlertAction();
+      expect(mostRecentAction(instanceIdB)).toBeAlertAction();
+      interTestStateStorage.push(resultState); // Hand off resultState to the next test
     });
     test('sends No Data alerts for the previously detected groups when they stop reporting data, but not the * group', async () => {
-      await execute('test.metric.3', resultState.pop());
+      // Pop a previous execution result instead of defining it manually
+      // The type signature of alert executor states are complex
+      const resultState = interTestStateStorage.pop();
+      await executeEmptyResponse(true, resultState);
+      expect(mostRecentAction(instanceID)).toBe(undefined);
+      expect(mostRecentAction(instanceIdA)).toBeNoDataAction();
+      expect(mostRecentAction(instanceIdB)).toBeNoDataAction();
+    });
+    test('does not send individual No Data alerts when groups disappear if alertOnGroupDisappear is disabled', async () => {
+      const resultState = await execute3GroupsABCResponse(false);
+      expect(mostRecentAction(instanceID)).toBe(undefined);
+      expect(mostRecentAction(instanceIdA)).toBeAlertAction();
+      expect(mostRecentAction(instanceIdB)).toBeAlertAction();
+      expect(mostRecentAction(instanceIdC)).toBeAlertAction();
+      await execute2GroupsABResponse(false, resultState);
       expect(mostRecentAction(instanceID)).toBe(undefined);
-      expect(mostRecentAction(instanceIdA).id).toBe(FIRED_ACTIONS.id);
-      expect(mostRecentAction(instanceIdB).id).toBe(FIRED_ACTIONS.id);
+      expect(mostRecentAction(instanceIdA)).toBeAlertAction();
+      expect(mostRecentAction(instanceIdB)).toBeAlertAction();
+      expect(mostRecentAction(instanceIdC)).toBe(undefined);
+    });
+
+    describe('if alertOnNoData is disabled but alertOnGroupDisappear is enabled', () => {
+      const executeWeirdNoDataConfig = (metric: string, state?: any) =>
+        executor({
+          ...mockOptions,
+          services,
+          params: {
+            groupBy: 'something',
+            sourceId: 'default',
+            criteria: [
+              {
+                ...baseNonCountCriterion,
+                comparator: Comparator.GT,
+                threshold: [0],
+                metric,
+              },
+            ],
+            alertOnNoData: false,
+            alertOnGroupDisappear: true,
+          },
+          state: state ?? mockOptions.state.wrapped,
+        });
+
+      const executeWeirdEmptyResponse = (...args: [any?]) =>
+        executeWeirdNoDataConfig('test.metric.3', ...args);
+      const executeWeird2GroupsABResponse = (...args: [any?]) =>
+        executeWeirdNoDataConfig('test.metric.1', ...args);
+
+      test('does not send a No Data alert with the * group, but then reports groups when data is available', async () => {
+        let resultState = await executeWeirdEmptyResponse();
+        expect(mostRecentAction(instanceID)).toBe(undefined);
+        resultState = await executeWeirdEmptyResponse(resultState);
+        expect(mostRecentAction(instanceID)).toBe(undefined);
+        resultState = await executeWeird2GroupsABResponse(resultState);
+        expect(mostRecentAction(instanceID)).toBe(undefined);
+        expect(mostRecentAction(instanceIdA)).toBeAlertAction();
+        expect(mostRecentAction(instanceIdB)).toBeAlertAction();
+        interTestStateStorage.push(resultState); // Hand off resultState to the next test
+      });
+      test('sends No Data alerts for the previously detected groups when they stop reporting data, but not the * group', async () => {
+        const resultState = interTestStateStorage.pop(); // Import the resultState from the previous test
+        await executeWeirdEmptyResponse(resultState);
+        expect(mostRecentAction(instanceID)).toBe(undefined);
+        expect(mostRecentAction(instanceIdA)).toBeNoDataAction();
+        expect(mostRecentAction(instanceIdB)).toBeNoDataAction();
+      });
     });
   });
 
@@ -506,7 +580,7 @@ describe('The metric threshold alert type', () => {
       });
     test('sends a No Data alert', async () => {
       await execute();
-      expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
+      expect(mostRecentAction(instanceID)).toBeNoDataAction();
     });
   });
 
@@ -538,7 +612,7 @@ describe('The metric threshold alert type', () => {
 
     test('sends a recovery alert as soon as the metric recovers', async () => {
       await execute([0.5]);
-      expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
+      expect(mostRecentAction(instanceID)).toBeAlertAction();
       expect(getState(instanceID).alertState).toBe(AlertStates.ALERT);
       await execute([2]);
       expect(mostRecentAction(instanceID).id).toBe(RecoveredActionGroup.id);
@@ -554,7 +628,7 @@ describe('The metric threshold alert type', () => {
     });
     test('sends a recovery alert again once the metric alerts and recovers again', async () => {
       await execute([0.5]);
-      expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
+      expect(mostRecentAction(instanceID)).toBeAlertAction();
       expect(getState(instanceID).alertState).toBe(AlertStates.ALERT);
       await execute([2]);
       expect(mostRecentAction(instanceID).id).toBe(RecoveredActionGroup.id);
@@ -622,8 +696,11 @@ const services: AlertServicesMock &
 };
 services.scopedClusterClient.asCurrentUser.search.mockImplementation((params?: any): any => {
   const from = params?.body.query.bool.filter[0]?.range['@timestamp'].gte;
+
   if (params.index === 'alternatebeat-*') return mocks.changedSourceIdResponse(from);
+
   if (params.index === 'empty-response') return mocks.emptyMetricResponse;
+
   const metric = params?.body.query.bool.filter[1]?.exists.field;
   if (metric === 'test.metric.3') {
     return elasticsearchClientMock.createSuccessTransportRequestPromise(
@@ -705,6 +782,40 @@ function clearInstances() {
   alertInstances.clear();
 }
 
+interface Action {
+  id: string;
+  action: { alertState: string };
+}
+
+expect.extend({
+  toBeAlertAction(action?: Action) {
+    const pass = action?.id === FIRED_ACTIONS.id && action?.action.alertState === 'ALERT';
+    const message = () => `expected ${action} to be an ALERT action`;
+    return {
+      message,
+      pass,
+    };
+  },
+  toBeNoDataAction(action?: Action) {
+    const pass = action?.id === FIRED_ACTIONS.id && action?.action.alertState === 'NO DATA';
+    const message = () => `expected ${action} to be a NO DATA action`;
+    return {
+      message,
+      pass,
+    };
+  },
+});
+
+declare global {
+  // eslint-disable-next-line @typescript-eslint/no-namespace
+  namespace jest {
+    interface Matchers<R> {
+      toBeAlertAction(action?: Action): R;
+      toBeNoDataAction(action?: Action): R;
+    }
+  }
+}
+
 const baseNonCountCriterion: Pick<
   NonCountMetricExpressionParams,
   'aggType' | 'metric' | 'timeSize' | 'timeUnit'
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
index f49b281909f4be..af5f945eeb4bbe 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
@@ -74,11 +74,19 @@ export const createMetricThresholdExecutor = (libs: InfraBackendLibs) =>
         },
       });
 
-    const { sourceId, alertOnNoData } = params as {
+    const {
+      sourceId,
+      alertOnNoData,
+      alertOnGroupDisappear: _alertOnGroupDisappear,
+    } = params as {
       sourceId?: string;
       alertOnNoData: boolean;
+      alertOnGroupDisappear: boolean | undefined;
     };
 
+    // For backwards-compatibility, interpret undefined alertOnGroupDisappear as true
+    const alertOnGroupDisappear = _alertOnGroupDisappear !== false;
+
     const source = await libs.sources.getSourceConfiguration(
       savedObjectsClient,
       sourceId || 'default'
@@ -86,12 +94,13 @@ export const createMetricThresholdExecutor = (libs: InfraBackendLibs) =>
     const config = source.configuration;
 
     const previousGroupBy = state.groupBy;
-    const prevGroups = isEqual(previousGroupBy, params.groupBy)
-      ? // Filter out the * key from the previous groups, only include it if it's one of
-        // the current groups. In case of a groupBy alert that starts out with no data and no
-        // groups, we don't want to persist the existence of the * alert instance
-        state.groups?.filter((g) => g !== UNGROUPED_FACTORY_KEY) ?? []
-      : [];
+    const prevGroups =
+      alertOnGroupDisappear && isEqual(previousGroupBy, params.groupBy)
+        ? // Filter out the * key from the previous groups, only include it if it's one of
+          // the current groups. In case of a groupBy alert that starts out with no data and no
+          // groups, we don't want to persist the existence of the * alert instance
+          state.groups?.filter((g) => g !== UNGROUPED_FACTORY_KEY) ?? []
+        : [];
 
     const alertResults = await evaluateAlert(
       services.scopedClusterClient.asCurrentUser,
@@ -106,6 +115,8 @@ export const createMetricThresholdExecutor = (libs: InfraBackendLibs) =>
     // no data results on groups that get removed
     const groups = [...new Set([...prevGroups, ...resultGroups])];
 
+    const hasGroups = !isEqual(groups, [UNGROUPED_FACTORY_KEY]);
+
     for (const group of groups) {
       // AND logic; all criteria must be across the threshold
       const shouldAlertFire = alertResults.every((result) =>
@@ -147,7 +158,26 @@ export const createMetricThresholdExecutor = (libs: InfraBackendLibs) =>
         //   .map((result) => buildRecoveredAlertReason(formatAlertResult(result[group])))
         //   .join('\n');
       }
-      if (alertOnNoData) {
+
+      /* NO DATA STATE HANDLING
+       *
+       * - `alertOnNoData` does not indicate IF the alert's next state is No Data, but whether or not the user WANTS TO BE ALERTED
+       *   if the state were No Data.
+       * - `alertOnGroupDisappear`, on the other hand, determines whether or not it's possible to return a No Data state
+       *   when a group disappears.
+       *
+       * This means we need to handle the possibility that `alertOnNoData` is false, but `alertOnGroupDisappear` is true
+       *
+       * nextState === NO_DATA would be true on both { '*': No Data } or, e.g. { 'a': No Data, 'b': OK, 'c': OK }, but if the user
+       * has for some reason disabled `alertOnNoData` and left `alertOnGroupDisappear` enabled, they would only care about the latter
+       * possibility. In this case, use hasGroups to determine whether to alert on a potential No Data state
+       *
+       * If `alertOnNoData` is true but `alertOnGroupDisappear` is false, we don't need to worry about the {a, b, c} possibility.
+       * At this point in the function, a false `alertOnGroupDisappear` would already have prevented group 'a' from being evaluated at all.
+       */
+      if (alertOnNoData || (alertOnGroupDisappear && hasGroups)) {
+        // In the previous line we've determined if the user is interested in No Data states, so only now do we actually
+        // check to see if a No Data state has occurred
         if (nextState === AlertStates.NO_DATA) {
           reason = alertResults
             .filter((result) => result[group].isNoData)
@@ -160,6 +190,7 @@ export const createMetricThresholdExecutor = (libs: InfraBackendLibs) =>
             .join('\n');
         }
       }
+
       if (reason) {
         const firstResult = first(alertResults);
         const timestamp = (firstResult && firstResult[group].timestamp) ?? moment().toISOString();
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/register_metric_threshold_alert_type.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/register_metric_threshold_alert_type.ts
index 054585e541ba10..251531b4515a97 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/register_metric_threshold_alert_type.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/register_metric_threshold_alert_type.ts
@@ -77,6 +77,8 @@ export async function registerMetricThresholdAlertType(
           ),
           sourceId: schema.string(),
           alertOnNoData: schema.maybe(schema.boolean()),
+          alertOnGroupDisappear: schema.maybe(schema.boolean()),
+          shouldDropPartialBuckets: schema.maybe(schema.boolean()),
         },
         { unknowns: 'allow' }
       ),
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/test_mocks.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/test_mocks.ts
index db6b771e91784a..d023aa5e28a4e4 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/test_mocks.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/test_mocks.ts
@@ -159,6 +159,7 @@ export const basicCompositeResponse = (from: number) => ({
           aggregatedIntervals: {
             buckets: bucketsA(from),
           },
+          doc_count: 1,
         },
         {
           key: {
@@ -167,6 +168,7 @@ export const basicCompositeResponse = (from: number) => ({
           aggregatedIntervals: {
             buckets: bucketsB(from),
           },
+          doc_count: 1,
         },
       ],
     },
@@ -190,6 +192,7 @@ export const alternateCompositeResponse = (from: number) => ({
           aggregatedIntervals: {
             buckets: bucketsB(from),
           },
+          doc_count: 1,
         },
         {
           key: {
@@ -198,6 +201,7 @@ export const alternateCompositeResponse = (from: number) => ({
           aggregatedIntervals: {
             buckets: bucketsA(from),
           },
+          doc_count: 1,
         },
         {
           key: {
@@ -206,6 +210,7 @@ export const alternateCompositeResponse = (from: number) => ({
           aggregatedIntervals: {
             buckets: bucketsC(from),
           },
+          doc_count: 1,
         },
       ],
     },
diff --git a/x-pack/plugins/lens/public/app_plugin/app.test.tsx b/x-pack/plugins/lens/public/app_plugin/app.test.tsx
index 275e6519367c7e..d10fe42feb3228 100644
--- a/x-pack/plugins/lens/public/app_plugin/app.test.tsx
+++ b/x-pack/plugins/lens/public/app_plugin/app.test.tsx
@@ -336,7 +336,18 @@ describe('Lens App', () => {
         {}
       );
     });
-
+    it('handles rejected index pattern', async () => {
+      const customServices = makeDefaultServices(sessionIdSubject);
+      customServices.data.indexPatterns.get = jest
+        .fn()
+        .mockImplementation((id) => Promise.reject({ reason: 'Could not locate that data view' }));
+      const customProps = makeDefaultProps();
+      const { services } = await mountWith({ props: customProps, services: customServices });
+      expect(services.navigation.ui.TopNavMenu).toHaveBeenCalledWith(
+        expect.objectContaining({ indexPatterns: [] }),
+        {}
+      );
+    });
     describe('save buttons', () => {
       interface SaveProps {
         newCopyOnSave: boolean;
diff --git a/x-pack/plugins/lens/public/app_plugin/lens_top_nav.tsx b/x-pack/plugins/lens/public/app_plugin/lens_top_nav.tsx
index f0785496dcf322..6692b7abc03d07 100644
--- a/x-pack/plugins/lens/public/app_plugin/lens_top_nav.tsx
+++ b/x-pack/plugins/lens/public/app_plugin/lens_top_nav.tsx
@@ -169,6 +169,7 @@ export const LensTopNavMenu = ({
   );
 
   const [indexPatterns, setIndexPatterns] = useState<IndexPattern[]>([]);
+  const [rejectedIndexPatterns, setRejectedIndexPatterns] = useState<string[]>([]);
 
   const {
     isSaveable,
@@ -200,17 +201,31 @@ export const LensTopNavMenu = ({
       datasourceStates,
     });
     const hasIndexPatternsChanged =
-      indexPatterns.length !== indexPatternIds.length ||
-      indexPatternIds.some((id) => !indexPatterns.find((indexPattern) => indexPattern.id === id));
+      indexPatterns.length + rejectedIndexPatterns.length !== indexPatternIds.length ||
+      indexPatternIds.some(
+        (id) =>
+          ![...indexPatterns.map((ip) => ip.id), ...rejectedIndexPatterns].find(
+            (loadedId) => loadedId === id
+          )
+      );
+
     // Update the cached index patterns if the user made a change to any of them
     if (hasIndexPatternsChanged) {
       getIndexPatternsObjects(indexPatternIds, data.indexPatterns).then(
-        ({ indexPatterns: indexPatternObjects }) => {
+        ({ indexPatterns: indexPatternObjects, rejectedIds }) => {
           setIndexPatterns(indexPatternObjects);
+          setRejectedIndexPatterns(rejectedIds);
         }
       );
     }
-  }, [datasourceStates, activeDatasourceId, data.indexPatterns, datasourceMap, indexPatterns]);
+  }, [
+    datasourceStates,
+    activeDatasourceId,
+    rejectedIndexPatterns,
+    datasourceMap,
+    indexPatterns,
+    data.indexPatterns,
+  ]);
 
   const { TopNavMenu } = navigation.ui;
   const { from, to } = data.query.timefilter.timefilter.getTime();
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/layer_panel.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/layer_panel.tsx
index 8c947d3502f930..6e2e77af4f3b01 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/layer_panel.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/layer_panel.tsx
@@ -178,9 +178,9 @@ export function LayerPanel(
         setNextFocusedButtonId(columnId);
       }
 
-      const filterOperations =
-        groups.find(({ groupId: gId }) => gId === targetItem.groupId)?.filterOperations ||
-        (() => false);
+      const group = groups.find(({ groupId: gId }) => gId === groupId);
+
+      const filterOperations = group?.filterOperations || (() => false);
 
       const dropResult = layerDatasourceOnDrop({
         ...layerDatasourceDropProps,
@@ -193,12 +193,28 @@ export function LayerPanel(
         dropType,
       });
       if (dropResult) {
+        let previousColumn =
+          typeof droppedItem.column === 'string' ? droppedItem.column : undefined;
+
+        // make it inherit only for moving and duplicate
+        if (!previousColumn) {
+          // when duplicating check if the previous column is required
+          if (
+            dropType === 'duplicate_compatible' &&
+            typeof droppedItem.columnId === 'string' &&
+            group?.requiresPreviousColumnOnDuplicate
+          ) {
+            previousColumn = droppedItem.columnId;
+          } else {
+            previousColumn = typeof dropResult === 'object' ? dropResult.deleted : undefined;
+          }
+        }
         const newVisState = setDimension({
           columnId,
           groupId,
           layerId: targetLayerId,
           prevState: props.visualizationState,
-          previousColumn: typeof droppedItem.column === 'string' ? droppedItem.column : undefined,
+          previousColumn,
           frame: framePublicAPI,
         });
 
diff --git a/x-pack/plugins/lens/public/types.ts b/x-pack/plugins/lens/public/types.ts
index cf6634c200d556..75ed5f4907e0b2 100644
--- a/x-pack/plugins/lens/public/types.ts
+++ b/x-pack/plugins/lens/public/types.ts
@@ -478,6 +478,8 @@ export type VisualizationDimensionGroupConfig = SharedDimensionProps & {
   // some type of layers can produce groups even if invalid. Keep this information to visually show the user that.
   invalid?: boolean;
   invalidMessage?: string;
+  // need a special flag to know when to pass the previous column on duplicating
+  requiresPreviousColumnOnDuplicate?: boolean;
 };
 
 interface VisualizationDimensionChangeProps<T> {
diff --git a/x-pack/plugins/lens/public/xy_visualization/visualization.tsx b/x-pack/plugins/lens/public/xy_visualization/visualization.tsx
index ed1cc015806c51..33cd01c8fda7aa 100644
--- a/x-pack/plugins/lens/public/xy_visualization/visualization.tsx
+++ b/x-pack/plugins/lens/public/xy_visualization/visualization.tsx
@@ -367,6 +367,7 @@ export const getXyVisualization = ({
             defaultMessage:
               'This threshold is assigned to an axis that no longer exists. You may move this threshold to another available axis or remove it.',
           }),
+          requiresPreviousColumnOnDuplicate: true,
         })),
       };
     }
@@ -422,7 +423,7 @@ export const getXyVisualization = ({
     return state.layers[0].palette;
   },
 
-  setDimension({ prevState, layerId, columnId, groupId }) {
+  setDimension({ prevState, layerId, columnId, groupId, previousColumn }) {
     const foundLayer = prevState.layers.find((l) => l.layerId === layerId);
     if (!foundLayer) {
       return prevState;
@@ -441,12 +442,21 @@ export const getXyVisualization = ({
     if (newLayer.layerType === layerTypes.THRESHOLD) {
       newLayer.accessors = [...newLayer.accessors.filter((a) => a !== columnId), columnId];
       const hasYConfig = newLayer.yConfig?.some(({ forAccessor }) => forAccessor === columnId);
+      const previousYConfig = previousColumn
+        ? newLayer.yConfig?.find(({ forAccessor }) => forAccessor === previousColumn)
+        : false;
       if (!hasYConfig) {
         newLayer.yConfig = [
           ...(newLayer.yConfig || []),
           // TODO: move this
           // add a default config if none is available
           {
+            icon: undefined,
+            lineStyle: 'solid',
+            lineWidth: 1,
+            // override with previous styling,
+            ...previousYConfig,
+            // but keep the new group & id config
             forAccessor: columnId,
             axisMode:
               groupId === 'xThreshold'
@@ -454,9 +464,6 @@ export const getXyVisualization = ({
                 : groupId === 'yThresholdRight'
                 ? 'right'
                 : 'left',
-            icon: undefined,
-            lineStyle: 'solid',
-            lineWidth: 1,
           },
         ];
       }
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/recognize/components/job_settings_form.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/recognize/components/job_settings_form.tsx
index 7a677b8086b407..8dc0ca0ddbdc47 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/recognize/components/job_settings_form.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/recognize/components/job_settings_form.tsx
@@ -269,7 +269,7 @@ export const JobSettingsForm: FC<JobSettingsFormProps> = ({
         >
           <FormattedMessage
             id="xpack.ml.newJob.recognize.createJobButtonLabel"
-            defaultMessage="Create {numberOfJobs, plural, zero {Job} one {Job} other {Jobs}}"
+            defaultMessage="Create {numberOfJobs, plural, zero {job} one {job} other {jobs}}"
             values={{ numberOfJobs: jobs.length }}
           />
         </EuiButton>
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/manifest.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/manifest.json
index f8feaef3be5f85..123232935df05d 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/manifest.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/manifest.json
@@ -1,29 +1,29 @@
 {
   "id": "apm_transaction",
   "title": "APM",
-  "description": "Detect anomalies in transactions from your APM services.",
+  "description": "Detect anomalies in transactions from your APM services for metric data.",
   "type": "Transaction data",
   "logoFile": "logo.json",
-  "defaultIndexPattern": "apm-*-transaction",
+  "defaultIndexPattern": "apm-*-metric,metrics-apm*",
   "query": {
     "bool": {
       "filter": [
-        { "term": { "processor.event": "transaction" } },
-        { "exists": { "field": "transaction.duration" } }
+        { "term": { "processor.event": "metric" } },
+        { "term": { "metricset.name": "transaction" } }
       ]
     }
   },
   "jobs": [
     {
-      "id": "high_mean_transaction_duration",
-      "file": "high_mean_transaction_duration.json"
+      "id": "apm_metrics",
+      "file": "apm_metrics.json"
     }
   ],
   "datafeeds": [
     {
-      "id": "datafeed-high_mean_transaction_duration",
-      "file": "datafeed_high_mean_transaction_duration.json",
-      "job_id": "high_mean_transaction_duration"
+      "id": "datafeed-apm_metrics",
+      "file": "datafeed_apm_metrics.json",
+      "job_id": "apm_metrics"
     }
   ]
 }
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/ml/apm_metrics.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/ml/apm_metrics.json
new file mode 100644
index 00000000000000..d5092f3ffc5538
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/ml/apm_metrics.json
@@ -0,0 +1,53 @@
+{
+  "job_type": "anomaly_detector",
+  "groups": [
+    "apm"
+  ],
+  "description": "Detects anomalies in transaction duration, throughput and error percentage for metric data.",
+  "analysis_config": {
+    "bucket_span": "15m",
+    "summary_count_field_name" : "doc_count",
+    "detectors" : [
+      {
+        "detector_description" : "high duration by transaction type for an APM service",
+        "function" : "high_mean",
+        "field_name" : "transaction_duration",
+        "by_field_name" : "transaction.type",
+        "partition_field_name" : "service.name"
+      },
+      {
+        "detector_description" : "transactions per minute for an APM service",
+        "function" : "mean",
+        "field_name" : "transactions_per_min",
+        "by_field_name" : "transaction.type",
+        "partition_field_name" : "service.name"
+      },
+      {
+        "detector_description" : "percent failed for an APM service",
+        "function" : "high_mean",
+        "field_name" : "transaction_failure_percentage",
+        "by_field_name" : "transaction.type",
+        "partition_field_name" : "service.name"
+      }
+    ],
+    "influencers" : [
+      "transaction.type",
+      "service.name"
+    ]
+  },
+  "analysis_limits": {
+    "model_memory_limit": "32mb"
+  },
+  "data_description": {
+    "time_field" : "@timestamp",
+    "time_format" : "epoch_ms"
+  },
+  "model_plot_config": {
+    "enabled" : true,
+    "annotations_enabled" : true
+  },
+  "results_index_name" : "custom-apm",
+  "custom_settings": {
+    "created_by": "ml-module-apm-transaction"
+  }
+}
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/ml/datafeed_apm_metrics.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/ml/datafeed_apm_metrics.json
new file mode 100644
index 00000000000000..ba45582252cd77
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/ml/datafeed_apm_metrics.json
@@ -0,0 +1,95 @@
+{
+  "job_id": "JOB_ID",
+  "indices": [
+    "INDEX_PATTERN_NAME"
+  ],
+  "chunking_config" : {
+    "mode" : "off"
+  },
+  "query": {
+    "bool": {
+      "filter": [
+        { "term": { "processor.event": "metric" } },
+        { "term": { "metricset.name": "transaction" } }
+      ]
+    }
+  },
+  "aggregations" : {
+    "buckets" : {
+      "composite" : {
+        "size" : 5000,
+        "sources" : [
+          {
+            "date" : {
+              "date_histogram" : {
+                "field" : "@timestamp",
+                "fixed_interval" : "90s"
+              }
+            }
+          },
+          {
+            "transaction.type" : {
+              "terms" : {
+                "field" : "transaction.type"
+              }
+            }
+          },
+          {
+            "service.name" : {
+              "terms" : {
+                "field" : "service.name"
+              }
+            }
+          }
+        ]
+      },
+      "aggs" : {
+        "@timestamp" : {
+          "max" : {
+            "field" : "@timestamp"
+          }
+        },
+        "transactions_per_min" : {
+          "rate" : {
+            "unit" : "minute"
+          }
+        },
+        "transaction_duration" : {
+          "avg" : {
+            "field" : "transaction.duration.histogram"
+          }
+        },
+        "error_count" : {
+          "filter" : {
+            "term" : {
+              "event.outcome" : "failure"
+            }
+          },
+          "aggs" : {
+            "actual_error_count" : {
+              "value_count" : {
+                "field" : "event.outcome"
+              }
+            }
+          }
+        },
+        "success_count" : {
+          "filter" : {
+            "term" : {
+              "event.outcome" : "success"
+            }
+          }
+        },
+        "transaction_failure_percentage" : {
+          "bucket_script" : {
+            "buckets_path" : {
+              "failure_count" : "error_count>_count",
+              "success_count" : "success_count>_count"
+            },
+            "script" : "if ((params.failure_count + params.success_count)==0){return 0;}else{return params.failure_count/(params.failure_count + params.success_count);}"
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/ml/datafeed_high_mean_transaction_duration.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/ml/datafeed_high_mean_transaction_duration.json
deleted file mode 100644
index d312577902f517..00000000000000
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/ml/datafeed_high_mean_transaction_duration.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "job_id": "JOB_ID",
-  "indices": [
-    "INDEX_PATTERN_NAME"
-  ],
-  "query": {
-    "bool": {
-      "filter": [
-        { "term": { "processor.event": "transaction" } },
-        { "exists": { "field": "transaction.duration.us" } }
-      ]
-    }
-  }
-}
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/ml/high_mean_transaction_duration.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/ml/high_mean_transaction_duration.json
deleted file mode 100644
index 77284cb275cd8d..00000000000000
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/ml/high_mean_transaction_duration.json
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  "job_type": "anomaly_detector",
-  "groups": [
-    "apm"
-  ],
-  "description": "Detect transaction duration anomalies across transaction types for your APM services.",
-  "analysis_config": {
-    "bucket_span": "15m",
-    "detectors": [
-      {
-        "detector_description": "high duration by transaction type for an APM service",
-        "function": "high_mean",
-        "field_name": "transaction.duration.us",
-        "by_field_name": "transaction.type",
-        "partition_field_name": "service.name"
-      }
-    ],
-    "influencers": [
-      "transaction.type",
-      "service.name"
-    ]
-  },
-  "analysis_limits": {
-    "model_memory_limit": "32mb"
-  },
-  "data_description": {
-    "time_field": "@timestamp"
-  },
-  "model_plot_config": {
-    "enabled": true
-  },
-  "custom_settings": {
-    "created_by": "ml-module-apm-transaction"
-  }
-}
diff --git a/x-pack/plugins/monitoring/public/application/hooks/use_table.ts b/x-pack/plugins/monitoring/public/application/hooks/use_table.ts
index 60264f3657fe37..600ac20cd01999 100644
--- a/x-pack/plugins/monitoring/public/application/hooks/use_table.ts
+++ b/x-pack/plugins/monitoring/public/application/hooks/use_table.ts
@@ -98,10 +98,22 @@ export function useTable(storageKey: string) {
 
   const [query, setQuery] = useState('');
 
-  const onTableChange = () => {
-    // we are already updating the state in fetchMoreData. We would need to check in react
-    // if both methods are needed or we can clean one of them
-    // For now I just keep it so existing react components don't break
+  const onTableChange = ({ page, sort }: { page: Page; sort: Sorting['sort'] }) => {
+    setPagination({
+      ...pagination,
+      ...{
+        initialPageSize: page.size,
+        pageSize: page.size,
+        initialPageIndex: page.index,
+        pageIndex: page.index,
+        pageSizeOptions: PAGE_SIZE_OPTIONS,
+      },
+    });
+    setSorting(cleanSortingData({ sort }));
+    setLocalStorageData(storage, {
+      page,
+      sort,
+    });
   };
 
   const getPaginationRouteOptions = useCallback(() => {
diff --git a/x-pack/plugins/monitoring/public/application/index.tsx b/x-pack/plugins/monitoring/public/application/index.tsx
index b9ea91bce98055..690ea26319bd3e 100644
--- a/x-pack/plugins/monitoring/public/application/index.tsx
+++ b/x-pack/plugins/monitoring/public/application/index.tsx
@@ -24,6 +24,7 @@ import { BeatsOverviewPage } from './pages/beats/overview';
 import { BeatsInstancesPage } from './pages/beats/instances';
 import { CODE_PATH_ELASTICSEARCH, CODE_PATH_BEATS } from '../../common/constants';
 import { ElasticsearchNodesPage } from './pages/elasticsearch/nodes_page';
+import { ElasticsearchIndicesPage } from './pages/elasticsearch/indices_page';
 import { ElasticsearchNodePage } from './pages/elasticsearch/node_page';
 import { MonitoringTimeContainer } from './hooks/use_monitoring_time';
 import { BreadcrumbContainer } from './hooks/use_breadcrumbs';
@@ -81,6 +82,13 @@ const MonitoringApp: React.FC<{
                   />
 
                   {/* ElasticSearch Views */}
+                  <RouteInit
+                    path="/elasticsearch/indices"
+                    component={ElasticsearchIndicesPage}
+                    codePaths={[CODE_PATH_ELASTICSEARCH]}
+                    fetchAllClusters={false}
+                  />
+
                   <RouteInit
                     path="/elasticsearch/nodes/:node"
                     component={ElasticsearchNodePage}
diff --git a/x-pack/plugins/monitoring/public/application/pages/beats/instances.tsx b/x-pack/plugins/monitoring/public/application/pages/beats/instances.tsx
index 451c71deb472da..3f32e1abf9a883 100644
--- a/x-pack/plugins/monitoring/public/application/pages/beats/instances.tsx
+++ b/x-pack/plugins/monitoring/public/application/pages/beats/instances.tsx
@@ -29,7 +29,7 @@ export const BeatsInstancesPage: React.FC<ComponentProps> = ({ clusters }) => {
   const globalState = useContext(GlobalStateContext);
   const { services } = useKibana<{ data: any }>();
   const { generate: generateBreadcrumbs } = useContext(BreadcrumbContainer.Context);
-  const { getPaginationTableProps } = useTable('beats.instances');
+  const { updateTotalItemCount, getPaginationTableProps } = useTable('beats.instances');
   const clusterUuid = globalState.cluster_uuid;
   const ccs = globalState.ccs;
   const cluster = find(clusters, {
@@ -66,7 +66,14 @@ export const BeatsInstancesPage: React.FC<ComponentProps> = ({ clusters }) => {
     });
 
     setData(response);
-  }, [ccs, clusterUuid, services.data?.query.timefilter.timefilter, services.http]);
+    updateTotalItemCount(response.stats.total);
+  }, [
+    ccs,
+    clusterUuid,
+    services.data?.query.timefilter.timefilter,
+    services.http,
+    updateTotalItemCount,
+  ]);
 
   return (
     <BeatsTemplate
diff --git a/x-pack/plugins/monitoring/public/application/pages/elasticsearch/indices_page.tsx b/x-pack/plugins/monitoring/public/application/pages/elasticsearch/indices_page.tsx
new file mode 100644
index 00000000000000..9166f2090d89a9
--- /dev/null
+++ b/x-pack/plugins/monitoring/public/application/pages/elasticsearch/indices_page.tsx
@@ -0,0 +1,99 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React, { useContext, useState, useCallback } from 'react';
+import { i18n } from '@kbn/i18n';
+import { find } from 'lodash';
+import { ElasticsearchTemplate } from './elasticsearch_template';
+import { useKibana } from '../../../../../../../src/plugins/kibana_react/public';
+import { GlobalStateContext } from '../../global_state_context';
+import { ElasticsearchIndices } from '../../../components/elasticsearch';
+import { ComponentProps } from '../../route_init';
+import { SetupModeRenderer } from '../../setup_mode/setup_mode_renderer';
+import { SetupModeContext } from '../../../components/setup_mode/setup_mode_context';
+import { useTable } from '../../hooks/use_table';
+import { useLocalStorage } from '../../hooks/use_local_storage';
+
+interface SetupModeProps {
+  setupMode: any;
+  flyoutComponent: any;
+  bottomBarComponent: any;
+}
+
+export const ElasticsearchIndicesPage: React.FC<ComponentProps> = ({ clusters }) => {
+  const globalState = useContext(GlobalStateContext);
+  const { services } = useKibana<{ data: any }>();
+  const { getPaginationTableProps } = useTable('elasticsearch.indices');
+  const clusterUuid = globalState.cluster_uuid;
+  const cluster = find(clusters, {
+    cluster_uuid: clusterUuid,
+  });
+  const [data, setData] = useState({} as any);
+  const [showSystemIndices, setShowSystemIndices] = useLocalStorage<boolean>(
+    'showSystemIndices',
+    false
+  );
+
+  const title = i18n.translate('xpack.monitoring.elasticsearch.indices.routeTitle', {
+    defaultMessage: 'Elasticsearch - Indices',
+  });
+
+  const pageTitle = i18n.translate('xpack.monitoring.elasticsearch.indices.pageTitle', {
+    defaultMessage: 'Elasticsearch indices',
+  });
+
+  const toggleShowSystemIndices = useCallback(
+    () => setShowSystemIndices(!showSystemIndices),
+    [showSystemIndices, setShowSystemIndices]
+  );
+
+  const getPageData = useCallback(async () => {
+    const bounds = services.data?.query.timefilter.timefilter.getBounds();
+    const url = `../api/monitoring/v1/clusters/${clusterUuid}/elasticsearch/indices`;
+    const response = await services.http?.fetch(url, {
+      method: 'POST',
+      query: {
+        show_system_indices: showSystemIndices,
+      },
+      body: JSON.stringify({
+        timeRange: {
+          min: bounds.min.toISOString(),
+          max: bounds.max.toISOString(),
+        },
+      }),
+    });
+    setData(response);
+  }, [showSystemIndices, clusterUuid, services.data?.query.timefilter.timefilter, services.http]);
+
+  return (
+    <ElasticsearchTemplate
+      title={title}
+      pageTitle={pageTitle}
+      getPageData={getPageData}
+      data-test-subj="elasticsearchOverviewPage"
+      cluster={cluster}
+    >
+      <div data-test-subj="elasticsearchNodesListingPage">
+        <SetupModeRenderer
+          render={({ flyoutComponent, bottomBarComponent }: SetupModeProps) => (
+            <SetupModeContext.Provider value={{ setupModeSupported: true }}>
+              {flyoutComponent}
+              <ElasticsearchIndices
+                clusterStatus={data.clusterStatus}
+                indices={data.indices}
+                alerts={{}}
+                showSystemIndices={showSystemIndices}
+                toggleShowSystemIndices={toggleShowSystemIndices}
+                {...getPaginationTableProps()}
+              />
+              {bottomBarComponent}
+            </SetupModeContext.Provider>
+          )}
+        />
+      </div>
+    </ElasticsearchTemplate>
+  );
+};
diff --git a/x-pack/plugins/monitoring/public/components/elasticsearch/index.d.ts b/x-pack/plugins/monitoring/public/components/elasticsearch/index.d.ts
index 5aa2854e3631ce..434115df0762c8 100644
--- a/x-pack/plugins/monitoring/public/components/elasticsearch/index.d.ts
+++ b/x-pack/plugins/monitoring/public/components/elasticsearch/index.d.ts
@@ -7,4 +7,5 @@
 
 export const ElasticsearchOverview: FunctionComponent<Props>;
 export const ElasticsearchNodes: FunctionComponent<Props>;
+export const ElasticsearchIndices: FunctionComponent<Props>;
 export const NodeReact: FunctionComponent<Props>;
diff --git a/x-pack/plugins/observability/common/index.ts b/x-pack/plugins/observability/common/index.ts
index baa3d92ffeeb3b..bfb2eedf6deb2a 100644
--- a/x-pack/plugins/observability/common/index.ts
+++ b/x-pack/plugins/observability/common/index.ts
@@ -6,6 +6,7 @@
  */
 
 export type { AsDuration, AsPercent } from './utils/formatters';
+export { enableInspectEsQueries, maxSuggestions } from './ui_settings_keys';
 
 export const casesFeatureId = 'observabilityCases';
 
diff --git a/x-pack/plugins/observability/common/ui_settings_keys.ts b/x-pack/plugins/observability/common/ui_settings_keys.ts
index bd536474882565..69eb507328719e 100644
--- a/x-pack/plugins/observability/common/ui_settings_keys.ts
+++ b/x-pack/plugins/observability/common/ui_settings_keys.ts
@@ -6,3 +6,4 @@
  */
 
 export const enableInspectEsQueries = 'observability:enableInspectEsQueries';
+export const maxSuggestions = 'observability:maxSuggestions';
diff --git a/x-pack/plugins/observability/dev_docs/feature_flags.md b/x-pack/plugins/observability/dev_docs/feature_flags.md
new file mode 100644
index 00000000000000..56c0e468138274
--- /dev/null
+++ b/x-pack/plugins/observability/dev_docs/feature_flags.md
@@ -0,0 +1,16 @@
+## Feature flags and advanced settings
+
+To set up a flagged feature or other advanced setting, add the name of the feature key (`observability:myFeature`) to [common/ui_settings_keys.ts](../common/ui_settings_keys.ts) and the feature parameters to [server/ui_settings.ts](../server/ui_settings.ts).
+
+Test for the feature like:
+
+```js
+import { myFeatureEnabled } from '../ui_settings_keys';
+if (core.uiSettings.get(myFeatureEnabled)) {
+  doStuff();
+}
+```
+
+In order for telemetry to be collected, the keys and types need to be added in [src/plugins/kibana_usage_collection/server/collectors/management/schema.ts](../../../../src/plugins/kibana_usage_collection/server/collectors/management/schema.ts) and [src/plugins/kibana_usage_collection/server/collectors/management/types.ts](../../../../src/plugins/kibana_usage_collection/server/collectors/management/types.ts).
+
+Settings can be managed in Kibana under Stack Management > Advanced Settings > Observability.
diff --git a/x-pack/plugins/observability/server/ui_settings.ts b/x-pack/plugins/observability/server/ui_settings.ts
index a8dab0fef8f5f0..0bd9f99b5b1454 100644
--- a/x-pack/plugins/observability/server/ui_settings.ts
+++ b/x-pack/plugins/observability/server/ui_settings.ts
@@ -9,16 +9,16 @@ import { schema } from '@kbn/config-schema';
 import { i18n } from '@kbn/i18n';
 import { UiSettingsParams } from '../../../../src/core/types';
 import { observabilityFeatureId } from '../common';
-import { enableInspectEsQueries } from '../common/ui_settings_keys';
+import { enableInspectEsQueries, maxSuggestions } from '../common/ui_settings_keys';
 
 /**
  * uiSettings definitions for Observability.
  */
-export const uiSettings: Record<string, UiSettingsParams<boolean>> = {
+export const uiSettings: Record<string, UiSettingsParams<boolean | number>> = {
   [enableInspectEsQueries]: {
     category: [observabilityFeatureId],
     name: i18n.translate('xpack.observability.enableInspectEsQueriesExperimentName', {
-      defaultMessage: 'inspect ES queries',
+      defaultMessage: 'Inspect ES queries',
     }),
     value: false,
     description: i18n.translate('xpack.observability.enableInspectEsQueriesExperimentDescription', {
@@ -26,4 +26,15 @@ export const uiSettings: Record<string, UiSettingsParams<boolean>> = {
     }),
     schema: schema.boolean(),
   },
+  [maxSuggestions]: {
+    category: [observabilityFeatureId],
+    name: i18n.translate('xpack.observability.maxSuggestionsUiSettingName', {
+      defaultMessage: 'Maximum suggestions',
+    }),
+    value: 100,
+    description: i18n.translate('xpack.observability.maxSuggestionsUiSettingDescription', {
+      defaultMessage: 'Maximum number of suggestions fetched in autocomplete selection boxes.',
+    }),
+    schema: schema.number(),
+  },
 };
diff --git a/x-pack/plugins/osquery/public/scheduled_query_groups/queries/ecs_mapping_editor_field.tsx b/x-pack/plugins/osquery/public/scheduled_query_groups/queries/ecs_mapping_editor_field.tsx
index 9f203d7bf751f5..92f2cfa973ce8d 100644
--- a/x-pack/plugins/osquery/public/scheduled_query_groups/queries/ecs_mapping_editor_field.tsx
+++ b/x-pack/plugins/osquery/public/scheduled_query_groups/queries/ecs_mapping_editor_field.tsx
@@ -6,7 +6,7 @@
  */
 
 import { produce } from 'immer';
-import { find, orderBy, sortedUniqBy, isArray, map } from 'lodash';
+import { isEmpty, find, orderBy, sortedUniqBy, isArray, map } from 'lodash';
 import React, {
   forwardRef,
   useCallback,
@@ -30,7 +30,7 @@ import {
   EuiText,
   EuiIcon,
 } from '@elastic/eui';
-import { Parser, Select } from 'node-sql-parser';
+import sqlParser from 'js-sql-parser';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
 import styled from 'styled-components';
@@ -615,47 +615,65 @@ export const ECSMappingEditorField = ({ field, query, fieldRef }: ECSMappingEdit
         return currentValue;
       }
 
-      const parser = new Parser();
-      let ast: Select;
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      let ast: Record<string, any> | undefined;
 
       try {
-        const parsedQuery = parser.astify(query);
-        ast = (isArray(parsedQuery) ? parsedQuery[0] : parsedQuery) as Select;
+        ast = sqlParser.parse(query)?.value;
       } catch (e) {
         return currentValue;
       }
 
-      const tablesOrderMap = ast?.from?.reduce((acc, table, index) => {
-        acc[table.as ?? table.table] = index;
-        return acc;
-      }, {});
-
-      const astOsqueryTables: Record<string, OsqueryColumn[]> = ast?.from?.reduce((acc, table) => {
-        const osqueryTable = find(osquerySchema, ['name', table.table]);
-
-        if (osqueryTable) {
-          acc[table.as ?? table.table] = osqueryTable.columns;
-        }
+      const tablesOrderMap =
+        ast?.from?.value?.reduce(
+          (
+            acc: { [x: string]: number },
+            table: { value: { alias?: { value: string }; value: { value: string } } },
+            index: number
+          ) => {
+            acc[table.value.alias?.value ?? table.value.value.value] = index;
+            return acc;
+          },
+          {}
+        ) ?? {};
+
+      const astOsqueryTables: Record<string, OsqueryColumn[]> =
+        ast?.from?.value?.reduce(
+          (
+            acc: { [x: string]: OsqueryColumn[] },
+            table: { value: { alias?: { value: string }; value: { value: string } } }
+          ) => {
+            const osqueryTable = find(osquerySchema, ['name', table.value.value.value]);
+
+            if (osqueryTable) {
+              acc[table.value.alias?.value ?? table.value.value.value] = osqueryTable.columns;
+            }
 
-        return acc;
-      }, {});
+            return acc;
+          },
+          {}
+        ) ?? {};
 
       // Table doesn't exist in osquery schema
-      if (
-        !isArray(ast?.columns) &&
-        ast?.columns !== '*' &&
-        !astOsqueryTables[ast?.from && ast?.from[0].table]
-      ) {
+      if (isEmpty(astOsqueryTables)) {
         return currentValue;
       }
+
       /*
         Simple query
         select * from users;
       */
-      if (ast?.columns === '*' && ast.from?.length && astOsqueryTables[ast.from[0].table]) {
-        const tableName = ast.from[0].as ?? ast.from[0].table;
+      if (
+        ast?.selectItems?.value?.length &&
+        ast?.selectItems?.value[0].value === '*' &&
+        ast.from?.value?.length &&
+        ast?.from.value[0].value?.value?.value &&
+        astOsqueryTables[ast.from.value[0].value.value.value]
+      ) {
+        const tableName =
+          ast.from.value[0].value.alias?.value ?? ast.from.value[0].value.value.value;
 
-        return astOsqueryTables[ast.from[0].table].map((osqueryColumn) => ({
+        return astOsqueryTables[ast.from.value[0].value.value.value].map((osqueryColumn) => ({
           label: osqueryColumn.name,
           value: {
             name: osqueryColumn.name,
@@ -672,39 +690,39 @@ export const ECSMappingEditorField = ({ field, query, fieldRef }: ECSMappingEdit
        select i.*, p.resident_size, p.user_time, p.system_time, time.minutes as counter from osquery_info i, processes p, time where p.pid = i.pid;
       */
       const suggestions =
-        isArray(ast?.columns) &&
-        ast?.columns
-          ?.map((column) => {
-            if (column.expr.column === '*' && astOsqueryTables[column.expr.table]) {
-              return astOsqueryTables[column.expr.table].map((osqueryColumn) => ({
+        isArray(ast?.selectItems?.value) &&
+        ast?.selectItems?.value
+          // @ts-expect-error update types
+          ?.map((selectItem) => {
+            const [table, column] = selectItem.value?.split('.');
+
+            if (column === '*' && astOsqueryTables[table]) {
+              return astOsqueryTables[table].map((osqueryColumn) => ({
                 label: osqueryColumn.name,
                 value: {
                   name: osqueryColumn.name,
                   description: osqueryColumn.description,
-                  table: column.expr.table,
-                  tableOrder: tablesOrderMap[column.expr.table],
+                  table,
+                  tableOrder: tablesOrderMap[table],
                   suggestion_label: `${osqueryColumn.name}`,
                 },
               }));
             }
 
-            if (astOsqueryTables && astOsqueryTables[column.expr.table]) {
-              const osqueryColumn = find(astOsqueryTables[column.expr.table], [
-                'name',
-                column.expr.column,
-              ]);
+            if (astOsqueryTables && astOsqueryTables[table]) {
+              const osqueryColumn = find(astOsqueryTables[table], ['name', column]);
 
               if (osqueryColumn) {
-                const label = column.as ?? column.expr.column;
+                const label = selectItem.hasAs ? selectItem.alias : column;
 
                 return [
                   {
-                    label: column.as ?? column.expr.column,
+                    label,
                     value: {
                       name: osqueryColumn.name,
                       description: osqueryColumn.description,
-                      table: column.expr.table,
-                      tableOrder: tablesOrderMap[column.expr.table],
+                      table,
+                      tableOrder: tablesOrderMap[table],
                       suggestion_label: `${label}`,
                     },
                   },
@@ -718,7 +736,6 @@ export const ECSMappingEditorField = ({ field, query, fieldRef }: ECSMappingEdit
 
       // Remove column duplicates by keeping the column from the table that appears last in the query
       return sortedUniqBy(
-        //  @ts-expect-error update types
         orderBy(suggestions, ['value.suggestion_label', 'value.tableOrder'], ['asc', 'desc']),
         'label'
       );
diff --git a/x-pack/plugins/security_solution/cypress/integration/timelines/creation.spec.ts b/x-pack/plugins/security_solution/cypress/integration/timelines/creation.spec.ts
index 096ac0595d76c9..6b86957c78e6ef 100644
--- a/x-pack/plugins/security_solution/cypress/integration/timelines/creation.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/timelines/creation.spec.ts
@@ -12,8 +12,10 @@ import {
   NOTES_TEXT,
   PIN_EVENT,
   SERVER_SIDE_EVENT_COUNT,
+  TIMELINE_DESCRIPTION,
   TIMELINE_FILTER,
   TIMELINE_FLYOUT_WRAPPER,
+  TIMELINE_QUERY,
   TIMELINE_PANEL,
   TIMELINE_TAB_CONTENT_EQL,
   TIMELINE_TAB_CONTENT_GRAPHS_NOTES,
@@ -124,19 +126,11 @@ describe('Create a timeline from a template', () => {
       cy.intercept('/api/timeline').as('timeline');
 
       clickingOnCreateTimelineFormTemplateBtn();
-      cy.wait('@timeline', { timeout: 100000 }).then(({ request }) => {
-        if (request.body && request.body.timeline) {
-          expect(request.body.timeline).to.haveOwnProperty(
-            'description',
-            getTimeline().description
-          );
-          expect(request.body.timeline.kqlQuery.filterQuery.kuery).to.haveOwnProperty(
-            'expression',
-            getTimeline().query
-          );
-          cy.get(TIMELINE_FLYOUT_WRAPPER).should('have.css', 'visibility', 'visible');
-        }
-      });
+      cy.wait('@timeline', { timeout: 100000 });
+
+      cy.get(TIMELINE_FLYOUT_WRAPPER).should('have.css', 'visibility', 'visible');
+      cy.get(TIMELINE_DESCRIPTION).should('have.text', getTimeline().description);
+      cy.get(TIMELINE_QUERY).should('have.text', getTimeline().query);
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts b/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts
index 0e81f75a190465..7d2116cff7bfb6 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts
@@ -45,6 +45,7 @@ import {
   RULE_DETAILS_DELETE_BTN,
 } from '../screens/alerts_detection_rules';
 import { ALL_ACTIONS, DELETE_RULE } from '../screens/rule_details';
+import { LOADING_INDICATOR } from '../screens/security_header';
 
 export const activateRule = (rulePosition: number) => {
   cy.get(RULE_SWITCH).eq(rulePosition).click({ force: true });
@@ -71,7 +72,7 @@ export const duplicateFirstRule = () => {
  * flake.
  */
 export const duplicateRuleFromMenu = () => {
-  cy.get(ALL_ACTIONS).should('be.visible');
+  cy.get(LOADING_INDICATOR).should('not.exist');
   cy.root()
     .pipe(($el) => {
       $el.find(ALL_ACTIONS).trigger('click');
diff --git a/x-pack/plugins/security_solution/public/common/utils/validators/index.test.ts b/x-pack/plugins/security_solution/public/common/utils/validators/index.test.ts
index 2eebb1723ea1fc..2758a9724e8979 100644
--- a/x-pack/plugins/security_solution/public/common/utils/validators/index.test.ts
+++ b/x-pack/plugins/security_solution/public/common/utils/validators/index.test.ts
@@ -9,12 +9,40 @@ import { isUrlInvalid } from '.';
 
 describe('helpers', () => {
   describe('isUrlInvalid', () => {
-    test('verifies invalid url', () => {
+    test('should verify invalid url', () => {
       expect(isUrlInvalid('this is not a url')).toBeTruthy();
     });
 
+    test('should verify as invalid url without http(s):// prefix', () => {
+      expect(isUrlInvalid('www.thisIsNotValid.com')).toBeTruthy();
+    });
+
     test('verifies valid url', () => {
       expect(isUrlInvalid('https://www.elastic.co/')).toBeFalsy();
     });
+
+    test('should verify valid wwww such as 4 of them.', () => {
+      expect(isUrlInvalid('https://wwww.example.com')).toBeFalsy();
+    });
+
+    test('should validate characters such as %22 being part of a correct URL.', () => {
+      expect(isUrlInvalid('https://www.exam%22ple.com')).toBeFalsy();
+    });
+
+    test('should validate characters incorrectly such as ]', () => {
+      expect(isUrlInvalid('https://www.example.com[')).toBeTruthy();
+    });
+
+    test('should verify valid http url', () => {
+      expect(isUrlInvalid('http://www.example.com/')).toBeFalsy();
+    });
+
+    test('should verify as valid when given an empty string', () => {
+      expect(isUrlInvalid('')).toBeFalsy();
+    });
+
+    test('empty spaces should valid as not valid ', () => {
+      expect(isUrlInvalid(' ')).toBeTruthy();
+    });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/common/utils/validators/index.ts b/x-pack/plugins/security_solution/public/common/utils/validators/index.ts
index 6d85e1fdd981ea..7f0e8c30177f8f 100644
--- a/x-pack/plugins/security_solution/public/common/utils/validators/index.ts
+++ b/x-pack/plugins/security_solution/public/common/utils/validators/index.ts
@@ -5,16 +5,24 @@
  * 2.0.
  */
 
-import { isEmpty } from 'lodash/fp';
-
 export * from './is_endpoint_host_isolated';
 
-const urlExpression =
-  /(https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9]+\.[^\s]{2,}|www\.[a-zA-Z0-9]+\.[^\s]{2,})/gi;
+const allowedSchemes = ['http:', 'https:'];
 
 export const isUrlInvalid = (url: string | null | undefined) => {
-  if (!isEmpty(url) && url != null && url.match(urlExpression) == null) {
-    return true;
+  try {
+    if (url != null) {
+      if (url === '') {
+        return false;
+      } else {
+        const urlParsed = new URL(url);
+        if (allowedSchemes.includes(urlParsed.protocol)) {
+          return false;
+        }
+      }
+    }
+  } catch (error) {
+    // intentionally left empty
   }
-  return false;
+  return true;
 };
diff --git a/x-pack/plugins/security_solution/public/management/components/artifact_entry_card/artifact_entry_card.test.tsx b/x-pack/plugins/security_solution/public/management/components/artifact_entry_card/artifact_entry_card.test.tsx
index e6e4bb0c2643cd..31e49aef0ac197 100644
--- a/x-pack/plugins/security_solution/public/management/components/artifact_entry_card/artifact_entry_card.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/components/artifact_entry_card/artifact_entry_card.test.tsx
@@ -6,53 +6,12 @@
  */
 
 import React from 'react';
-import { cloneDeep } from 'lodash';
 import { AppContextTestRender, createAppRootMockRenderer } from '../../../common/mock/endpoint';
 import { ArtifactEntryCard, ArtifactEntryCardProps } from './artifact_entry_card';
-import { TrustedAppGenerator } from '../../../../common/endpoint/data_generators/trusted_app_generator';
 import { act, fireEvent, getByTestId } from '@testing-library/react';
-import { getExceptionListItemSchemaMock } from '../../../../../lists/common/schemas/response/exception_list_item_schema.mock';
 import { AnyArtifact } from './types';
 import { isTrustedApp } from './hooks/use_normalized_artifact';
-
-const getCommonItemDataOverrides = () => {
-  return {
-    name: 'some internal app',
-    description: 'this app is trusted by the company',
-    created_at: new Date('2021-07-01').toISOString(),
-  };
-};
-
-const getTrustedAppProvider = () =>
-  new TrustedAppGenerator('seed').generate(getCommonItemDataOverrides());
-
-const getExceptionProvider = () => {
-  // cloneDeep needed because exception mock generator uses state across instances
-  return cloneDeep(
-    getExceptionListItemSchemaMock({
-      ...getCommonItemDataOverrides(),
-      os_types: ['windows'],
-      updated_at: new Date().toISOString(),
-      created_by: 'Justa',
-      updated_by: 'Mara',
-      entries: [
-        {
-          field: 'process.hash.*',
-          operator: 'included',
-          type: 'match',
-          value: '1234234659af249ddf3e40864e9fb241',
-        },
-        {
-          field: 'process.executable.caseless',
-          operator: 'included',
-          type: 'match',
-          value: '/one/two/three',
-        },
-      ],
-      tags: ['policy:all'],
-    })
-  );
-};
+import { getTrustedAppProvider, getExceptionProvider } from './test_utils';
 
 describe.each([
   ['trusted apps', getTrustedAppProvider],
diff --git a/x-pack/plugins/security_solution/public/management/components/artifact_entry_card/artifact_entry_card_minified.test.tsx b/x-pack/plugins/security_solution/public/management/components/artifact_entry_card/artifact_entry_card_minified.test.tsx
new file mode 100644
index 00000000000000..1178e4b07e5bdb
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/components/artifact_entry_card/artifact_entry_card_minified.test.tsx
@@ -0,0 +1,98 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { AppContextTestRender, createAppRootMockRenderer } from '../../../common/mock/endpoint';
+import {
+  ArtifactEntryCardMinified,
+  ArtifactEntryCardMinifiedProps,
+} from './artifact_entry_card_minified';
+import { act, fireEvent } from '@testing-library/react';
+import { AnyArtifact } from './types';
+import { getTrustedAppProvider, getExceptionProvider } from './test_utils';
+
+describe.each([
+  ['trusted apps', getTrustedAppProvider],
+  ['exceptions/event filters', getExceptionProvider],
+])('when using the ArtifactEntryCardMinified component with %s', (_, generateItem) => {
+  let item: AnyArtifact;
+  let appTestContext: AppContextTestRender;
+  let renderResult: ReturnType<AppContextTestRender['render']>;
+  let render: (props: ArtifactEntryCardMinifiedProps) => ReturnType<AppContextTestRender['render']>;
+  let onToggleSelectedArtifactMock: jest.Mock;
+
+  beforeEach(() => {
+    onToggleSelectedArtifactMock = jest.fn();
+    item = generateItem();
+    appTestContext = createAppRootMockRenderer();
+    render = (props) => {
+      renderResult = appTestContext.render(
+        <ArtifactEntryCardMinified
+          {...{
+            'data-test-subj': 'testCard',
+            ...props,
+          }}
+        />
+      );
+      return renderResult;
+    };
+  });
+
+  it('should display title', async () => {
+    render({ item, isSelected: false, onToggleSelectedArtifact: onToggleSelectedArtifactMock });
+
+    expect(renderResult.getByTestId('testCard-title').textContent).toEqual('some internal app');
+  });
+
+  it('should display description if one exists', async () => {
+    render({ item, isSelected: false, onToggleSelectedArtifact: onToggleSelectedArtifactMock });
+
+    expect(renderResult.getByTestId('testCard-description').textContent).toEqual(item.description);
+  });
+
+  it('should display default empty value if description does not exist', async () => {
+    item.description = undefined;
+    render({ item, isSelected: false, onToggleSelectedArtifact: onToggleSelectedArtifactMock });
+
+    expect(renderResult.getByTestId('testCard-description').textContent).toEqual('—');
+  });
+
+  it('should collapse/uncollapse critera conditions', async () => {
+    render({ item, isSelected: false, onToggleSelectedArtifact: onToggleSelectedArtifactMock });
+
+    expect(renderResult.getByTestId('testCard-collapse').textContent).toEqual('Show details');
+    await act(async () => {
+      await fireEvent.click(renderResult.getByTestId('testCard-collapse'));
+    });
+    expect(renderResult.getByTestId('testCard-criteriaConditions').textContent).toEqual(
+      ' OSIS WindowsAND process.hash.*IS 1234234659af249ddf3e40864e9fb241AND process.executable.caselessIS /one/two/three'
+    );
+    expect(renderResult.getByTestId('testCard-collapse').textContent).toEqual('Hide details');
+  });
+
+  it('should select artifact when unselected by default', async () => {
+    render({ item, isSelected: false, onToggleSelectedArtifact: onToggleSelectedArtifactMock });
+
+    expect(onToggleSelectedArtifactMock).toHaveBeenCalledTimes(0);
+    await act(async () => {
+      await fireEvent.click(renderResult.getByTestId(`${item.name}_checkbox`));
+    });
+    expect(onToggleSelectedArtifactMock).toHaveBeenCalledTimes(1);
+    expect(onToggleSelectedArtifactMock).toHaveBeenCalledWith(true);
+  });
+
+  it('should select artifact when selected by default', async () => {
+    render({ item, isSelected: true, onToggleSelectedArtifact: onToggleSelectedArtifactMock });
+
+    expect(onToggleSelectedArtifactMock).toHaveBeenCalledTimes(0);
+    await act(async () => {
+      await fireEvent.click(renderResult.getByTestId(`${item.name}_checkbox`));
+    });
+    expect(onToggleSelectedArtifactMock).toHaveBeenCalledTimes(1);
+    expect(onToggleSelectedArtifactMock).toHaveBeenCalledWith(false);
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/management/components/artifact_entry_card/artifact_entry_card_minified.tsx b/x-pack/plugins/security_solution/public/management/components/artifact_entry_card/artifact_entry_card_minified.tsx
new file mode 100644
index 00000000000000..5fb53e44a0ba78
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/components/artifact_entry_card/artifact_entry_card_minified.tsx
@@ -0,0 +1,143 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { memo, useCallback, useState, useMemo } from 'react';
+import {
+  CommonProps,
+  EuiPanel,
+  EuiText,
+  EuiAccordion,
+  EuiTitle,
+  EuiCheckbox,
+  EuiSplitPanel,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiButtonEmpty,
+} from '@elastic/eui';
+import styled from 'styled-components';
+import { getEmptyValue } from '../../../common/components/empty_value';
+import { CriteriaConditions, CriteriaConditionsProps } from './components/criteria_conditions';
+import { AnyArtifact } from './types';
+import { useNormalizedArtifact } from './hooks/use_normalized_artifact';
+import { useTestIdGenerator } from '../hooks/use_test_id_generator';
+
+const CardContainerPanel = styled(EuiSplitPanel.Outer)`
+  &.artifactEntryCardMinified + &.artifactEntryCardMinified {
+    margin-top: ${({ theme }) => theme.eui.spacerSizes.l};
+  }
+`;
+
+const CustomSplitInnerPanel = styled(EuiSplitPanel.Inner)`
+  background-color: ${({ theme }) => theme.eui.euiColorLightestShade} !important;
+`;
+
+export interface ArtifactEntryCardMinifiedProps extends CommonProps {
+  item: AnyArtifact;
+  isSelected: boolean;
+  onToggleSelectedArtifact: (selected: boolean) => void;
+}
+
+/**
+ * Display Artifact Items (ex. Trusted App, Event Filter, etc) as a minified card.
+ * This component is a TS Generic that allows you to set what the Item type is
+ */
+export const ArtifactEntryCardMinified = memo(
+  ({
+    item,
+    isSelected = false,
+    onToggleSelectedArtifact,
+    'data-test-subj': dataTestSubj,
+    ...commonProps
+  }: ArtifactEntryCardMinifiedProps) => {
+    const artifact = useNormalizedArtifact(item);
+    const getTestId = useTestIdGenerator(dataTestSubj);
+
+    const [accordionTrigger, setAccordionTrigger] = useState<'open' | 'closed'>('closed');
+
+    const handleOnToggleAccordion = useCallback(() => {
+      setAccordionTrigger((current) => (current === 'closed' ? 'open' : 'closed'));
+    }, []);
+
+    const getAccordionTitle = useCallback(
+      () => (accordionTrigger === 'open' ? 'Hide details' : 'Show details'),
+      [accordionTrigger]
+    );
+
+    const cardTitle = useMemo(
+      () => (
+        <CustomSplitInnerPanel>
+          <EuiFlexGroup alignItems="center" gutterSize="s">
+            <EuiFlexItem grow={false}>
+              <EuiCheckbox
+                id={artifact.name}
+                data-test-subj={`${artifact.name}_checkbox`}
+                checked={isSelected}
+                onChange={() => onToggleSelectedArtifact(!isSelected)}
+              />
+            </EuiFlexItem>
+            <EuiFlexItem>
+              <EuiTitle size="xxs">
+                <h5 data-test-subj={getTestId('title')}>{artifact.name}</h5>
+              </EuiTitle>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </CustomSplitInnerPanel>
+      ),
+      [artifact.name, getTestId, isSelected, onToggleSelectedArtifact]
+    );
+
+    return (
+      <CardContainerPanel
+        {...commonProps}
+        data-test-subj={dataTestSubj}
+        className={`${commonProps.className ?? ''}  artifactEntryCardMinified`}
+        id={artifact.name}
+        hasShadow={false}
+        hasBorder
+      >
+        {cardTitle}
+        <EuiSplitPanel.Inner paddingSize="s">
+          <EuiPanel hasBorder={false} hasShadow={false} paddingSize="s">
+            <EuiTitle size="xxs">
+              <h5 data-test-subj={getTestId('descriptionTitle')}>{'Description'}</h5>
+            </EuiTitle>
+            <EuiText>
+              <p data-test-subj={getTestId('description')}>
+                {artifact.description || getEmptyValue()}
+              </p>
+            </EuiText>
+          </EuiPanel>
+
+          <EuiPanel hasBorder={false} hasShadow={false} paddingSize="s">
+            <EuiButtonEmpty
+              data-test-subj={getTestId('collapse')}
+              color="primary"
+              size="s"
+              flush="left"
+              iconType={accordionTrigger === 'open' ? 'arrowUp' : 'arrowDown'}
+              iconSide="right"
+              iconSize="m"
+              onClick={handleOnToggleAccordion}
+              style={{ fontWeight: 400 }}
+            >
+              {getAccordionTitle()}
+            </EuiButtonEmpty>
+            <EuiAccordion id="showDetails" arrowDisplay="none" forceState={accordionTrigger}>
+              <CriteriaConditions
+                os={artifact.os as CriteriaConditionsProps['os']}
+                entries={artifact.entries}
+                data-test-subj={getTestId('criteriaConditions')}
+              />
+            </EuiAccordion>
+          </EuiPanel>
+        </EuiSplitPanel.Inner>
+      </CardContainerPanel>
+    );
+  }
+);
+
+ArtifactEntryCardMinified.displayName = 'ArtifactEntryCardMinified';
diff --git a/x-pack/plugins/security_solution/public/management/components/artifact_entry_card/index.ts b/x-pack/plugins/security_solution/public/management/components/artifact_entry_card/index.ts
index 58c0e160f760db..f37d5d4e650e19 100644
--- a/x-pack/plugins/security_solution/public/management/components/artifact_entry_card/index.ts
+++ b/x-pack/plugins/security_solution/public/management/components/artifact_entry_card/index.ts
@@ -6,3 +6,4 @@
  */
 
 export * from './artifact_entry_card';
+export * from './artifact_entry_card_minified';
diff --git a/x-pack/plugins/security_solution/public/management/components/artifact_entry_card/test_utils.ts b/x-pack/plugins/security_solution/public/management/components/artifact_entry_card/test_utils.ts
new file mode 100644
index 00000000000000..219fa6a8f39b10
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/components/artifact_entry_card/test_utils.ts
@@ -0,0 +1,49 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { cloneDeep } from 'lodash';
+import { TrustedAppGenerator } from '../../../../common/endpoint/data_generators/trusted_app_generator';
+import { getExceptionListItemSchemaMock } from '../../../../../lists/common/schemas/response/exception_list_item_schema.mock';
+
+export const getCommonItemDataOverrides = () => {
+  return {
+    name: 'some internal app',
+    description: 'this app is trusted by the company',
+    created_at: new Date('2021-07-01').toISOString(),
+  };
+};
+
+export const getTrustedAppProvider = () =>
+  new TrustedAppGenerator('seed').generate(getCommonItemDataOverrides());
+
+export const getExceptionProvider = () => {
+  // cloneDeep needed because exception mock generator uses state across instances
+  return cloneDeep(
+    getExceptionListItemSchemaMock({
+      ...getCommonItemDataOverrides(),
+      os_types: ['windows'],
+      updated_at: new Date().toISOString(),
+      created_by: 'Justa',
+      updated_by: 'Mara',
+      entries: [
+        {
+          field: 'process.hash.*',
+          operator: 'included',
+          type: 'match',
+          value: '1234234659af249ddf3e40864e9fb241',
+        },
+        {
+          field: 'process.executable.caseless',
+          operator: 'included',
+          type: 'match',
+          value: '/one/two/three',
+        },
+      ],
+      tags: ['policy:all'],
+    })
+  );
+};
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/action/policy_trusted_apps_action.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/action/policy_trusted_apps_action.ts
index 46e0f8293cc33f..c7bc142eb78c57 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/action/policy_trusted_apps_action.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/action/policy_trusted_apps_action.ts
@@ -5,9 +5,41 @@
  * 2.0.
  */
 
-// TODO: defined trusted apps actions (code below only here to silence TS)
+import { AsyncResourceState } from '../../../../../state';
+import {
+  PostTrustedAppCreateResponse,
+  GetTrustedListAppsResponse,
+} from '../../../../../../../common/endpoint/types';
+export interface PolicyArtifactsAssignableListPageDataChanged {
+  type: 'policyArtifactsAssignableListPageDataChanged';
+  payload: AsyncResourceState<GetTrustedListAppsResponse>;
+}
+
+export interface PolicyArtifactsUpdateTrustedApps {
+  type: 'policyArtifactsUpdateTrustedApps';
+  payload: {
+    trustedAppIds: string[];
+  };
+}
+
+export interface PolicyArtifactsUpdateTrustedAppsChanged {
+  type: 'policyArtifactsUpdateTrustedAppsChanged';
+  payload: AsyncResourceState<PostTrustedAppCreateResponse[]>;
+}
+
+export interface PolicyArtifactsAssignableListExistDataChanged {
+  type: 'policyArtifactsAssignableListExistDataChanged';
+  payload: AsyncResourceState<boolean>;
+}
+
+export interface PolicyArtifactsAssignableListPageDataFilter {
+  type: 'policyArtifactsAssignableListPageDataFilter';
+  payload: { filter: string };
+}
+
 export type PolicyTrustedAppsAction =
-  | {
-      type: 'a';
-    }
-  | { type: 'b' };
+  | PolicyArtifactsAssignableListPageDataChanged
+  | PolicyArtifactsUpdateTrustedApps
+  | PolicyArtifactsUpdateTrustedAppsChanged
+  | PolicyArtifactsAssignableListExistDataChanged
+  | PolicyArtifactsAssignableListPageDataFilter;
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware/policy_trusted_apps_middleware.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware/policy_trusted_apps_middleware.ts
index 171bbd881302e2..532e39b4824013 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware/policy_trusted_apps_middleware.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware/policy_trusted_apps_middleware.ts
@@ -5,12 +5,208 @@
  * 2.0.
  */
 
-import { MiddlewareRunner } from '../../../types';
+import pMap from 'p-map';
+import { find, isEmpty } from 'lodash/fp';
+import { PolicyDetailsState, MiddlewareRunner } from '../../../types';
+import {
+  policyIdFromParams,
+  isOnPolicyTrustedAppsPage,
+  getCurrentArtifactsLocation,
+  getAssignableArtifactsList,
+} from '../selectors';
+import {
+  ImmutableArray,
+  ImmutableObject,
+  PostTrustedAppCreateRequest,
+  TrustedApp,
+} from '../../../../../../../common/endpoint/types';
+import { ImmutableMiddlewareAPI } from '../../../../../../common/store';
+import { TrustedAppsHttpService, TrustedAppsService } from '../../../../trusted_apps/service';
+import {
+  createLoadedResourceState,
+  createLoadingResourceState,
+  createUninitialisedResourceState,
+  createFailedResourceState,
+} from '../../../../../state';
+import { parseQueryFilterToKQL } from '../../../../../common/utils';
+import { SEARCHABLE_FIELDS } from '../../../../trusted_apps/constants';
+import { PolicyDetailsAction } from '../action';
+
+const checkIfThereAreAssignableTrustedApps = async (
+  store: ImmutableMiddlewareAPI<PolicyDetailsState, PolicyDetailsAction>,
+  trustedAppsService: TrustedAppsService
+) => {
+  const state = store.getState();
+  const policyId = policyIdFromParams(state);
+
+  store.dispatch({
+    type: 'policyArtifactsAssignableListExistDataChanged',
+    // Ignore will be fixed with when AsyncResourceState is refactored (#830)
+    // @ts-ignore
+    payload: createLoadingResourceState({ previousState: createUninitialisedResourceState() }),
+  });
+  try {
+    const trustedApps = await trustedAppsService.getTrustedAppsList({
+      page: 1,
+      per_page: 100,
+      kuery: `(not exception-list-agnostic.attributes.tags:"policy:${policyId}") AND (not exception-list-agnostic.attributes.tags:"policy:all")`,
+    });
+
+    store.dispatch({
+      type: 'policyArtifactsAssignableListExistDataChanged',
+      payload: createLoadedResourceState(!isEmpty(trustedApps.data)),
+    });
+  } catch (err) {
+    store.dispatch({
+      type: 'policyArtifactsAssignableListExistDataChanged',
+      // Ignore will be fixed with when AsyncResourceState is refactored (#830)
+      // @ts-ignore
+      payload: createFailedResourceState(err.body ?? err),
+    });
+  }
+};
+
+const searchTrustedApps = async (
+  store: ImmutableMiddlewareAPI<PolicyDetailsState, PolicyDetailsAction>,
+  trustedAppsService: TrustedAppsService,
+  filter?: string
+) => {
+  const state = store.getState();
+  const policyId = policyIdFromParams(state);
+
+  store.dispatch({
+    type: 'policyArtifactsAssignableListPageDataChanged',
+    // Ignore will be fixed with when AsyncResourceState is refactored (#830)
+    // @ts-ignore
+    payload: createLoadingResourceState({ previousState: createUninitialisedResourceState() }),
+  });
+
+  try {
+    const kuery = [
+      `(not exception-list-agnostic.attributes.tags:"policy:${policyId}") AND (not exception-list-agnostic.attributes.tags:"policy:all")`,
+    ];
+
+    if (filter) {
+      const filterKuery = parseQueryFilterToKQL(filter, SEARCHABLE_FIELDS) || undefined;
+      if (filterKuery) kuery.push(filterKuery);
+    }
+
+    const trustedApps = await trustedAppsService.getTrustedAppsList({
+      page: 1,
+      per_page: 100,
+      kuery: kuery.join(' AND '),
+    });
+
+    store.dispatch({
+      type: 'policyArtifactsAssignableListPageDataChanged',
+      payload: createLoadedResourceState(trustedApps),
+    });
+
+    if (isEmpty(trustedApps.data)) {
+      checkIfThereAreAssignableTrustedApps(store, trustedAppsService);
+    }
+  } catch (err) {
+    store.dispatch({
+      type: 'policyArtifactsAssignableListPageDataChanged',
+      // Ignore will be fixed with when AsyncResourceState is refactored (#830)
+      // @ts-ignore
+      payload: createFailedResourceState(err.body ?? err),
+    });
+  }
+};
+
+interface UpdateTrustedAppWrapperProps {
+  entry: ImmutableObject<TrustedApp>;
+  policies: ImmutableArray<string>;
+}
+
+const updateTrustedApps = async (
+  store: ImmutableMiddlewareAPI<PolicyDetailsState, PolicyDetailsAction>,
+  trustedAppsService: TrustedAppsService,
+  trustedAppsIds: ImmutableArray<string>
+) => {
+  const state = store.getState();
+  const policyId = policyIdFromParams(state);
+  const availavleArtifacts = getAssignableArtifactsList(state);
+
+  if (!availavleArtifacts || !availavleArtifacts.data.length) {
+    return;
+  }
+
+  store.dispatch({
+    type: 'policyArtifactsUpdateTrustedAppsChanged',
+    // Ignore will be fixed with when AsyncResourceState is refactored (#830)
+    // @ts-ignore
+    payload: createLoadingResourceState({ previousState: createUninitialisedResourceState() }),
+  });
+
+  try {
+    const trustedAppsUpdateActions = [];
+
+    const updateTrustedApp = async ({ entry, policies }: UpdateTrustedAppWrapperProps) =>
+      trustedAppsService.updateTrustedApp({ id: entry.id }, {
+        effectScope: { type: 'policy', policies: [...policies, policyId] },
+        name: entry.name,
+        entries: entry.entries,
+        os: entry.os,
+        description: entry.description,
+        version: entry.version,
+      } as PostTrustedAppCreateRequest);
+
+    for (const entryId of trustedAppsIds) {
+      const entry = find({ id: entryId }, availavleArtifacts.data) as ImmutableObject<TrustedApp>;
+      if (entry) {
+        const policies = entry.effectScope.type === 'policy' ? entry.effectScope.policies : [];
+        trustedAppsUpdateActions.push({ entry, policies });
+      }
+    }
+
+    const updatedTrustedApps = await pMap(trustedAppsUpdateActions, updateTrustedApp, {
+      concurrency: 5,
+      /** When set to false, instead of stopping when a promise rejects, it will wait for all the promises to settle
+       * and then reject with an aggregated error containing all the errors from the rejected promises. */
+      stopOnError: false,
+    });
+
+    store.dispatch({
+      type: 'policyArtifactsUpdateTrustedAppsChanged',
+      payload: createLoadedResourceState(updatedTrustedApps),
+    });
+  } catch (err) {
+    store.dispatch({
+      type: 'policyArtifactsUpdateTrustedAppsChanged',
+      // Ignore will be fixed with when AsyncResourceState is refactored (#830)
+      // @ts-ignore
+      payload: createFailedResourceState(err.body ?? err),
+    });
+  }
+};
 
 export const policyTrustedAppsMiddlewareRunner: MiddlewareRunner = async (
   coreStart,
   store,
   action
 ) => {
-  // FIXME: implement middlware for trusted apps
+  const http = coreStart.http;
+  const trustedAppsService = new TrustedAppsHttpService(http);
+  const state = store.getState();
+  if (
+    action.type === 'userChangedUrl' &&
+    isOnPolicyTrustedAppsPage(state) &&
+    getCurrentArtifactsLocation(state).show === 'list'
+  ) {
+    await searchTrustedApps(store, trustedAppsService);
+  } else if (
+    action.type === 'policyArtifactsUpdateTrustedApps' &&
+    isOnPolicyTrustedAppsPage(state) &&
+    getCurrentArtifactsLocation(state).show === 'list'
+  ) {
+    await updateTrustedApps(store, trustedAppsService, action.payload.trustedAppIds);
+  } else if (
+    action.type === 'policyArtifactsAssignableListPageDataFilter' &&
+    isOnPolicyTrustedAppsPage(state) &&
+    getCurrentArtifactsLocation(state).show === 'list'
+  ) {
+    await searchTrustedApps(store, trustedAppsService, action.payload.filter);
+  }
 };
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer/initial_policy_details_state.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer/initial_policy_details_state.ts
index 723f8fe31bd2a7..93108e6f376aed 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer/initial_policy_details_state.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer/initial_policy_details_state.ts
@@ -34,6 +34,8 @@ export const initialPolicyDetailsState: () => Immutable<PolicyDetailsState> = ()
       show: undefined,
       filter: '',
     },
-    availableList: createUninitialisedResourceState(),
+    assignableList: createUninitialisedResourceState(),
+    trustedAppsToUpdate: createUninitialisedResourceState(),
+    assignableListEntriesExist: createUninitialisedResourceState(),
   },
 });
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer/trusted_apps_reducer.test.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer/trusted_apps_reducer.test.ts
new file mode 100644
index 00000000000000..26efcaa68686d5
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer/trusted_apps_reducer.test.ts
@@ -0,0 +1,264 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { PolicyDetailsState } from '../../../types';
+import { initialPolicyDetailsState } from '../reducer/initial_policy_details_state';
+import { policyTrustedAppsReducer } from './trusted_apps_reducer';
+
+import { ImmutableObject } from '../../../../../../../common/endpoint/types';
+import {
+  createLoadedResourceState,
+  createUninitialisedResourceState,
+  createLoadingResourceState,
+  createFailedResourceState,
+} from '../../../../../state';
+import { getMockListResponse, getAPIError, getMockCreateResponse } from '../../../test_utils';
+
+describe('policy trusted apps reducer', () => {
+  let initialState: ImmutableObject<PolicyDetailsState>;
+
+  beforeEach(() => {
+    initialState = initialPolicyDetailsState();
+  });
+
+  describe('PolicyTrustedApps', () => {
+    describe('policyArtifactsAssignableListPageDataChanged', () => {
+      it('sets assignable list uninitialised', () => {
+        const result = policyTrustedAppsReducer(initialState, {
+          type: 'policyArtifactsAssignableListPageDataChanged',
+          payload: createUninitialisedResourceState(),
+        });
+
+        expect(result).toStrictEqual({
+          ...initialState,
+          artifacts: {
+            ...initialState.artifacts,
+            assignableList: {
+              type: 'UninitialisedResourceState',
+            },
+          },
+        });
+      });
+      it('sets assignable list loading', () => {
+        const result = policyTrustedAppsReducer(initialState, {
+          type: 'policyArtifactsAssignableListPageDataChanged',
+          payload: createLoadingResourceState(createUninitialisedResourceState()),
+        });
+
+        expect(result).toStrictEqual({
+          ...initialState,
+          artifacts: {
+            ...initialState.artifacts,
+            assignableList: {
+              previousState: {
+                type: 'UninitialisedResourceState',
+              },
+              type: 'LoadingResourceState',
+            },
+          },
+        });
+      });
+      it('sets assignable list loaded', () => {
+        const result = policyTrustedAppsReducer(initialState, {
+          type: 'policyArtifactsAssignableListPageDataChanged',
+          payload: createLoadedResourceState(getMockListResponse()),
+        });
+
+        expect(result).toStrictEqual({
+          ...initialState,
+          artifacts: {
+            ...initialState.artifacts,
+            assignableList: {
+              data: getMockListResponse(),
+              type: 'LoadedResourceState',
+            },
+          },
+        });
+      });
+      it('sets assignable list failed', () => {
+        const result = policyTrustedAppsReducer(initialState, {
+          type: 'policyArtifactsAssignableListPageDataChanged',
+          payload: createFailedResourceState(getAPIError()),
+        });
+
+        expect(result).toStrictEqual({
+          ...initialState,
+          artifacts: {
+            ...initialState.artifacts,
+            assignableList: {
+              type: 'FailedResourceState',
+              error: getAPIError(),
+              lastLoadedState: undefined,
+            },
+          },
+        });
+      });
+    });
+  });
+
+  describe('policyArtifactsUpdateTrustedAppsChanged', () => {
+    it('sets update trusted app uninitialised', () => {
+      const result = policyTrustedAppsReducer(initialState, {
+        type: 'policyArtifactsUpdateTrustedAppsChanged',
+        payload: createUninitialisedResourceState(),
+      });
+
+      expect(result).toStrictEqual({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          trustedAppsToUpdate: {
+            type: 'UninitialisedResourceState',
+          },
+        },
+      });
+    });
+    it('sets update trusted app loading', () => {
+      const result = policyTrustedAppsReducer(initialState, {
+        type: 'policyArtifactsUpdateTrustedAppsChanged',
+        payload: createLoadingResourceState(createUninitialisedResourceState()),
+      });
+
+      expect(result).toStrictEqual({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          trustedAppsToUpdate: {
+            previousState: {
+              type: 'UninitialisedResourceState',
+            },
+            type: 'LoadingResourceState',
+          },
+        },
+      });
+    });
+    it('sets update trusted app loaded', () => {
+      const result = policyTrustedAppsReducer(initialState, {
+        type: 'policyArtifactsUpdateTrustedAppsChanged',
+        payload: createLoadedResourceState([getMockCreateResponse()]),
+      });
+
+      expect(result).toStrictEqual({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          trustedAppsToUpdate: {
+            data: [getMockCreateResponse()],
+            type: 'LoadedResourceState',
+          },
+        },
+      });
+    });
+    it('sets update trusted app failed', () => {
+      const result = policyTrustedAppsReducer(initialState, {
+        type: 'policyArtifactsUpdateTrustedAppsChanged',
+        payload: createFailedResourceState(getAPIError()),
+      });
+
+      expect(result).toStrictEqual({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          trustedAppsToUpdate: {
+            type: 'FailedResourceState',
+            error: getAPIError(),
+            lastLoadedState: undefined,
+          },
+        },
+      });
+    });
+  });
+
+  describe('policyArtifactsAssignableListExistDataChanged', () => {
+    it('sets exists trusted app uninitialised', () => {
+      const result = policyTrustedAppsReducer(initialState, {
+        type: 'policyArtifactsAssignableListExistDataChanged',
+        payload: createUninitialisedResourceState(),
+      });
+
+      expect(result).toStrictEqual({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          assignableListEntriesExist: {
+            type: 'UninitialisedResourceState',
+          },
+        },
+      });
+    });
+    it('sets exists trusted app loading', () => {
+      const result = policyTrustedAppsReducer(initialState, {
+        type: 'policyArtifactsAssignableListExistDataChanged',
+        payload: createLoadingResourceState(createUninitialisedResourceState()),
+      });
+
+      expect(result).toStrictEqual({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          assignableListEntriesExist: {
+            previousState: {
+              type: 'UninitialisedResourceState',
+            },
+            type: 'LoadingResourceState',
+          },
+        },
+      });
+    });
+    it('sets exists trusted app loaded negative', () => {
+      const result = policyTrustedAppsReducer(initialState, {
+        type: 'policyArtifactsAssignableListExistDataChanged',
+        payload: createLoadedResourceState(false),
+      });
+
+      expect(result).toStrictEqual({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          assignableListEntriesExist: {
+            data: false,
+            type: 'LoadedResourceState',
+          },
+        },
+      });
+    });
+    it('sets exists trusted app loaded positive', () => {
+      const result = policyTrustedAppsReducer(initialState, {
+        type: 'policyArtifactsAssignableListExistDataChanged',
+        payload: createLoadedResourceState(true),
+      });
+
+      expect(result).toStrictEqual({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          assignableListEntriesExist: {
+            data: true,
+            type: 'LoadedResourceState',
+          },
+        },
+      });
+    });
+    it('sets exists trusted app failed', () => {
+      const result = policyTrustedAppsReducer(initialState, {
+        type: 'policyArtifactsAssignableListExistDataChanged',
+        payload: createFailedResourceState(getAPIError()),
+      });
+
+      expect(result).toStrictEqual({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          assignableListEntriesExist: {
+            type: 'FailedResourceState',
+            error: getAPIError(),
+            lastLoadedState: undefined,
+          },
+        },
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer/trusted_apps_reducer.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer/trusted_apps_reducer.ts
index 7f2f9e437ca063..e2843ec83ee2a9 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer/trusted_apps_reducer.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer/trusted_apps_reducer.ts
@@ -14,6 +14,35 @@ export const policyTrustedAppsReducer: ImmutableReducer<PolicyDetailsState, AppA
   state = initialPolicyDetailsState(),
   action
 ) => {
-  // FIXME: implement trusted apps reducer
+  if (action.type === 'policyArtifactsAssignableListPageDataChanged') {
+    return {
+      ...state,
+      artifacts: {
+        ...state.artifacts,
+        assignableList: action.payload,
+      },
+    };
+  }
+
+  if (action.type === 'policyArtifactsUpdateTrustedAppsChanged') {
+    return {
+      ...state,
+      artifacts: {
+        ...state.artifacts,
+        trustedAppsToUpdate: action.payload,
+      },
+    };
+  }
+
+  if (action.type === 'policyArtifactsAssignableListExistDataChanged') {
+    return {
+      ...state,
+      artifacts: {
+        ...state.artifacts,
+        assignableListEntriesExist: action.payload,
+      },
+    };
+  }
+
   return state;
 };
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors/policy_settings_selectors.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors/policy_settings_selectors.ts
index 23ab0fd73c9e1e..84049c98eaa114 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors/policy_settings_selectors.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors/policy_settings_selectors.ts
@@ -9,7 +9,7 @@ import { createSelector } from 'reselect';
 import { matchPath } from 'react-router-dom';
 import { ILicense } from '../../../../../../../../licensing/common/types';
 import { unsetPolicyFeaturesAccordingToLicenseLevel } from '../../../../../../../common/license/policy_config';
-import { PolicyDetailsArtifactsPageLocation, PolicyDetailsState } from '../../../types';
+import { PolicyDetailsState } from '../../../types';
 import {
   Immutable,
   NewPolicyData,
@@ -24,6 +24,7 @@ import {
 } from '../../../../../common/constants';
 import { ManagementRoutePolicyDetailsParams } from '../../../../../types';
 import { getPolicyDataForUpdate } from '../../../../../../../common/endpoint/service/policy/get_policy_data_for_update';
+import { isOnPolicyTrustedAppsPage } from './trusted_apps_selectors';
 
 /** Returns the policy details */
 export const policyDetails = (state: Immutable<PolicyDetailsState>) => state.policyItem;
@@ -80,13 +81,6 @@ export const needsToRefresh = (state: Immutable<PolicyDetailsState>): boolean =>
   return !state.policyItem && !state.apiError;
 };
 
-/**
- * Returns current artifacts location
- */
-export const getCurrentArtifactsLocation = (
-  state: Immutable<PolicyDetailsState>
-): Immutable<PolicyDetailsArtifactsPageLocation> => state.artifacts.location;
-
 /** Returns a boolean of whether the user is on the policy form page or not */
 export const isOnPolicyFormPage = (state: Immutable<PolicyDetailsState>) => {
   return (
@@ -97,16 +91,6 @@ export const isOnPolicyFormPage = (state: Immutable<PolicyDetailsState>) => {
   );
 };
 
-/** Returns a boolean of whether the user is on the policy details page or not */
-export const isOnPolicyTrustedAppsPage = (state: Immutable<PolicyDetailsState>) => {
-  return (
-    matchPath(state.location?.pathname ?? '', {
-      path: MANAGEMENT_ROUTING_POLICY_DETAILS_TRUSTED_APPS_PATH,
-      exact: true,
-    }) !== null
-  );
-};
-
 /** Returns a boolean of whether the user is on some of the policy details page or not */
 export const isOnPolicyDetailsPage = (state: Immutable<PolicyDetailsState>) =>
   isOnPolicyFormPage(state) || isOnPolicyTrustedAppsPage(state);
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors/trusted_apps_selectors.test.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors/trusted_apps_selectors.test.ts
new file mode 100644
index 00000000000000..6d329884649570
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors/trusted_apps_selectors.test.ts
@@ -0,0 +1,409 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { PolicyDetailsState } from '../../../types';
+import { initialPolicyDetailsState } from '../reducer/initial_policy_details_state';
+import {
+  getCurrentArtifactsLocation,
+  getAssignableArtifactsList,
+  getAssignableArtifactsListIsLoading,
+  getUpdateArtifactsIsLoading,
+  getUpdateArtifactsIsFailed,
+  getUpdateArtifactsLoaded,
+  getAssignableArtifactsListExist,
+  getAssignableArtifactsListExistIsLoading,
+  getUpdateArtifacts,
+  isOnPolicyTrustedAppsPage,
+} from './trusted_apps_selectors';
+
+import { ImmutableObject } from '../../../../../../../common/endpoint/types';
+import {
+  createLoadedResourceState,
+  createUninitialisedResourceState,
+  createLoadingResourceState,
+  createFailedResourceState,
+} from '../../../../../state';
+import { MANAGEMENT_ROUTING_POLICY_DETAILS_TRUSTED_APPS_PATH } from '../../../../../common/constants';
+import { getMockListResponse, getAPIError, getMockCreateResponse } from '../../../test_utils';
+
+describe('policy trusted apps selectors', () => {
+  let initialState: ImmutableObject<PolicyDetailsState>;
+
+  beforeEach(() => {
+    initialState = initialPolicyDetailsState();
+  });
+
+  describe('isOnPolicyTrustedAppsPage()', () => {
+    it('when location is on policy trusted apps page', () => {
+      const isOnPage = isOnPolicyTrustedAppsPage({
+        ...initialState,
+        location: {
+          pathname: MANAGEMENT_ROUTING_POLICY_DETAILS_TRUSTED_APPS_PATH,
+          search: '',
+          hash: '',
+        },
+      });
+      expect(isOnPage).toBeFalsy();
+    });
+    it('when location is not on policy trusted apps page', () => {
+      const isOnPage = isOnPolicyTrustedAppsPage({
+        ...initialState,
+        location: { pathname: '', search: '', hash: '' },
+      });
+      expect(isOnPage).toBeFalsy();
+    });
+  });
+
+  describe('getCurrentArtifactsLocation()', () => {
+    it('when location is defined', () => {
+      const location = getCurrentArtifactsLocation(initialState);
+      expect(location).toEqual({ filter: '', page_index: 0, page_size: 10, show: undefined });
+    });
+    it('when location has show param to list', () => {
+      const location = getCurrentArtifactsLocation({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          location: { ...initialState.artifacts.location, show: 'list' },
+        },
+      });
+      expect(location).toEqual({ filter: '', page_index: 0, page_size: 10, show: 'list' });
+    });
+  });
+
+  describe('getAssignableArtifactsList()', () => {
+    it('when assignable list is uninitialised', () => {
+      const assignableList = getAssignableArtifactsList(initialState);
+      expect(assignableList).toBeUndefined();
+    });
+    it('when assignable list is loading', () => {
+      const assignableList = getAssignableArtifactsList({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          assignableList: createLoadingResourceState(createUninitialisedResourceState()),
+        },
+      });
+      expect(assignableList).toBeUndefined();
+    });
+    it('when assignable list is loaded', () => {
+      const assignableList = getAssignableArtifactsList({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          assignableList: createLoadedResourceState(getMockListResponse()),
+        },
+      });
+      expect(assignableList).toEqual(getMockListResponse());
+    });
+  });
+
+  describe('getAssignableArtifactsListIsLoading()', () => {
+    it('when assignable list is loading', () => {
+      const isLoading = getAssignableArtifactsListIsLoading({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          assignableList: createLoadingResourceState(createUninitialisedResourceState()),
+        },
+      });
+      expect(isLoading).toBeTruthy();
+    });
+    it('when assignable list is uninitialised', () => {
+      const isLoading = getAssignableArtifactsListIsLoading({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          assignableList: createUninitialisedResourceState(),
+        },
+      });
+      expect(isLoading).toBeFalsy();
+    });
+    it('when assignable list is loaded', () => {
+      const isLoading = getAssignableArtifactsListIsLoading({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          assignableList: createLoadedResourceState(getMockListResponse()),
+        },
+      });
+      expect(isLoading).toBeFalsy();
+    });
+  });
+
+  describe('getUpdateArtifactsIsLoading()', () => {
+    it('when update artifacts is loading', () => {
+      const isLoading = getUpdateArtifactsIsLoading({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          trustedAppsToUpdate: createLoadingResourceState(createUninitialisedResourceState()),
+        },
+      });
+      expect(isLoading).toBeTruthy();
+    });
+    it('when update artifacts is uninitialised', () => {
+      const isLoading = getUpdateArtifactsIsLoading({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          trustedAppsToUpdate: createUninitialisedResourceState(),
+        },
+      });
+      expect(isLoading).toBeFalsy();
+    });
+    it('when update artifacts is loaded', () => {
+      const isLoading = getUpdateArtifactsIsLoading({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          trustedAppsToUpdate: createLoadedResourceState([getMockCreateResponse()]),
+        },
+      });
+      expect(isLoading).toBeFalsy();
+    });
+  });
+
+  describe('getUpdateArtifactsIsFailed()', () => {
+    it('when update artifacts is loading', () => {
+      const hasFailed = getUpdateArtifactsIsFailed({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          trustedAppsToUpdate: createLoadingResourceState(createUninitialisedResourceState()),
+        },
+      });
+      expect(hasFailed).toBeFalsy();
+    });
+    it('when update artifacts is uninitialised', () => {
+      const hasFailed = getUpdateArtifactsIsFailed({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          trustedAppsToUpdate: createUninitialisedResourceState(),
+        },
+      });
+      expect(hasFailed).toBeFalsy();
+    });
+    it('when update artifacts is loaded', () => {
+      const hasFailed = getUpdateArtifactsIsFailed({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          trustedAppsToUpdate: createLoadedResourceState([getMockCreateResponse()]),
+        },
+      });
+      expect(hasFailed).toBeFalsy();
+    });
+    it('when update artifacts has failed', () => {
+      const hasFailed = getUpdateArtifactsIsFailed({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          trustedAppsToUpdate: createFailedResourceState(getAPIError()),
+        },
+      });
+      expect(hasFailed).toBeTruthy();
+    });
+  });
+
+  describe('getUpdateArtifactsLoaded()', () => {
+    it('when update artifacts is loading', () => {
+      const isLoaded = getUpdateArtifactsLoaded({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          trustedAppsToUpdate: createLoadingResourceState(createUninitialisedResourceState()),
+        },
+      });
+      expect(isLoaded).toBeFalsy();
+    });
+    it('when update artifacts is uninitialised', () => {
+      const isLoaded = getUpdateArtifactsLoaded({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          trustedAppsToUpdate: createUninitialisedResourceState(),
+        },
+      });
+      expect(isLoaded).toBeFalsy();
+    });
+    it('when update artifacts is loaded', () => {
+      const isLoaded = getUpdateArtifactsLoaded({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          trustedAppsToUpdate: createLoadedResourceState([getMockCreateResponse()]),
+        },
+      });
+      expect(isLoaded).toBeTruthy();
+    });
+    it('when update artifacts has failed', () => {
+      const isLoaded = getUpdateArtifactsLoaded({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          trustedAppsToUpdate: createFailedResourceState(getAPIError()),
+        },
+      });
+      expect(isLoaded).toBeFalsy();
+    });
+  });
+
+  describe('getUpdateArtifacts()', () => {
+    it('when update artifacts is loading', () => {
+      const isLoading = getUpdateArtifacts({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          trustedAppsToUpdate: createLoadingResourceState(createUninitialisedResourceState()),
+        },
+      });
+      expect(isLoading).toBeUndefined();
+    });
+    it('when update artifacts is uninitialised', () => {
+      const isLoading = getUpdateArtifacts({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          trustedAppsToUpdate: createUninitialisedResourceState(),
+        },
+      });
+      expect(isLoading).toBeUndefined();
+    });
+    it('when update artifacts is loaded', () => {
+      const isLoading = getUpdateArtifacts({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          trustedAppsToUpdate: createLoadedResourceState([getMockCreateResponse()]),
+        },
+      });
+      expect(isLoading).toEqual([getMockCreateResponse()]);
+    });
+    it('when update artifacts has failed', () => {
+      const isLoading = getUpdateArtifacts({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          trustedAppsToUpdate: createFailedResourceState(getAPIError()),
+        },
+      });
+      expect(isLoading).toBeUndefined();
+    });
+  });
+
+  describe('getAssignableArtifactsListExist()', () => {
+    it('when check artifacts exists is loading', () => {
+      const exists = getAssignableArtifactsListExist({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          assignableListEntriesExist: createLoadingResourceState(
+            createUninitialisedResourceState()
+          ),
+        },
+      });
+      expect(exists).toBeFalsy();
+    });
+    it('when check artifacts exists is uninitialised', () => {
+      const exists = getAssignableArtifactsListExist({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          assignableListEntriesExist: createUninitialisedResourceState(),
+        },
+      });
+      expect(exists).toBeFalsy();
+    });
+    it('when check artifacts exists is loaded with negative result', () => {
+      const exists = getAssignableArtifactsListExist({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          assignableListEntriesExist: createLoadedResourceState(false),
+        },
+      });
+      expect(exists).toBeFalsy();
+    });
+    it('when check artifacts exists is loaded with positive result', () => {
+      const exists = getAssignableArtifactsListExist({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          assignableListEntriesExist: createLoadedResourceState(true),
+        },
+      });
+      expect(exists).toBeTruthy();
+    });
+    it('when check artifacts exists has failed', () => {
+      const exists = getAssignableArtifactsListExist({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          assignableListEntriesExist: createFailedResourceState(getAPIError()),
+        },
+      });
+      expect(exists).toBeFalsy();
+    });
+  });
+
+  describe('getAssignableArtifactsListExistIsLoading()', () => {
+    it('when check artifacts exists is loading', () => {
+      const isLoading = getAssignableArtifactsListExistIsLoading({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          assignableListEntriesExist: createLoadingResourceState(
+            createUninitialisedResourceState()
+          ),
+        },
+      });
+      expect(isLoading).toBeTruthy();
+    });
+    it('when check artifacts exists is uninitialised', () => {
+      const isLoading = getAssignableArtifactsListExistIsLoading({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          assignableListEntriesExist: createUninitialisedResourceState(),
+        },
+      });
+      expect(isLoading).toBeFalsy();
+    });
+    it('when check artifacts exists is loaded with negative result', () => {
+      const isLoading = getAssignableArtifactsListExistIsLoading({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          assignableListEntriesExist: createLoadedResourceState(false),
+        },
+      });
+      expect(isLoading).toBeFalsy();
+    });
+    it('when check artifacts exists is loaded with positive result', () => {
+      const isLoading = getAssignableArtifactsListExistIsLoading({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          assignableListEntriesExist: createLoadedResourceState(true),
+        },
+      });
+      expect(isLoading).toBeFalsy();
+    });
+    it('when check artifacts exists has failed', () => {
+      const isLoading = getAssignableArtifactsListExistIsLoading({
+        ...initialState,
+        artifacts: {
+          ...initialState.artifacts,
+          assignableListEntriesExist: createFailedResourceState(getAPIError()),
+        },
+      });
+      expect(isLoading).toBeFalsy();
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors/trusted_apps_selectors.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors/trusted_apps_selectors.ts
index f7a568b5ade0e1..65d24ac58cab48 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors/trusted_apps_selectors.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors/trusted_apps_selectors.ts
@@ -5,6 +5,99 @@
  * 2.0.
  */
 
-export const isOnTrustedAppsView = () => {
-  return true;
+import { matchPath } from 'react-router-dom';
+import { PolicyDetailsArtifactsPageLocation, PolicyDetailsState } from '../../../types';
+import {
+  Immutable,
+  ImmutableArray,
+  PostTrustedAppCreateResponse,
+  GetTrustedListAppsResponse,
+} from '../../../../../../../common/endpoint/types';
+import { MANAGEMENT_ROUTING_POLICY_DETAILS_TRUSTED_APPS_PATH } from '../../../../../common/constants';
+import {
+  getLastLoadedResourceState,
+  isFailedResourceState,
+  isLoadedResourceState,
+  isLoadingResourceState,
+} from '../../../../../state';
+
+/**
+ * Returns current artifacts location
+ */
+export const getCurrentArtifactsLocation = (
+  state: Immutable<PolicyDetailsState>
+): Immutable<PolicyDetailsArtifactsPageLocation> => state.artifacts.location;
+
+/**
+ * Returns current assignable artifacts list
+ */
+export const getAssignableArtifactsList = (
+  state: Immutable<PolicyDetailsState>
+): Immutable<GetTrustedListAppsResponse> | undefined =>
+  getLastLoadedResourceState(state.artifacts.assignableList)?.data;
+
+/**
+ * Returns if assignable list is loading
+ */
+export const getAssignableArtifactsListIsLoading = (
+  state: Immutable<PolicyDetailsState>
+): boolean => isLoadingResourceState(state.artifacts.assignableList);
+
+/**
+ * Returns if update action is loading
+ */
+export const getUpdateArtifactsIsLoading = (state: Immutable<PolicyDetailsState>): boolean =>
+  isLoadingResourceState(state.artifacts.trustedAppsToUpdate);
+
+/**
+ * Returns if update action is loading
+ */
+export const getUpdateArtifactsIsFailed = (state: Immutable<PolicyDetailsState>): boolean =>
+  isFailedResourceState(state.artifacts.trustedAppsToUpdate);
+
+/**
+ * Returns if update action is done successfully
+ */
+export const getUpdateArtifactsLoaded = (state: Immutable<PolicyDetailsState>): boolean => {
+  return isLoadedResourceState(state.artifacts.trustedAppsToUpdate);
+};
+
+/**
+ * Returns true if there is data assignable even if the search didn't returned it.
+ */
+export const getAssignableArtifactsListExist = (state: Immutable<PolicyDetailsState>): boolean => {
+  return (
+    isLoadedResourceState(state.artifacts.assignableListEntriesExist) &&
+    state.artifacts.assignableListEntriesExist.data
+  );
+};
+
+/**
+ * Returns true if there is data assignable even if the search didn't returned it.
+ */
+export const getAssignableArtifactsListExistIsLoading = (
+  state: Immutable<PolicyDetailsState>
+): boolean => {
+  return isLoadingResourceState(state.artifacts.assignableListEntriesExist);
+};
+
+/**
+ * Returns artifacts to be updated
+ */
+export const getUpdateArtifacts = (
+  state: Immutable<PolicyDetailsState>
+): ImmutableArray<PostTrustedAppCreateResponse> | undefined => {
+  return state.artifacts.trustedAppsToUpdate.type === 'LoadedResourceState'
+    ? state.artifacts.trustedAppsToUpdate.data
+    : undefined;
+};
+
+/** Returns a boolean of whether the user is on the policy details page or not */
+export const isOnPolicyTrustedAppsPage = (state: Immutable<PolicyDetailsState>) => {
+  return (
+    matchPath(state.location?.pathname ?? '', {
+      path: MANAGEMENT_ROUTING_POLICY_DETAILS_TRUSTED_APPS_PATH,
+      exact: true,
+    }) !== null
+  );
 };
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/test_utils/index.ts b/x-pack/plugins/security_solution/public/management/pages/policy/test_utils/index.ts
new file mode 100644
index 00000000000000..383b7e277babdc
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/test_utils/index.ts
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  GetTrustedListAppsResponse,
+  PostTrustedAppCreateResponse,
+} from '../../../../../common/endpoint/types';
+
+import { createSampleTrustedApps, createSampleTrustedApp } from '../../trusted_apps/test_utils';
+
+export const getMockListResponse: () => GetTrustedListAppsResponse = () => ({
+  data: createSampleTrustedApps({}),
+  per_page: 100,
+  page: 1,
+  total: 100,
+});
+
+export const getMockCreateResponse: () => PostTrustedAppCreateResponse = () =>
+  createSampleTrustedApp(1) as unknown as unknown as PostTrustedAppCreateResponse;
+
+export const getAPIError = () => ({
+  statusCode: 500,
+  error: 'Internal Server Error',
+  message: 'Something is not right',
+});
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/types.ts b/x-pack/plugins/security_solution/public/management/pages/policy/types.ts
index 9000fb469afd30..8e4e31a3c70e9f 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/types.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/types.ts
@@ -13,6 +13,8 @@ import {
   ProtectionFields,
   PolicyData,
   UIPolicyConfig,
+  PostTrustedAppCreateResponse,
+  GetTrustedListAppsResponse,
   MaybeImmutable,
 } from '../../../../common/endpoint/types';
 import { ServerApiError } from '../../../common/types';
@@ -24,7 +26,6 @@ import {
   UpdatePackagePolicyResponse,
 } from '../../../../../fleet/common';
 import { AsyncResourceState } from '../../state';
-import { TrustedAppsListData } from '../trusted_apps/state';
 import { ImmutableMiddlewareAPI } from '../../../common/store';
 import { AppAction } from '../../../common/store/actions';
 
@@ -96,7 +97,11 @@ export interface PolicyArtifactsState {
   /** artifacts location params  */
   location: PolicyDetailsArtifactsPageLocation;
   /** A list of artifacts can be linked to the policy  */
-  availableList: AsyncResourceState<TrustedAppsListData>;
+  assignableList: AsyncResourceState<GetTrustedListAppsResponse>;
+  /** Represents if avaialble trusted apps entries exist, regardless of whether the list is showing results  */
+  assignableListEntriesExist: AsyncResourceState<boolean>;
+  /** A list of trusted apps going to be updated  */
+  trustedAppsToUpdate: AsyncResourceState<PostTrustedAppCreateResponse[]>;
 }
 
 export enum OS {
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/artifacts/assignable/index.ts b/x-pack/plugins/security_solution/public/management/pages/policy/view/artifacts/assignable/index.ts
new file mode 100644
index 00000000000000..4a46e30f825e8b
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/artifacts/assignable/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { PolicyArtifactsAssignableList } from './policy_artifacts_assignable_list';
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/artifacts/assignable/policy_artifacts_assignable_list.test.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/artifacts/assignable/policy_artifacts_assignable_list.test.tsx
new file mode 100644
index 00000000000000..a93ae878eb6ddd
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/artifacts/assignable/policy_artifacts_assignable_list.test.tsx
@@ -0,0 +1,85 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React from 'react';
+import {
+  PolicyArtifactsAssignableList,
+  PolicyArtifactsAssignableListProps,
+} from './policy_artifacts_assignable_list';
+import * as reactTestingLibrary from '@testing-library/react';
+import {
+  AppContextTestRender,
+  createAppRootMockRenderer,
+} from '../../../../../../common/mock/endpoint';
+import { fireEvent } from '@testing-library/dom';
+import { getMockListResponse } from '../../../test_utils';
+
+describe('Policy artifacts list', () => {
+  let mockedContext: AppContextTestRender;
+  let selectedArtifactsUpdatedMock: jest.Mock;
+  let render: (
+    props: PolicyArtifactsAssignableListProps
+  ) => ReturnType<AppContextTestRender['render']>;
+  const act = reactTestingLibrary.act;
+
+  afterEach(() => reactTestingLibrary.cleanup());
+  beforeEach(() => {
+    selectedArtifactsUpdatedMock = jest.fn();
+    mockedContext = createAppRootMockRenderer();
+    render = (props) => mockedContext.render(<PolicyArtifactsAssignableList {...props} />);
+  });
+
+  it('should artifacts list loading state', async () => {
+    const emptyArtifactsResponse = { data: [], per_page: 0, page: 0, total: 0 };
+    const component = render({
+      artifacts: emptyArtifactsResponse,
+      selectedArtifactIds: [],
+      isListLoading: true,
+      selectedArtifactsUpdated: selectedArtifactsUpdatedMock,
+    });
+
+    expect(component.getByTestId('loading-spinner')).not.toBeNull();
+  });
+
+  it('should artifacts list without data', async () => {
+    const emptyArtifactsResponse = { data: [], per_page: 0, page: 0, total: 0 };
+    const component = render({
+      artifacts: emptyArtifactsResponse,
+      selectedArtifactIds: [],
+      isListLoading: false,
+      selectedArtifactsUpdated: selectedArtifactsUpdatedMock,
+    });
+    expect(component.queryByTestId('artifactsList')).toBeNull();
+  });
+
+  it('should artifacts list with data', async () => {
+    const artifactsResponse = getMockListResponse();
+    const component = render({
+      artifacts: artifactsResponse,
+      selectedArtifactIds: [],
+      isListLoading: false,
+      selectedArtifactsUpdated: selectedArtifactsUpdatedMock,
+    });
+    expect(component.getByTestId('artifactsList')).not.toBeNull();
+  });
+
+  it('should select an artifact from list', async () => {
+    const artifactsResponse = getMockListResponse();
+    const component = render({
+      artifacts: artifactsResponse,
+      selectedArtifactIds: [artifactsResponse.data[0].id],
+      isListLoading: false,
+      selectedArtifactsUpdated: selectedArtifactsUpdatedMock,
+    });
+    const tACardCheckbox = component.getByTestId(`${getMockListResponse().data[1].name}_checkbox`);
+
+    await act(async () => {
+      fireEvent.click(tACardCheckbox);
+    });
+
+    expect(selectedArtifactsUpdatedMock).toHaveBeenCalledWith(artifactsResponse.data[1].id, true);
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/artifacts/assignable/policy_artifacts_assignable_list.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/artifacts/assignable/policy_artifacts_assignable_list.tsx
new file mode 100644
index 00000000000000..7046b289063f6b
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/artifacts/assignable/policy_artifacts_assignable_list.tsx
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useMemo } from 'react';
+
+import {
+  GetTrustedListAppsResponse,
+  Immutable,
+  TrustedApp,
+} from '../../../../../../../common/endpoint/types';
+import { Loader } from '../../../../../../common/components/loader';
+import { ArtifactEntryCardMinified } from '../../../../../components/artifact_entry_card';
+
+export interface PolicyArtifactsAssignableListProps {
+  artifacts: Immutable<GetTrustedListAppsResponse | undefined>; // Or other artifacts type like Event Filters or Endpoint Exceptions
+  selectedArtifactIds: string[];
+  selectedArtifactsUpdated: (id: string, selected: boolean) => void;
+  isListLoading: boolean;
+}
+
+export const PolicyArtifactsAssignableList = React.memo<PolicyArtifactsAssignableListProps>(
+  ({ artifacts, isListLoading, selectedArtifactIds, selectedArtifactsUpdated }) => {
+    const selectedArtifactIdsByKey = useMemo(
+      () =>
+        selectedArtifactIds.reduce(
+          (acc: { [key: string]: boolean }, current) => ({ ...acc, [current]: true }),
+          {}
+        ),
+      [selectedArtifactIds]
+    );
+
+    const assignableList = useMemo(() => {
+      if (!artifacts || !artifacts.data.length) return null;
+      const items = Array.from(artifacts.data) as TrustedApp[];
+      return (
+        <div data-test-subj="artifactsList">
+          {items.map((artifact) => (
+            <ArtifactEntryCardMinified
+              key={artifact.id}
+              item={artifact}
+              isSelected={selectedArtifactIdsByKey[artifact.id] || false}
+              onToggleSelectedArtifact={(selected) =>
+                selectedArtifactsUpdated(artifact.id, selected)
+              }
+            />
+          ))}
+        </div>
+      );
+    }, [artifacts, selectedArtifactIdsByKey, selectedArtifactsUpdated]);
+
+    return isListLoading ? <Loader size="xl" /> : <div>{assignableList}</div>;
+  }
+);
+
+PolicyArtifactsAssignableList.displayName = 'PolicyArtifactsAssignableList';
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_hooks.ts b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_hooks.ts
index bbaeb7e7590d98..e62458c9ce47ef 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_hooks.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_hooks.ts
@@ -5,13 +5,25 @@
  * 2.0.
  */
 
+import { useCallback, useState } from 'react';
+import { useHistory } from 'react-router-dom';
 import { useSelector } from 'react-redux';
-import { PolicyDetailsState } from '../types';
+import { i18n } from '@kbn/i18n';
+import { PolicyDetailsArtifactsPageLocation, PolicyDetailsState } from '../types';
 import { State } from '../../../../common/store';
 import {
   MANAGEMENT_STORE_GLOBAL_NAMESPACE,
   MANAGEMENT_STORE_POLICY_DETAILS_NAMESPACE,
 } from '../../../common/constants';
+import { getPolicyDetailsArtifactsListPath } from '../../../common/routing';
+import {
+  getCurrentArtifactsLocation,
+  getUpdateArtifacts,
+  getUpdateArtifactsLoaded,
+  getUpdateArtifactsIsFailed,
+  policyIdFromParams,
+} from '../store/policy_details/selectors';
+import { useToasts } from '../../../../common/lib/kibana';
 
 /**
  * Narrows global state down to the PolicyDetailsState before calling the provided Policy Details Selector
@@ -28,3 +40,60 @@ export function usePolicyDetailsSelector<TSelected>(
     )
   );
 }
+
+export type NavigationCallback = (
+  ...args: Parameters<Parameters<typeof useCallback>[0]>
+) => Partial<PolicyDetailsArtifactsPageLocation>;
+
+export function usePolicyDetailsNavigateCallback() {
+  const location = usePolicyDetailsSelector(getCurrentArtifactsLocation);
+  const history = useHistory();
+  const policyId = usePolicyDetailsSelector(policyIdFromParams);
+
+  return useCallback(
+    (args: Partial<PolicyDetailsArtifactsPageLocation>) =>
+      history.push(
+        getPolicyDetailsArtifactsListPath(policyId, {
+          ...location,
+          ...args,
+        })
+      ),
+    [history, location, policyId]
+  );
+}
+
+export const usePolicyTrustedAppsNotification = () => {
+  const updateSuccessfull = usePolicyDetailsSelector(getUpdateArtifactsLoaded);
+  const updateFailed = usePolicyDetailsSelector(getUpdateArtifactsIsFailed);
+  const updatedArtifacts = usePolicyDetailsSelector(getUpdateArtifacts);
+  const toasts = useToasts();
+  const [wasAlreadyHandled] = useState(new WeakSet());
+
+  if (updateSuccessfull && updatedArtifacts && !wasAlreadyHandled.has(updatedArtifacts)) {
+    wasAlreadyHandled.add(updatedArtifacts);
+    toasts.addSuccess({
+      title: i18n.translate(
+        'xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.toastSuccess.title',
+        {
+          defaultMessage: 'Success',
+        }
+      ),
+      text: i18n.translate(
+        'xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.toastSuccess.text',
+        {
+          defaultMessage: '"{names}" has been added to your trusted applications list.',
+          values: { names: updatedArtifacts.map((artifact) => artifact.data.name).join(', ') },
+        }
+      ),
+    });
+  } else if (updateFailed) {
+    toasts.addSuccess(
+      i18n.translate(
+        'xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.toastError.text',
+        {
+          defaultMessage: 'An error occurred updating artifacts',
+        }
+      )
+    );
+  }
+};
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/index.ts b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/index.ts
new file mode 100644
index 00000000000000..d3090a340fa2bc
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { PolicyTrustedAppsFlyout } from './policy_trusted_apps_flyout';
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.test.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.test.tsx
new file mode 100644
index 00000000000000..a586c3c9d1b299
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.test.tsx
@@ -0,0 +1,184 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React from 'react';
+import { PolicyTrustedAppsFlyout } from './policy_trusted_apps_flyout';
+import * as reactTestingLibrary from '@testing-library/react';
+import { fireEvent } from '@testing-library/dom';
+import {
+  AppContextTestRender,
+  createAppRootMockRenderer,
+} from '../../../../../../common/mock/endpoint';
+import { MiddlewareActionSpyHelper } from '../../../../../../common/store/test_utils';
+
+import { TrustedAppsHttpService } from '../../../../trusted_apps/service';
+import { PolicyDetailsState } from '../../../types';
+import { getMockCreateResponse, getMockListResponse } from '../../../test_utils';
+import { createLoadedResourceState, isLoadedResourceState } from '../../../../../state';
+import { getPolicyDetailsArtifactsListPath } from '../../../../../common/routing';
+
+jest.mock('../../../../trusted_apps/service');
+
+let mockedContext: AppContextTestRender;
+let waitForAction: MiddlewareActionSpyHelper['waitForAction'];
+let render: () => ReturnType<AppContextTestRender['render']>;
+const act = reactTestingLibrary.act;
+const TrustedAppsHttpServiceMock = TrustedAppsHttpService as jest.Mock;
+let getState: () => PolicyDetailsState;
+
+describe('Policy trusted apps flyout', () => {
+  beforeEach(() => {
+    TrustedAppsHttpServiceMock.mockImplementation(() => {
+      return {
+        getTrustedAppsList: () => getMockListResponse(),
+        updateTrustedApp: () => ({
+          data: getMockCreateResponse(),
+        }),
+      };
+    });
+    mockedContext = createAppRootMockRenderer();
+    waitForAction = mockedContext.middlewareSpy.waitForAction;
+    getState = () => mockedContext.store.getState().management.policyDetails;
+    render = () => mockedContext.render(<PolicyTrustedAppsFlyout />);
+  });
+
+  afterEach(() => reactTestingLibrary.cleanup());
+
+  it('should renders flyout open correctly without assignable data', async () => {
+    const waitAssignableListExist = waitForAction('policyArtifactsAssignableListExistDataChanged', {
+      validate: (action) => isLoadedResourceState(action.payload),
+    });
+
+    TrustedAppsHttpServiceMock.mockImplementation(() => {
+      return {
+        getTrustedAppsList: () => ({ data: [] }),
+      };
+    });
+    const component = render();
+
+    mockedContext.history.push(getPolicyDetailsArtifactsListPath('1234', { show: 'list' }));
+
+    await waitForAction('policyArtifactsAssignableListPageDataChanged', {
+      validate: (action) => isLoadedResourceState(action.payload),
+    });
+    await waitAssignableListExist;
+
+    expect(component.getByTestId('confirmPolicyTrustedAppsFlyout')).not.toBeNull();
+    expect(component.getByTestId('noAssignableItemsTrustedAppsFlyout')).not.toBeNull();
+  });
+
+  it('should renders flyout open correctly without data', async () => {
+    TrustedAppsHttpServiceMock.mockImplementation(() => {
+      return {
+        getTrustedAppsList: () => ({ data: [] }),
+      };
+    });
+    const component = render();
+
+    mockedContext.history.push(getPolicyDetailsArtifactsListPath('1234', { show: 'list' }));
+    await waitForAction('policyArtifactsAssignableListPageDataChanged', {
+      validate: (action) => isLoadedResourceState(action.payload),
+    });
+
+    mockedContext.store.dispatch({
+      type: 'policyArtifactsAssignableListExistDataChanged',
+      payload: createLoadedResourceState(true),
+    });
+
+    expect(component.getByTestId('confirmPolicyTrustedAppsFlyout')).not.toBeNull();
+    expect(component.getByTestId('noItemsFoundTrustedAppsFlyout')).not.toBeNull();
+  });
+
+  it('should renders flyout open correctly', async () => {
+    const component = render();
+
+    mockedContext.history.push(getPolicyDetailsArtifactsListPath('1234', { show: 'list' }));
+    await waitForAction('policyArtifactsAssignableListPageDataChanged', {
+      validate: (action) => isLoadedResourceState(action.payload),
+    });
+
+    expect(component.getByTestId('confirmPolicyTrustedAppsFlyout')).not.toBeNull();
+    expect(component.getByTestId(`${getMockListResponse().data[0].name}_checkbox`)).not.toBeNull();
+  });
+
+  it('should confirm flyout action', async () => {
+    const waitForUpdate = waitForAction('policyArtifactsUpdateTrustedAppsChanged', {
+      validate: (action) => isLoadedResourceState(action.payload),
+    });
+    const waitChangeUrl = waitForAction('userChangedUrl');
+    const component = render();
+
+    mockedContext.history.push(getPolicyDetailsArtifactsListPath('1234', { show: 'list' }));
+    await waitForAction('policyArtifactsAssignableListPageDataChanged', {
+      validate: (action) => isLoadedResourceState(action.payload),
+    });
+
+    const tACardCheckbox = component.getByTestId(`${getMockListResponse().data[0].name}_checkbox`);
+
+    await act(async () => {
+      fireEvent.click(tACardCheckbox);
+    });
+
+    const confirmButton = component.getByTestId('confirmPolicyTrustedAppsFlyout');
+
+    await act(async () => {
+      fireEvent.click(confirmButton);
+    });
+
+    await waitForUpdate;
+    await waitChangeUrl;
+    const currentLocation = getState().artifacts.location;
+    expect(currentLocation.show).toBeUndefined();
+  });
+
+  it('should cancel flyout action', async () => {
+    const waitChangeUrl = waitForAction('userChangedUrl');
+    const component = render();
+
+    mockedContext.history.push(getPolicyDetailsArtifactsListPath('1234', { show: 'list' }));
+    await waitForAction('policyArtifactsAssignableListPageDataChanged', {
+      validate: (action) => isLoadedResourceState(action.payload),
+    });
+
+    const cancelButton = component.getByTestId('cancelPolicyTrustedAppsFlyout');
+
+    await act(async () => {
+      fireEvent.click(cancelButton);
+    });
+
+    await waitChangeUrl;
+    const currentLocation = getState().artifacts.location;
+    expect(currentLocation.show).toBeUndefined();
+  });
+
+  it('should display warning message when too much results', async () => {
+    TrustedAppsHttpServiceMock.mockImplementation(() => {
+      return {
+        getTrustedAppsList: () => ({ ...getMockListResponse(), total: 101 }),
+      };
+    });
+
+    const component = render();
+
+    mockedContext.history.push(getPolicyDetailsArtifactsListPath('1234', { show: 'list' }));
+    await waitForAction('policyArtifactsAssignableListPageDataChanged', {
+      validate: (action) => isLoadedResourceState(action.payload),
+    });
+
+    expect(component.getByTestId('tooMuchResultsWarningMessageTrustedAppsFlyout')).not.toBeNull();
+  });
+
+  it('should not display warning message when few results', async () => {
+    const component = render();
+
+    mockedContext.history.push(getPolicyDetailsArtifactsListPath('1234', { show: 'list' }));
+    await waitForAction('policyArtifactsAssignableListPageDataChanged', {
+      validate: (action) => isLoadedResourceState(action.payload),
+    });
+
+    expect(component.queryByTestId('tooMuchResultsWarningMessageTrustedAppsFlyout')).toBeNull();
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.tsx
new file mode 100644
index 00000000000000..cd291ed9f6eb0f
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.tsx
@@ -0,0 +1,257 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useMemo, useState, useCallback, useEffect } from 'react';
+import { useDispatch } from 'react-redux';
+
+import { FormattedMessage } from '@kbn/i18n/react';
+import { i18n } from '@kbn/i18n';
+import { isEmpty, without } from 'lodash/fp';
+import {
+  EuiButton,
+  EuiTitle,
+  EuiFlyout,
+  EuiFlyoutHeader,
+  EuiFlyoutBody,
+  EuiSpacer,
+  EuiFlyoutFooter,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiButtonEmpty,
+  EuiCallOut,
+  EuiEmptyPrompt,
+} from '@elastic/eui';
+import {
+  policyDetails,
+  getCurrentArtifactsLocation,
+  getAssignableArtifactsList,
+  getAssignableArtifactsListIsLoading,
+  getUpdateArtifactsIsLoading,
+  getUpdateArtifactsLoaded,
+  getAssignableArtifactsListExist,
+  getAssignableArtifactsListExistIsLoading,
+} from '../../../store/policy_details/selectors';
+import {
+  usePolicyDetailsNavigateCallback,
+  usePolicyDetailsSelector,
+  usePolicyTrustedAppsNotification,
+} from '../../policy_hooks';
+import { PolicyArtifactsAssignableList } from '../../artifacts/assignable';
+import { SearchExceptions } from '../../../../../components/search_exceptions';
+
+export const PolicyTrustedAppsFlyout = React.memo(() => {
+  usePolicyTrustedAppsNotification();
+  const dispatch = useDispatch();
+  const [selectedArtifactIds, setSelectedArtifactIds] = useState<string[]>([]);
+  const location = usePolicyDetailsSelector(getCurrentArtifactsLocation);
+  const policyItem = usePolicyDetailsSelector(policyDetails);
+  const assignableArtifactsList = usePolicyDetailsSelector(getAssignableArtifactsList);
+  const isAssignableArtifactsListLoading = usePolicyDetailsSelector(
+    getAssignableArtifactsListIsLoading
+  );
+  const isUpdateArtifactsLoading = usePolicyDetailsSelector(getUpdateArtifactsIsLoading);
+  const isUpdateArtifactsLoaded = usePolicyDetailsSelector(getUpdateArtifactsLoaded);
+  const isAssignableArtifactsListExist = usePolicyDetailsSelector(getAssignableArtifactsListExist);
+  const isAssignableArtifactsListExistLoading = usePolicyDetailsSelector(
+    getAssignableArtifactsListExistIsLoading
+  );
+
+  const navigateCallback = usePolicyDetailsNavigateCallback();
+
+  const policyName = policyItem?.name ?? '';
+
+  const handleListFlyoutClose = useCallback(
+    () =>
+      navigateCallback({
+        show: undefined,
+      }),
+    [navigateCallback]
+  );
+
+  useEffect(() => {
+    if (isUpdateArtifactsLoaded) {
+      handleListFlyoutClose();
+      dispatch({
+        type: 'policyArtifactsUpdateTrustedAppsChanged',
+        payload: { type: 'UninitialisedResourceState' },
+      });
+    }
+  }, [dispatch, handleListFlyoutClose, isUpdateArtifactsLoaded]);
+
+  const handleOnConfirmAction = useCallback(() => {
+    dispatch({
+      type: 'policyArtifactsUpdateTrustedApps',
+      payload: { trustedAppIds: selectedArtifactIds },
+    });
+  }, [dispatch, selectedArtifactIds]);
+
+  const handleOnSearch = useCallback(
+    (filter) => {
+      dispatch({
+        type: 'policyArtifactsAssignableListPageDataFilter',
+        payload: { filter },
+      });
+    },
+    [dispatch]
+  );
+
+  const searchWarningMessage = useMemo(
+    () => (
+      <>
+        <EuiCallOut
+          data-test-subj="tooMuchResultsWarningMessageTrustedAppsFlyout"
+          color="warning"
+          size="s"
+          heading="h4"
+          title={i18n.translate(
+            'xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.searchWarning.title',
+            {
+              defaultMessage: 'Limited search results',
+            }
+          )}
+        >
+          {i18n.translate(
+            'xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.searchWarning.text',
+            {
+              defaultMessage:
+                'Only the first 100 trusted applications are displayed. Please use the search bar to refine the results.',
+            }
+          )}
+        </EuiCallOut>
+        <EuiSpacer size="m" />
+      </>
+    ),
+    []
+  );
+
+  const canShowPolicyArtifactsAssignableList = useMemo(
+    () =>
+      isAssignableArtifactsListExistLoading ||
+      isAssignableArtifactsListLoading ||
+      !isEmpty(assignableArtifactsList?.data),
+    [
+      assignableArtifactsList?.data,
+      isAssignableArtifactsListExistLoading,
+      isAssignableArtifactsListLoading,
+    ]
+  );
+
+  const entriesExists = useMemo(
+    () => isEmpty(assignableArtifactsList?.data) && isAssignableArtifactsListExist,
+    [assignableArtifactsList?.data, isAssignableArtifactsListExist]
+  );
+
+  return (
+    <EuiFlyout onClose={handleListFlyoutClose}>
+      <EuiFlyoutHeader hasBorder>
+        <EuiTitle size="m">
+          <h2>
+            <FormattedMessage
+              id="xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.title"
+              defaultMessage="Assign trusted applications"
+            />
+          </h2>
+        </EuiTitle>
+        <EuiSpacer size="m" />
+        <FormattedMessage
+          id="xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.subtitle"
+          defaultMessage="Select trusted applications to add to {policyName}"
+          values={{ policyName }}
+        />
+      </EuiFlyoutHeader>
+      <EuiFlyoutBody>
+        {(assignableArtifactsList?.total || 0) > 100 ? searchWarningMessage : null}
+        <SearchExceptions
+          defaultValue={location.filter}
+          onSearch={handleOnSearch}
+          placeholder={i18n.translate(
+            'xpack.securitySolution.endpoint.policy.trustedApps.layout.searh.label',
+            {
+              defaultMessage: 'Search trusted applications',
+            }
+          )}
+        />
+        <EuiSpacer size="m" />
+
+        {canShowPolicyArtifactsAssignableList ? (
+          <PolicyArtifactsAssignableList
+            data-test-subj="artifactsListTrustedAppsFlyout"
+            artifacts={assignableArtifactsList}
+            selectedArtifactIds={selectedArtifactIds}
+            isListLoading={
+              isAssignableArtifactsListLoading || isAssignableArtifactsListExistLoading
+            }
+            selectedArtifactsUpdated={(artifactId, selected) => {
+              setSelectedArtifactIds((currentSelectedArtifactIds) =>
+                selected
+                  ? [...currentSelectedArtifactIds, artifactId]
+                  : without([artifactId], currentSelectedArtifactIds)
+              );
+            }}
+          />
+        ) : entriesExists ? (
+          <EuiEmptyPrompt
+            data-test-subj="noItemsFoundTrustedAppsFlyout"
+            title={
+              <FormattedMessage
+                id="xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.noResults"
+                defaultMessage="No items found"
+              />
+            }
+          />
+        ) : (
+          <EuiEmptyPrompt
+            data-test-subj="noAssignableItemsTrustedAppsFlyout"
+            title={
+              <FormattedMessage
+                id="xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.noAssignable"
+                defaultMessage="There are no assignable Trused Apps to assign to this policy"
+              />
+            }
+          />
+        )}
+      </EuiFlyoutBody>
+      <EuiFlyoutFooter>
+        <EuiFlexGroup justifyContent="spaceBetween">
+          <EuiFlexItem grow={false}>
+            <EuiButtonEmpty
+              data-test-subj="cancelPolicyTrustedAppsFlyout"
+              onClick={handleListFlyoutClose}
+            >
+              <FormattedMessage
+                id="xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.cancel"
+                defaultMessage="Cancel"
+              />
+            </EuiButtonEmpty>
+          </EuiFlexItem>
+          <EuiFlexItem grow={false}>
+            <EuiButton
+              className="eui-textTruncate"
+              style={{ maxWidth: '300px' }}
+              data-test-subj="confirmPolicyTrustedAppsFlyout"
+              fill
+              onClick={handleOnConfirmAction}
+              isLoading={isUpdateArtifactsLoading}
+              disabled={isEmpty(selectedArtifactIds)}
+              title={policyName}
+            >
+              <FormattedMessage
+                id="xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.confirm"
+                defaultMessage="Assing to {policyName}"
+                values={{
+                  policyName,
+                }}
+              />
+            </EuiButton>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiFlyoutFooter>
+    </EuiFlyout>
+  );
+});
+
+PolicyTrustedAppsFlyout.displayName = 'PolicyTrustedAppsFlyout';
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/layout/policy_trusted_apps_layout.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/layout/policy_trusted_apps_layout.tsx
index d89f2612403cab..f29b6a9feae3b0 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/layout/policy_trusted_apps_layout.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/layout/policy_trusted_apps_layout.tsx
@@ -5,8 +5,7 @@
  * 2.0.
  */
 
-import React, { useMemo, useCallback } from 'react';
-
+import React, { useMemo } from 'react';
 import { i18n } from '@kbn/i18n';
 import {
   EuiButton,
@@ -15,14 +14,27 @@ import {
   EuiPageHeaderSection,
   EuiPageContent,
 } from '@elastic/eui';
+import { getCurrentArtifactsLocation } from '../../../store/policy_details/selectors';
+import { usePolicyDetailsNavigateCallback, usePolicyDetailsSelector } from '../../policy_hooks';
+import { PolicyTrustedAppsFlyout } from '../flyout';
 
 export const PolicyTrustedAppsLayout = React.memo(() => {
-  const onClickAssignTrustedAppButton = useCallback(() => {
-    /* TODO: to be implemented*/
-  }, []);
+  const location = usePolicyDetailsSelector(getCurrentArtifactsLocation);
+  const navigateCallback = usePolicyDetailsNavigateCallback();
+
+  const showListFlyout = location.show === 'list';
+
   const assignTrustedAppButton = useMemo(
     () => (
-      <EuiButton fill iconType="plusInCircle" onClick={onClickAssignTrustedAppButton}>
+      <EuiButton
+        fill
+        iconType="plusInCircle"
+        onClick={() =>
+          navigateCallback({
+            show: 'list',
+          })
+        }
+      >
         {i18n.translate(
           'xpack.securitySolution.endpoint.policy.trustedApps.layout.assignToPolicy',
           {
@@ -31,7 +43,7 @@ export const PolicyTrustedAppsLayout = React.memo(() => {
         )}
       </EuiButton>
     ),
-    [onClickAssignTrustedAppButton]
+    [navigateCallback]
   );
 
   return (
@@ -58,6 +70,7 @@ export const PolicyTrustedAppsLayout = React.memo(() => {
         {/* TODO: To be implemented */}
         {'Policy trusted apps layout content'}
       </EuiPageContent>
+      {showListFlyout ? <PolicyTrustedAppsFlyout /> : null}
     </div>
   );
 });
diff --git a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/task.test.ts b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/task.test.ts
index a9e30e64a003be..396cc402c0ab57 100644
--- a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/task.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/task.test.ts
@@ -123,6 +123,7 @@ describe('task', () => {
       const manifestManager = buildManifestManagerMock();
 
       manifestManager.getLastComputedManifest = jest.fn().mockReturnValue(null);
+      manifestManager.cleanup = jest.fn().mockResolvedValue(null);
 
       await runTask(manifestManager);
 
@@ -132,6 +133,7 @@ describe('task', () => {
       expect(manifestManager.commit).not.toHaveBeenCalled();
       expect(manifestManager.tryDispatch).not.toHaveBeenCalled();
       expect(manifestManager.deleteArtifacts).not.toHaveBeenCalled();
+      expect(manifestManager.cleanup).not.toHaveBeenCalled();
     });
 
     test('Should stop the process when no building new manifest throws error', async () => {
@@ -140,6 +142,7 @@ describe('task', () => {
 
       manifestManager.getLastComputedManifest = jest.fn().mockReturnValue(lastManifest);
       manifestManager.buildNewManifest = jest.fn().mockRejectedValue(new Error());
+      manifestManager.cleanup = jest.fn().mockResolvedValue(null);
 
       await runTask(manifestManager);
 
@@ -149,6 +152,7 @@ describe('task', () => {
       expect(manifestManager.commit).not.toHaveBeenCalled();
       expect(manifestManager.tryDispatch).not.toHaveBeenCalled();
       expect(manifestManager.deleteArtifacts).not.toHaveBeenCalled();
+      expect(manifestManager.cleanup).not.toHaveBeenCalled();
     });
 
     test('Should recover if last Computed Manifest threw an InvalidInternalManifestError error', async () => {
@@ -186,6 +190,7 @@ describe('task', () => {
       manifestManager.pushArtifacts = jest.fn().mockResolvedValue([]);
       manifestManager.tryDispatch = jest.fn().mockResolvedValue([]);
       manifestManager.deleteArtifacts = jest.fn().mockResolvedValue([]);
+      manifestManager.cleanup = jest.fn().mockResolvedValue(null);
 
       await runTask(manifestManager);
 
@@ -197,6 +202,7 @@ describe('task', () => {
       expect(manifestManager.commit).not.toHaveBeenCalled();
       expect(manifestManager.tryDispatch).toHaveBeenCalledWith(newManifest);
       expect(manifestManager.deleteArtifacts).toHaveBeenCalledWith([]);
+      expect(manifestManager.cleanup).toHaveBeenCalledWith(newManifest);
     });
 
     test('Should stop the process when there are errors pushing new artifacts', async () => {
@@ -211,6 +217,7 @@ describe('task', () => {
       manifestManager.getLastComputedManifest = jest.fn().mockReturnValue(lastManifest);
       manifestManager.buildNewManifest = jest.fn().mockResolvedValue(newManifest);
       manifestManager.pushArtifacts = jest.fn().mockResolvedValue([new Error()]);
+      manifestManager.cleanup = jest.fn().mockResolvedValue(null);
 
       await runTask(manifestManager);
 
@@ -225,6 +232,7 @@ describe('task', () => {
       expect(manifestManager.commit).not.toHaveBeenCalled();
       expect(manifestManager.tryDispatch).not.toHaveBeenCalled();
       expect(manifestManager.deleteArtifacts).not.toHaveBeenCalled();
+      expect(manifestManager.cleanup).not.toHaveBeenCalled();
     });
 
     test('Should stop the process when there are errors committing manifest', async () => {
@@ -240,6 +248,7 @@ describe('task', () => {
       manifestManager.buildNewManifest = jest.fn().mockResolvedValue(newManifest);
       manifestManager.pushArtifacts = jest.fn().mockResolvedValue([]);
       manifestManager.commit = jest.fn().mockRejectedValue(new Error());
+      manifestManager.cleanup = jest.fn().mockResolvedValue(null);
 
       await runTask(manifestManager);
 
@@ -254,6 +263,7 @@ describe('task', () => {
       expect(manifestManager.commit).toHaveBeenCalledWith(newManifest);
       expect(manifestManager.tryDispatch).not.toHaveBeenCalled();
       expect(manifestManager.deleteArtifacts).not.toHaveBeenCalled();
+      expect(manifestManager.cleanup).not.toHaveBeenCalled();
     });
 
     test('Should stop the process when there are errors dispatching manifest', async () => {
@@ -270,6 +280,7 @@ describe('task', () => {
       manifestManager.pushArtifacts = jest.fn().mockResolvedValue([]);
       manifestManager.commit = jest.fn().mockResolvedValue(null);
       manifestManager.tryDispatch = jest.fn().mockResolvedValue([new Error()]);
+      manifestManager.cleanup = jest.fn().mockResolvedValue(null);
 
       await runTask(manifestManager);
 
@@ -284,6 +295,7 @@ describe('task', () => {
       expect(manifestManager.commit).toHaveBeenCalledWith(newManifest);
       expect(manifestManager.tryDispatch).toHaveBeenCalledWith(newManifest);
       expect(manifestManager.deleteArtifacts).not.toHaveBeenCalled();
+      expect(manifestManager.cleanup).not.toHaveBeenCalled();
     });
 
     test('Should succeed the process and delete old artifacts', async () => {
@@ -303,6 +315,7 @@ describe('task', () => {
       manifestManager.commit = jest.fn().mockResolvedValue(null);
       manifestManager.tryDispatch = jest.fn().mockResolvedValue([]);
       manifestManager.deleteArtifacts = jest.fn().mockResolvedValue([]);
+      manifestManager.cleanup = jest.fn().mockResolvedValue(null);
 
       await runTask(manifestManager);
 
@@ -317,6 +330,7 @@ describe('task', () => {
       expect(manifestManager.commit).toHaveBeenCalledWith(newManifest);
       expect(manifestManager.tryDispatch).toHaveBeenCalledWith(newManifest);
       expect(manifestManager.deleteArtifacts).toHaveBeenCalledWith([ARTIFACT_ID_1]);
+      expect(manifestManager.cleanup).toHaveBeenCalledWith(newManifest);
     });
 
     test('Should succeed the process but not add or delete artifacts when there are only transitions', async () => {
@@ -336,6 +350,7 @@ describe('task', () => {
       manifestManager.commit = jest.fn().mockResolvedValue(null);
       manifestManager.tryDispatch = jest.fn().mockResolvedValue([]);
       manifestManager.deleteArtifacts = jest.fn().mockResolvedValue([]);
+      manifestManager.cleanup = jest.fn().mockResolvedValue(null);
 
       await runTask(manifestManager);
 
@@ -347,6 +362,7 @@ describe('task', () => {
       expect(manifestManager.commit).toHaveBeenCalledWith(newManifest);
       expect(manifestManager.tryDispatch).toHaveBeenCalledWith(newManifest);
       expect(manifestManager.deleteArtifacts).toHaveBeenCalledWith([]);
+      expect(manifestManager.cleanup).toHaveBeenCalledWith(newManifest);
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/task.ts b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/task.ts
index 6a89c50b86973f..a116311becfe5e 100644
--- a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/task.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/task.ts
@@ -174,6 +174,7 @@ export class ManifestTask {
       if (deleteErrors.length) {
         reportErrors(this.logger, deleteErrors);
       }
+      await manifestManager.cleanup(newManifest);
     } catch (err) {
       this.logger.error(wrapErrorIfNeeded(err));
     }
diff --git a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/artifact_client.test.ts b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/artifact_client.test.ts
index 740068a836d057..2987049511c513 100644
--- a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/artifact_client.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/artifact_client.test.ts
@@ -28,6 +28,12 @@ describe('artifact_client', () => {
       expect(fleetArtifactClient.listArtifacts).toHaveBeenCalled();
     });
 
+    test('can list artifact', async () => {
+      const response = await artifactClient.listArtifacts();
+      expect(fleetArtifactClient.listArtifacts).toHaveBeenCalled();
+      expect(response.items[0].id).toEqual('123');
+    });
+
     test('can create artifact', async () => {
       const artifact = await getInternalArtifactMock('linux', 'v1');
       await artifactClient.createArtifact(artifact);
diff --git a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/artifact_client.ts b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/artifact_client.ts
index c0930980dffb9f..ac19757e037b29 100644
--- a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/artifact_client.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/artifact_client.ts
@@ -6,7 +6,12 @@
  */
 
 import { InternalArtifactCompleteSchema } from '../../schemas/artifacts';
-import { Artifact, ArtifactsClientInterface } from '../../../../../fleet/server';
+import {
+  Artifact,
+  ArtifactsClientInterface,
+  ListArtifactsProps,
+} from '../../../../../fleet/server';
+import { ListResult } from '../../../../../fleet/common';
 
 export interface EndpointArtifactClientInterface {
   getArtifact(id: string): Promise<InternalArtifactCompleteSchema | undefined>;
@@ -14,6 +19,8 @@ export interface EndpointArtifactClientInterface {
   createArtifact(artifact: InternalArtifactCompleteSchema): Promise<InternalArtifactCompleteSchema>;
 
   deleteArtifact(id: string): Promise<void>;
+
+  listArtifacts(options?: ListArtifactsProps): Promise<ListResult<Artifact>>;
 }
 
 /**
@@ -49,6 +56,10 @@ export class EndpointArtifactClient implements EndpointArtifactClientInterface {
     return artifacts.items[0];
   }
 
+  async listArtifacts(options?: ListArtifactsProps): Promise<ListResult<Artifact>> {
+    return this.fleetArtifacts.listArtifacts(options);
+  }
+
   async createArtifact(
     artifact: InternalArtifactCompleteSchema
   ): Promise<InternalArtifactCompleteSchema> {
diff --git a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.test.ts b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.test.ts
index 89a704ecf1b1dd..d75e347b86bd51 100644
--- a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.test.ts
@@ -1004,4 +1004,74 @@ describe('ManifestManager', () => {
       expect(context.packagePolicyService.update).toHaveBeenCalledTimes(2);
     });
   });
+
+  describe('cleanup artifacts', () => {
+    const mockPolicyListIdsResponse = (items: string[]) =>
+      jest.fn().mockResolvedValue({
+        items,
+        page: 1,
+        per_page: 100,
+        total: items.length,
+      });
+
+    test('Successfully removes orphan artifacts', async () => {
+      const context = buildManifestManagerContextMock({});
+      const manifestManager = new ManifestManager(context);
+
+      context.exceptionListClient.findExceptionListItem = mockFindExceptionListItemResponses({});
+      context.packagePolicyService.listIds = mockPolicyListIdsResponse([TEST_POLICY_ID_1]);
+
+      context.savedObjectsClient.create = jest
+        .fn()
+        .mockImplementation((type: string, object: InternalManifestSchema) => ({
+          attributes: object,
+        }));
+      const manifest = await manifestManager.buildNewManifest();
+
+      await manifestManager.cleanup(manifest);
+      const artifactToBeRemoved = await context.artifactClient.getArtifact('');
+      expect(artifactToBeRemoved).not.toBeUndefined();
+
+      expect(context.artifactClient.deleteArtifact).toHaveBeenCalledWith(
+        getArtifactId(artifactToBeRemoved!)
+      );
+    });
+
+    test('When there is no artifact to be removed', async () => {
+      const context = buildManifestManagerContextMock({});
+      const manifestManager = new ManifestManager(context);
+
+      context.exceptionListClient.findExceptionListItem = mockFindExceptionListItemResponses({});
+      context.packagePolicyService.listIds = mockPolicyListIdsResponse([TEST_POLICY_ID_1]);
+
+      context.savedObjectsClient.create = jest
+        .fn()
+        .mockImplementation((type: string, object: InternalManifestSchema) => ({
+          attributes: object,
+        }));
+
+      context.artifactClient.listArtifacts = jest.fn().mockResolvedValue([
+        {
+          id: '123',
+          type: 'trustlist',
+          identifier: 'endpoint-trustlist-windows-v1',
+          packageName: 'endpoint',
+          encryptionAlgorithm: 'none',
+          relative_url: '/api/fleet/artifacts/trustlist-v1/d801aa1fb',
+          compressionAlgorithm: 'zlib',
+          decodedSha256: 'd801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658',
+          decodedSize: 14,
+          encodedSha256: 'd29238d40',
+          encodedSize: 22,
+          body: 'eJyrVkrNKynKTC1WsoqOrQUAJxkFKQ==',
+          created: '2021-03-08T14:47:13.714Z',
+        },
+      ]);
+      const manifest = await manifestManager.buildNewManifest();
+
+      await manifestManager.cleanup(manifest);
+
+      expect(context.artifactClient.deleteArtifact).toHaveBeenCalledTimes(0);
+    });
+  });
 });
diff --git a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts
index 4c69aa1dd0737b..5c1d327b1b8928 100644
--- a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts
@@ -5,9 +5,10 @@
  * 2.0.
  */
 
+import pMap from 'p-map';
 import semver from 'semver';
 import LRU from 'lru-cache';
-import { isEqual } from 'lodash';
+import { isEqual, isEmpty } from 'lodash';
 import { Logger, SavedObjectsClientContract } from 'src/core/server';
 import { ListResult } from '../../../../../../fleet/common';
 import { PackagePolicyServiceInterface } from '../../../../../../fleet/server';
@@ -515,4 +516,75 @@ export class ManifestManager {
   public getArtifactsClient(): EndpointArtifactClientInterface {
     return this.artifactClient;
   }
+
+  /**
+   * Cleanup .fleet-artifacts index if there are some orphan artifacts
+   */
+  public async cleanup(manifest: Manifest) {
+    try {
+      const fleetArtifacts = [];
+      const perPage = 100;
+      let page = 1;
+
+      let fleetArtifactsResponse = await this.artifactClient.listArtifacts({
+        perPage,
+        page,
+      });
+      fleetArtifacts.push(...fleetArtifactsResponse.items);
+
+      while (
+        fleetArtifactsResponse.total > fleetArtifacts.length &&
+        !isEmpty(fleetArtifactsResponse.items)
+      ) {
+        page += 1;
+        fleetArtifactsResponse = await this.artifactClient.listArtifacts({
+          perPage,
+          page,
+        });
+        fleetArtifacts.push(...fleetArtifactsResponse.items);
+      }
+
+      if (isEmpty(fleetArtifacts)) {
+        return;
+      }
+
+      const badArtifacts = [];
+
+      const manifestArtifactsIds = manifest
+        .getAllArtifacts()
+        .map((artifact) => getArtifactId(artifact));
+
+      for (const fleetArtifact of fleetArtifacts) {
+        const artifactId = getArtifactId(fleetArtifact);
+        const isArtifactInManifest = manifestArtifactsIds.includes(artifactId);
+
+        if (!isArtifactInManifest) {
+          badArtifacts.push(fleetArtifact);
+        }
+      }
+
+      if (isEmpty(badArtifacts)) {
+        return;
+      }
+
+      this.logger.error(
+        new EndpointError(`Cleaning up ${badArtifacts.length} orphan artifacts`, badArtifacts)
+      );
+
+      await pMap(
+        badArtifacts,
+        async (badArtifact) => this.artifactClient.deleteArtifact(getArtifactId(badArtifact)),
+        {
+          concurrency: 5,
+          /** When set to false, instead of stopping when a promise rejects, it will wait for all the promises to
+           * settle and then reject with an aggregated error containing all the errors from the rejected promises. */
+          stopOnError: false,
+        }
+      );
+
+      this.logger.info(`All orphan artifacts has been removed successfully`);
+    } catch (error) {
+      this.logger.error(new EndpointError('There was an error cleaning orphan artifacts', error));
+    }
+  }
 }
diff --git a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/mocks.ts b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/mocks.ts
index e2a4f9a3f53563..0a2e6253fd76fd 100644
--- a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/mocks.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/mocks.ts
@@ -47,6 +47,7 @@ export const createEndpointArtifactClientMock = (
       const response = await endpointArtifactClient.createArtifact(...args);
       return response;
     }),
+    listArtifacts: jest.fn((...args) => endpointArtifactClientMocked.listArtifacts(...args)),
     getArtifact: jest.fn((...args) => endpointArtifactClientMocked.getArtifact(...args)),
     deleteArtifact: jest.fn((...args) => endpointArtifactClientMocked.deleteArtifact(...args)),
     _esClient: esClient,
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index b8d4d8b9f80500..2b58733c230492 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -4182,12 +4182,8 @@
     "inspector.view": "{viewName} を表示",
     "kibana_legacy.notify.fatalError.errorStatusMessage": "エラー {errStatus} {errStatusText}: {errMessage}",
     "kibana_legacy.notify.fatalError.unavailableServerErrorMessage": "HTTP リクエストで接続に失敗しました。Kibana サーバーが実行されていて、ご使用のブラウザの接続が正常に動作していることを確認するか、システム管理者にお問い合わせください。",
-    "kibana_legacy.notify.toaster.errorMessage": "エラー：{errorMessage}\n      {errorStack}",
     "kibana_legacy.notify.toaster.errorStatusMessage": "エラー {errStatus} {errStatusText}: {errMessage}",
     "kibana_legacy.notify.toaster.unavailableServerErrorMessage": "HTTP リクエストで接続に失敗しました。Kibana サーバーが実行されていて、ご使用のブラウザの接続が正常に動作していることを確認するか、システム管理者にお問い合わせください。",
-    "kibana_legacy.paginate.controls.pageSizeLabel": "ページサイズ",
-    "kibana_legacy.paginate.controls.scrollTopButtonLabel": "最上部に移動",
-    "kibana_legacy.paginate.size.allDropDownOptionLabel": "すべて",
     "kibana_utils.history.savedObjectIsMissingNotificationMessage": "保存されたオブジェクトがありません",
     "kibana_utils.stateManagement.stateHash.unableToRestoreUrlErrorMessage": "URL を完全に復元できません。共有機能を使用していることを確認してください。",
     "kibana_utils.stateManagement.stateHash.unableToStoreHistoryInSessionErrorMessage": "セッションがいっぱいで安全に削除できるアイテムが見つからないため、Kibana は履歴アイテムを保存できません。\n\nこれは大抵新規タブに移動することで解決されますが、より大きな問題が原因である可能性もあります。このメッセージが定期的に表示される場合は、{gitHubIssuesUrl} で問題を報告してください。",
@@ -6193,7 +6189,6 @@
     "xpack.apm.alertAnnotationCriticalTitle": "重大アラート",
     "xpack.apm.alertAnnotationNoSeverityTitle": "アラート",
     "xpack.apm.alertAnnotationWarningTitle": "警告アラート",
-    "xpack.apm.alerting.fields.all_option": "すべて",
     "xpack.apm.alerting.fields.environment": "環境",
     "xpack.apm.alerting.fields.service": "サービス",
     "xpack.apm.alerting.fields.type": "型",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 17c6284ec9c6c6..3564f8b62f5cc1 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -4222,12 +4222,8 @@
     "inspector.view": "视图：{viewName}",
     "kibana_legacy.notify.fatalError.errorStatusMessage": "错误 {errStatus} {errStatusText}：{errMessage}",
     "kibana_legacy.notify.fatalError.unavailableServerErrorMessage": "HTTP 请求无法连接。请检查 Kibana 服务器是否正在运行以及您的浏览器是否具有有效的连接，或请联系您的系统管理员。",
-    "kibana_legacy.notify.toaster.errorMessage": "错误：{errorMessage}\n      {errorStack}",
     "kibana_legacy.notify.toaster.errorStatusMessage": "错误 {errStatus} {errStatusText}：{errMessage}",
     "kibana_legacy.notify.toaster.unavailableServerErrorMessage": "HTTP 请求无法连接。请检查 Kibana 服务器是否正在运行以及您的浏览器是否具有有效的连接，或请联系您的系统管理员。",
-    "kibana_legacy.paginate.controls.pageSizeLabel": "页面大小",
-    "kibana_legacy.paginate.controls.scrollTopButtonLabel": "滚动至顶部",
-    "kibana_legacy.paginate.size.allDropDownOptionLabel": "全部",
     "kibana_utils.history.savedObjectIsMissingNotificationMessage": "已保存对象缺失",
     "kibana_utils.stateManagement.stateHash.unableToRestoreUrlErrorMessage": "无法完全还原 URL，请确保使用共享功能。",
     "kibana_utils.stateManagement.stateHash.unableToStoreHistoryInSessionErrorMessage": "Kibana 无法将历史记录项存储在您的会话中，因为其已满，另外，似乎没有任何可安全删除的项目。\n\n通常，这可以通过移到全新的选项卡来解决，但这种情况可能是由更大的问题造成。如果您定期看到这个消息，请在 {gitHubIssuesUrl} 报告问题。",
@@ -6243,7 +6239,6 @@
     "xpack.apm.alertAnnotationCriticalTitle": "紧急告警",
     "xpack.apm.alertAnnotationNoSeverityTitle": "告警",
     "xpack.apm.alertAnnotationWarningTitle": "警告告警",
-    "xpack.apm.alerting.fields.all_option": "全部",
     "xpack.apm.alerting.fields.environment": "环境",
     "xpack.apm.alerting.fields.service": "服务",
     "xpack.apm.alerting.fields.type": "类型",
diff --git a/x-pack/test/api_integration/apis/ml/modules/recognize_module.ts b/x-pack/test/api_integration/apis/ml/modules/recognize_module.ts
index 2742fbff294c0d..00b820a025c8b7 100644
--- a/x-pack/test/api_integration/apis/ml/modules/recognize_module.ts
+++ b/x-pack/test/api_integration/apis/ml/modules/recognize_module.ts
@@ -44,7 +44,7 @@ export default ({ getService }: FtrProviderContext) => {
       user: USER.ML_POWERUSER,
       expected: {
         responseCode: 200,
-        moduleIds: ['apm_jsbase', 'apm_transaction', 'apm_nodejs'],
+        moduleIds: ['apm_jsbase', 'apm_nodejs'],
       },
     },
     {
diff --git a/x-pack/test/api_integration/apis/ml/modules/setup_module.ts b/x-pack/test/api_integration/apis/ml/modules/setup_module.ts
index c4dd529ac14f59..6ff6b8113cb1a4 100644
--- a/x-pack/test/api_integration/apis/ml/modules/setup_module.ts
+++ b/x-pack/test/api_integration/apis/ml/modules/setup_module.ts
@@ -187,9 +187,11 @@ export default ({ getService }: FtrProviderContext) => {
         dashboards: [] as string[],
       },
     },
+    // Set startDatafeed and estimateModelMemory to false for the APM transaction test
+    // until there is a new data set available with metric data.
     {
       testTitleSuffix:
-        'for apm_transaction with prefix, startDatafeed true and estimateModelMemory true',
+        'for apm_transaction with prefix, startDatafeed false and estimateModelMemory false',
       sourceDataArchive: 'x-pack/test/functional/es_archives/ml/module_apm',
       indexPattern: { name: 'ft_module_apm', timeField: '@timestamp' },
       module: 'apm_transaction',
@@ -197,14 +199,14 @@ export default ({ getService }: FtrProviderContext) => {
       requestBody: {
         prefix: 'pf5_',
         indexPatternName: 'ft_module_apm',
-        startDatafeed: true,
-        end: Date.now(),
+        startDatafeed: false,
+        estimateModelMemory: false,
       },
       expected: {
         responseCode: 200,
         jobs: [
           {
-            jobId: 'pf5_high_mean_transaction_duration',
+            jobId: 'pf5_apm_metrics',
             jobState: JOB_STATE.CLOSED,
             datafeedState: DATAFEED_STATE.STOPPED,
           },
diff --git a/x-pack/test/apm_api_integration/tests/index.ts b/x-pack/test/apm_api_integration/tests/index.ts
index 5ea5ad78d9479b..d402a74287f98e 100644
--- a/x-pack/test/apm_api_integration/tests/index.ts
+++ b/x-pack/test/apm_api_integration/tests/index.ts
@@ -137,6 +137,11 @@ export default function apmApiIntegrationTests(providerContext: FtrProviderConte
       loadTestFile(require.resolve('./settings/custom_link'));
     });
 
+    // suggestions
+    describe('suggestions', function () {
+      loadTestFile(require.resolve('./suggestions/suggestions'));
+    });
+
     // traces
     describe('traces/top_traces', function () {
       loadTestFile(require.resolve('./traces/top_traces'));
diff --git a/x-pack/test/apm_api_integration/tests/suggestions/suggestions.ts b/x-pack/test/apm_api_integration/tests/suggestions/suggestions.ts
new file mode 100644
index 00000000000000..d551aec632fabc
--- /dev/null
+++ b/x-pack/test/apm_api_integration/tests/suggestions/suggestions.ts
@@ -0,0 +1,143 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import {
+  SERVICE_ENVIRONMENT,
+  SERVICE_NAME,
+  TRANSACTION_TYPE,
+} from '../../../../plugins/apm/common/elasticsearch_fieldnames';
+import { FtrProviderContext } from '../../common/ftr_provider_context';
+import { registry } from '../../common/registry';
+
+export default function suggestionsTests({ getService }: FtrProviderContext) {
+  const apmApiClient = getService('apmApiClient');
+  const archiveName = 'apm_8.0.0';
+
+  registry.when(
+    'suggestions when data is loaded',
+    { config: 'basic', archives: [archiveName] },
+    () => {
+      describe('with environment', () => {
+        describe('with an empty string parameter', () => {
+          it('returns all environments', async () => {
+            const { body } = await apmApiClient.readUser({
+              endpoint: 'GET /internal/apm/suggestions',
+              params: { query: { field: SERVICE_ENVIRONMENT, string: '' } },
+            });
+
+            expectSnapshot(body).toMatchInline(`
+          Object {
+            "terms": Array [
+              "production",
+              "testing",
+            ],
+          }
+        `);
+          });
+        });
+
+        describe('with a string parameter', () => {
+          it('returns items matching the string parameter', async () => {
+            const { body } = await apmApiClient.readUser({
+              endpoint: 'GET /internal/apm/suggestions',
+              params: { query: { field: SERVICE_ENVIRONMENT, string: 'pr' } },
+            });
+
+            expectSnapshot(body).toMatchInline(`
+            Object {
+              "terms": Array [
+                "production",
+              ],
+            }
+          `);
+          });
+        });
+      });
+
+      describe('with service name', () => {
+        describe('with an empty string parameter', () => {
+          it('returns all services', async () => {
+            const { body } = await apmApiClient.readUser({
+              endpoint: 'GET /internal/apm/suggestions',
+              params: { query: { field: SERVICE_NAME, string: '' } },
+            });
+
+            expectSnapshot(body).toMatchInline(`
+              Object {
+                "terms": Array [
+                  "auditbeat",
+                  "opbeans-dotnet",
+                  "opbeans-go",
+                  "opbeans-java",
+                  "opbeans-node",
+                  "opbeans-python",
+                  "opbeans-ruby",
+                  "opbeans-rum",
+                ],
+              }
+            `);
+          });
+        });
+
+        describe('with a string parameter', () => {
+          it('returns items matching the string parameter', async () => {
+            const { body } = await apmApiClient.readUser({
+              endpoint: 'GET /internal/apm/suggestions',
+              params: { query: { field: SERVICE_NAME, string: 'aud' } },
+            });
+
+            expectSnapshot(body).toMatchInline(`
+              Object {
+                "terms": Array [
+                  "auditbeat",
+                ],
+              }
+            `);
+          });
+        });
+      });
+
+      describe('with transaction type', () => {
+        describe('with an empty string parameter', () => {
+          it('returns all transaction types', async () => {
+            const { body } = await apmApiClient.readUser({
+              endpoint: 'GET /internal/apm/suggestions',
+              params: { query: { field: TRANSACTION_TYPE, string: '' } },
+            });
+
+            expectSnapshot(body).toMatchInline(`
+                Object {
+                  "terms": Array [
+                    "Worker",
+                    "celery",
+                    "page-load",
+                    "request",
+                  ],
+                }
+              `);
+          });
+        });
+
+        describe('with a string parameter', () => {
+          it('returns items matching the string parameter', async () => {
+            const { body } = await apmApiClient.readUser({
+              endpoint: 'GET /internal/apm/suggestions',
+              params: { query: { field: TRANSACTION_TYPE, string: 'w' } },
+            });
+
+            expectSnapshot(body).toMatchInline(`
+                Object {
+                  "terms": Array [
+                    "Worker",
+                  ],
+                }
+              `);
+          });
+        });
+      });
+    }
+  );
+}
diff --git a/x-pack/test/functional/apps/ingest_pipelines/ingest_pipelines.ts b/x-pack/test/functional/apps/ingest_pipelines/ingest_pipelines.ts
index 02819cd2615346..17b4fef06f5ce2 100644
--- a/x-pack/test/functional/apps/ingest_pipelines/ingest_pipelines.ts
+++ b/x-pack/test/functional/apps/ingest_pipelines/ingest_pipelines.ts
@@ -20,7 +20,8 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
   const es = getService('es');
   const security = getService('security');
 
-  describe('Ingest Pipelines', function () {
+  // FAILING ES PROMOTION: https://github.com/elastic/kibana/issues/113439
+  describe.skip('Ingest Pipelines', function () {
     this.tags('smoke');
     before(async () => {
       await security.testUser.setRoles(['ingest_pipelines_user']);
diff --git a/x-pack/test/functional/apps/lens/heatmap.ts b/x-pack/test/functional/apps/lens/heatmap.ts
index 0655b09e84d566..ddc4130d388ce3 100644
--- a/x-pack/test/functional/apps/lens/heatmap.ts
+++ b/x-pack/test/functional/apps/lens/heatmap.ts
@@ -13,7 +13,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const elasticChart = getService('elasticChart');
   const testSubjects = getService('testSubjects');
 
-  describe('lens heatmap', () => {
+  // FLAKY: https://github.com/elastic/kibana/issues/113043
+  describe.skip('lens heatmap', () => {
     before(async () => {
       await PageObjects.visualize.navigateToNewVisualization();
       await PageObjects.visualize.clickVisType('lens');
diff --git a/x-pack/test/functional/apps/lens/thresholds.ts b/x-pack/test/functional/apps/lens/thresholds.ts
index bf6535acc7c8ea..10e330114442b3 100644
--- a/x-pack/test/functional/apps/lens/thresholds.ts
+++ b/x-pack/test/functional/apps/lens/thresholds.ts
@@ -64,5 +64,57 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         'Median of bytes',
       ]);
     });
+
+    it('should add a new group to the threshold layer when a right axis is enabled', async () => {
+      await PageObjects.lens.configureDimension({
+        dimension: 'lnsXY_yDimensionPanel > lns-empty-dimension',
+        operation: 'average',
+        field: 'bytes',
+        keepOpen: true,
+      });
+
+      await PageObjects.lens.changeAxisSide('right');
+
+      await PageObjects.lens.closeDimensionEditor();
+
+      await testSubjects.existOrFail('lnsXY_yThresholdRightPanel > lns-empty-dimension');
+    });
+
+    it('should carry the style when moving a threshold to another group', async () => {
+      // style it enabling the fill
+      await testSubjects.click('lnsXY_yThresholdLeftPanel > lns-dimensionTrigger');
+      await testSubjects.click('lnsXY_fill_below');
+      await PageObjects.lens.closeDimensionEditor();
+
+      // drag and drop it to the left axis
+      await PageObjects.lens.dragDimensionToDimension(
+        'lnsXY_yThresholdLeftPanel > lns-dimensionTrigger',
+        'lnsXY_yThresholdRightPanel > lns-empty-dimension'
+      );
+
+      await testSubjects.click('lnsXY_yThresholdRightPanel > lns-dimensionTrigger');
+      expect(
+        await find.existsByCssSelector('[data-test-subj="lnsXY_fill_below"][class$="isSelected"]')
+      ).to.be(true);
+      await PageObjects.lens.closeDimensionEditor();
+    });
+
+    it('should duplicate also the original style when duplicating a threshold', async () => {
+      // drag and drop to the empty field to generate a duplicate
+      await PageObjects.lens.dragDimensionToDimension(
+        'lnsXY_yThresholdRightPanel > lns-dimensionTrigger',
+        'lnsXY_yThresholdRightPanel > lns-empty-dimension'
+      );
+
+      await (
+        await find.byCssSelector(
+          '[data-test-subj="lnsXY_yThresholdRightPanel"]:nth-child(2) [data-test-subj="lns-dimensionTrigger"]'
+        )
+      ).click();
+      expect(
+        await find.existsByCssSelector('[data-test-subj="lnsXY_fill_below"][class$="isSelected"]')
+      ).to.be(true);
+      await PageObjects.lens.closeDimensionEditor();
+    });
   });
 }
diff --git a/x-pack/test/functional/services/observability/alerts.ts b/x-pack/test/functional/services/observability/alerts/common.ts
similarity index 95%
rename from x-pack/test/functional/services/observability/alerts.ts
rename to x-pack/test/functional/services/observability/alerts/common.ts
index 435da8ad94037a..7098fdec2a9d47 100644
--- a/x-pack/test/functional/services/observability/alerts.ts
+++ b/x-pack/test/functional/services/observability/alerts/common.ts
@@ -7,8 +7,8 @@
 
 import querystring from 'querystring';
 import { chunk } from 'lodash';
-import { FtrProviderContext } from '../../ftr_provider_context';
-import { WebElementWrapper } from '../../../../../test/functional/services/lib/web_element_wrapper';
+import { FtrProviderContext } from '../../../ftr_provider_context';
+import { WebElementWrapper } from '../../../../../../test/functional/services/lib/web_element_wrapper';
 
 // Based on the x-pack/test/functional/es_archives/observability/alerts archive.
 const DATE_WITH_DATA = {
@@ -19,12 +19,14 @@ const DATE_WITH_DATA = {
 const ALERTS_FLYOUT_SELECTOR = 'alertsFlyout';
 const COPY_TO_CLIPBOARD_BUTTON_SELECTOR = 'copy-to-clipboard';
 const ALERTS_TABLE_CONTAINER_SELECTOR = 'events-viewer-panel';
-
 const ACTION_COLUMN_INDEX = 1;
 
 type WorkflowStatus = 'open' | 'acknowledged' | 'closed';
 
-export function ObservabilityAlertsProvider({ getPageObjects, getService }: FtrProviderContext) {
+export function ObservabilityAlertsCommonProvider({
+  getPageObjects,
+  getService,
+}: FtrProviderContext) {
   const testSubjects = getService('testSubjects');
   const flyoutService = getService('flyout');
   const pageObjects = getPageObjects(['common']);
@@ -156,6 +158,7 @@ export function ObservabilityAlertsProvider({ getPageObjects, getService }: FtrP
     await actionsOverflowButton.click();
   };
 
+  // Workflow status
   const setWorkflowStatusForRow = async (rowIndex: number, workflowStatus: WorkflowStatus) => {
     await openActionsMenuForRow(rowIndex);
 
diff --git a/x-pack/test/functional/services/observability/alerts/index.ts b/x-pack/test/functional/services/observability/alerts/index.ts
new file mode 100644
index 00000000000000..f373b0d75c543b
--- /dev/null
+++ b/x-pack/test/functional/services/observability/alerts/index.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ObservabilityAlertsPaginationProvider } from './pagination';
+import { ObservabilityAlertsCommonProvider } from './common';
+
+import { FtrProviderContext } from '../../../ftr_provider_context';
+
+export function ObservabilityAlertsProvider(context: FtrProviderContext) {
+  const common = ObservabilityAlertsCommonProvider(context);
+  const pagination = ObservabilityAlertsPaginationProvider(context);
+
+  return {
+    common,
+    pagination,
+  };
+}
diff --git a/x-pack/test/functional/services/observability/alerts/pagination.ts b/x-pack/test/functional/services/observability/alerts/pagination.ts
new file mode 100644
index 00000000000000..6bffcf3596e2d7
--- /dev/null
+++ b/x-pack/test/functional/services/observability/alerts/pagination.ts
@@ -0,0 +1,109 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContext } from '../../../ftr_provider_context';
+
+const ROWS_PER_PAGE_SELECTOR = 'tablePaginationPopoverButton';
+const PREV_BUTTON_SELECTOR = 'pagination-button-previous';
+const NEXT_BUTTON_SELECTOR = 'pagination-button-next';
+const TEN_ROWS_SELECTOR = 'tablePagination-10-rows';
+const TWENTY_FIVE_ROWS_SELECTOR = 'tablePagination-25-rows';
+const FIFTY_ROWS_SELECTOR = 'tablePagination-50-rows';
+const BUTTON_ONE_SELECTOR = 'pagination-button-0';
+const BUTTON_TWO_SELECTOR = 'pagination-button-1';
+
+export function ObservabilityAlertsPaginationProvider({ getService }: FtrProviderContext) {
+  const testSubjects = getService('testSubjects');
+
+  const getPageSizeSelector = async () => {
+    return await testSubjects.find(ROWS_PER_PAGE_SELECTOR);
+  };
+
+  const getPageSizeSelectorOrFail = async () => {
+    return await testSubjects.existOrFail(ROWS_PER_PAGE_SELECTOR);
+  };
+
+  const missingPageSizeSelectorOrFail = async () => {
+    return await testSubjects.missingOrFail(ROWS_PER_PAGE_SELECTOR);
+  };
+
+  const getTenRowsPageSelector = async () => {
+    return await testSubjects.find(TEN_ROWS_SELECTOR);
+  };
+
+  const getTwentyFiveRowsPageSelector = async () => {
+    return await testSubjects.find(TWENTY_FIVE_ROWS_SELECTOR);
+  };
+
+  const getFiftyRowsPageSelector = async () => {
+    return await testSubjects.find(FIFTY_ROWS_SELECTOR);
+  };
+
+  const getPrevPageButton = async () => {
+    return await testSubjects.find(PREV_BUTTON_SELECTOR);
+  };
+
+  const getPrevPageButtonOrFail = async () => {
+    return await testSubjects.existOrFail(PREV_BUTTON_SELECTOR);
+  };
+
+  const missingPrevPageButtonOrFail = async () => {
+    return await testSubjects.missingOrFail(PREV_BUTTON_SELECTOR);
+  };
+
+  const getNextPageButton = async () => {
+    return await testSubjects.find(NEXT_BUTTON_SELECTOR);
+  };
+
+  const getNextPageButtonOrFail = async () => {
+    return await testSubjects.existOrFail(NEXT_BUTTON_SELECTOR);
+  };
+
+  const getPaginationButtonOne = async () => {
+    return await testSubjects.find(BUTTON_ONE_SELECTOR);
+  };
+
+  const getPaginationButtonTwo = async () => {
+    return await testSubjects.find(BUTTON_TWO_SELECTOR);
+  };
+
+  const goToNextPage = async () => {
+    return await (await getNextPageButton()).click();
+  };
+
+  const goToPrevPage = async () => {
+    return await (await getPrevPageButton()).click();
+  };
+
+  const goToFirstPage = async () => {
+    await (await getPaginationButtonOne()).click();
+  };
+
+  const getPrevButtonDisabledValue = async () => {
+    return await (await getPrevPageButton()).getAttribute('disabled');
+  };
+
+  return {
+    getPageSizeSelector,
+    getPageSizeSelectorOrFail,
+    missingPageSizeSelectorOrFail,
+    getTenRowsPageSelector,
+    getTwentyFiveRowsPageSelector,
+    getFiftyRowsPageSelector,
+    getPrevPageButton,
+    getPrevPageButtonOrFail,
+    missingPrevPageButtonOrFail,
+    getNextPageButton,
+    getNextPageButtonOrFail,
+    getPaginationButtonOne,
+    getPaginationButtonTwo,
+    goToNextPage,
+    goToPrevPage,
+    goToFirstPage,
+    getPrevButtonDisabledValue,
+  };
+}
diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alert_create_flyout.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alert_create_flyout.ts
index 88ba4c37559c57..adad80874dbc9f 100644
--- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alert_create_flyout.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alert_create_flyout.ts
@@ -103,8 +103,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
     await testSubjects.click('test.always-firing-SelectOption');
   }
 
-  // FLAKY https://github.com/elastic/kibana/issues/112749
-  describe.skip('create alert', function () {
+  describe('create alert', function () {
     before(async () => {
       await pageObjects.common.navigateToApp('triggersActions');
       await testSubjects.click('rulesTab');
@@ -236,6 +235,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
 
       const toastTitle = await pageObjects.common.closeToast();
       expect(toastTitle).to.eql(`Created rule "${alertName}"`);
+      await new Promise((resolve) => setTimeout(resolve, 1000));
       await pageObjects.triggersActionsUI.searchAlerts(alertName);
       const searchResultsAfterSave = await pageObjects.triggersActionsUI.getAlertsList();
       expect(searchResultsAfterSave).to.eql([
diff --git a/x-pack/test/observability_functional/apps/observability/alerts/index.ts b/x-pack/test/observability_functional/apps/observability/alerts/index.ts
index 856d7e60996ec2..14019472eb2ca3 100644
--- a/x-pack/test/observability_functional/apps/observability/alerts/index.ts
+++ b/x-pack/test/observability_functional/apps/observability/alerts/index.ts
@@ -31,7 +31,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
 
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/observability/alerts');
-      await observability.alerts.navigateToTimeWithData();
+      await observability.alerts.common.navigateToTimeWithData();
     });
 
     after(async () => {
@@ -40,50 +40,50 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
 
     describe('Alerts table', () => {
       it('Renders the table', async () => {
-        await observability.alerts.getTableOrFail();
+        await observability.alerts.common.getTableOrFail();
       });
 
       it('Renders the correct number of cells', async () => {
         await retry.try(async () => {
-          const cells = await observability.alerts.getTableCells();
+          const cells = await observability.alerts.common.getTableCells();
           expect(cells.length).to.be(TOTAL_ALERTS_CELL_COUNT);
         });
       });
 
       describe('Filtering', () => {
         afterEach(async () => {
-          await observability.alerts.clearQueryBar();
+          await observability.alerts.common.clearQueryBar();
         });
 
         after(async () => {
           // NOTE: We do this as the query bar takes the place of the datepicker when it is in focus, so we'll reset
           // back to default.
-          await observability.alerts.submitQuery('');
+          await observability.alerts.common.submitQuery('');
         });
 
         it('Autocompletion works', async () => {
-          await observability.alerts.typeInQueryBar('kibana.alert.s');
+          await observability.alerts.common.typeInQueryBar('kibana.alert.s');
           await testSubjects.existOrFail('autocompleteSuggestion-field-kibana.alert.start-');
           await testSubjects.existOrFail('autocompleteSuggestion-field-kibana.alert.status-');
         });
 
         it('Applies filters correctly', async () => {
-          await observability.alerts.submitQuery('kibana.alert.status: recovered');
+          await observability.alerts.common.submitQuery('kibana.alert.status: recovered');
           await retry.try(async () => {
-            const cells = await observability.alerts.getTableCells();
+            const cells = await observability.alerts.common.getTableCells();
             expect(cells.length).to.be(RECOVERED_ALERTS_CELL_COUNT);
           });
         });
 
         it('Displays a no data state when filters produce zero results', async () => {
-          await observability.alerts.submitQuery('kibana.alert.consumer: uptime');
-          await observability.alerts.getNoDataStateOrFail();
+          await observability.alerts.common.submitQuery('kibana.alert.consumer: uptime');
+          await observability.alerts.common.getNoDataStateOrFail();
         });
       });
 
       describe('Date selection', () => {
         after(async () => {
-          await observability.alerts.navigateToTimeWithData();
+          await observability.alerts.common.navigateToTimeWithData();
         });
 
         it('Correctly applies date picker selections', async () => {
@@ -91,7 +91,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
             await (await testSubjects.find('superDatePickerToggleQuickMenuButton')).click();
             // We shouldn't expect any data for the last 15 minutes
             await (await testSubjects.find('superDatePickerCommonlyUsed_Last_15 minutes')).click();
-            await observability.alerts.getNoDataStateOrFail();
+            await observability.alerts.common.getNoDataStateOrFail();
             await pageObjects.common.waitUntilUrlIncludes('rangeFrom=now-15m&rangeTo=now');
           });
         });
@@ -99,37 +99,38 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
 
       describe('Flyout', () => {
         it('Can be opened', async () => {
-          await observability.alerts.openAlertsFlyout();
-          await observability.alerts.getAlertsFlyoutOrFail();
+          await observability.alerts.common.openAlertsFlyout();
+          await observability.alerts.common.getAlertsFlyoutOrFail();
         });
 
         it('Can be closed', async () => {
-          await observability.alerts.closeAlertsFlyout();
+          await observability.alerts.common.closeAlertsFlyout();
           await testSubjects.missingOrFail('alertsFlyout');
         });
 
         describe('When open', async () => {
           before(async () => {
-            await observability.alerts.openAlertsFlyout();
+            await observability.alerts.common.openAlertsFlyout();
           });
 
           after(async () => {
-            await observability.alerts.closeAlertsFlyout();
+            await observability.alerts.common.closeAlertsFlyout();
           });
 
           it('Displays the correct title', async () => {
             await retry.try(async () => {
               const titleText = await (
-                await observability.alerts.getAlertsFlyoutTitle()
+                await observability.alerts.common.getAlertsFlyoutTitle()
               ).getVisibleText();
               expect(titleText).to.contain('Log threshold');
             });
           });
 
           it('Displays the correct content', async () => {
-            const flyoutTitles = await observability.alerts.getAlertsFlyoutDescriptionListTitles();
+            const flyoutTitles =
+              await observability.alerts.common.getAlertsFlyoutDescriptionListTitles();
             const flyoutDescriptions =
-              await observability.alerts.getAlertsFlyoutDescriptionListDescriptions();
+              await observability.alerts.common.getAlertsFlyoutDescriptionListDescriptions();
 
             const expectedTitles = [
               'Status',
@@ -158,7 +159,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
           });
 
           it('Displays a View in App button', async () => {
-            await observability.alerts.getAlertsFlyoutViewInAppButtonOrFail();
+            await observability.alerts.common.getAlertsFlyoutViewInAppButtonOrFail();
           });
         });
       });
@@ -166,35 +167,35 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       describe('Cell actions', () => {
         beforeEach(async () => {
           await retry.try(async () => {
-            const cells = await observability.alerts.getTableCells();
+            const cells = await observability.alerts.common.getTableCells();
             const alertStatusCell = cells[2];
             await alertStatusCell.moveMouseTo();
             await retry.waitFor(
               'cell actions visible',
-              async () => await observability.alerts.copyToClipboardButtonExists()
+              async () => await observability.alerts.common.copyToClipboardButtonExists()
             );
           });
         });
 
         afterEach(async () => {
-          await observability.alerts.clearQueryBar();
+          await observability.alerts.common.clearQueryBar();
         });
 
         it('Copy button works', async () => {
           // NOTE: We don't have access to the clipboard in a headless environment,
           // so we'll just check the button is clickable in the functional tests.
-          await (await observability.alerts.getCopyToClipboardButton()).click();
+          await (await observability.alerts.common.getCopyToClipboardButton()).click();
         });
 
         it('Filter for value works', async () => {
-          await (await observability.alerts.getFilterForValueButton()).click();
+          await (await observability.alerts.common.getFilterForValueButton()).click();
           const queryBarValue = await (
-            await observability.alerts.getQueryBar()
+            await observability.alerts.common.getQueryBar()
           ).getAttribute('value');
           expect(queryBarValue).to.be('kibana.alert.status: "active"');
           // Wait for request
           await retry.try(async () => {
-            const cells = await observability.alerts.getTableCells();
+            const cells = await observability.alerts.common.getTableCells();
             expect(cells.length).to.be(ACTIVE_ALERTS_CELL_COUNT);
           });
         });
diff --git a/x-pack/test/observability_functional/apps/observability/alerts/pagination.ts b/x-pack/test/observability_functional/apps/observability/alerts/pagination.ts
new file mode 100644
index 00000000000000..a00fbe2a77f346
--- /dev/null
+++ b/x-pack/test/observability_functional/apps/observability/alerts/pagination.ts
@@ -0,0 +1,130 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../../ftr_provider_context';
+
+const ROWS_NEEDED_FOR_PAGINATION = 10;
+const DEFAULT_ROWS_PER_PAGE = 50;
+
+export default ({ getService }: FtrProviderContext) => {
+  const esArchiver = getService('esArchiver');
+
+  // FAILING: https://github.com/elastic/kibana/issues/113486
+  describe.skip('Observability alerts pagination', function () {
+    this.tags('includeFirefox');
+
+    const retry = getService('retry');
+    const observability = getService('observability');
+
+    before(async () => {
+      await esArchiver.load('x-pack/test/functional/es_archives/observability/alerts');
+      await observability.alerts.common.navigateToTimeWithData();
+    });
+
+    after(async () => {
+      await esArchiver.unload('x-pack/test/functional/es_archives/observability/alerts');
+    });
+
+    describe(`When less than ${ROWS_NEEDED_FOR_PAGINATION} alerts are found`, () => {
+      before(async () => {
+        // current archiver has 3 closed alerts
+        await observability.alerts.common.setWorkflowStatusFilter('closed');
+      });
+
+      after(async () => {
+        await observability.alerts.common.setWorkflowStatusFilter('open');
+      });
+
+      it('Does not render page size selector', async () => {
+        await observability.alerts.pagination.missingPageSizeSelectorOrFail();
+      });
+
+      it('Does not render pagination controls', async () => {
+        await observability.alerts.pagination.missingPrevPageButtonOrFail();
+      });
+    });
+
+    describe(`When ${ROWS_NEEDED_FOR_PAGINATION} alerts are found`, () => {
+      before(async () => {
+        // current archiver has 12 open alerts
+        await observability.alerts.common.setWorkflowStatusFilter('open');
+      });
+
+      describe('Page size selector', () => {
+        it('Renders page size selector', async () => {
+          await observability.alerts.pagination.getPageSizeSelectorOrFail();
+        });
+
+        it('Default rows per page is 50', async () => {
+          await retry.try(async () => {
+            const defaultAlertsPerPage = await (
+              await observability.alerts.pagination.getPageSizeSelector()
+            ).getVisibleText();
+            expect(defaultAlertsPerPage).to.contain(DEFAULT_ROWS_PER_PAGE);
+          });
+        });
+
+        it('Shows up to 10 rows per page', async () => {
+          await retry.try(async () => {
+            await (await observability.alerts.pagination.getPageSizeSelector()).click();
+            await (await observability.alerts.pagination.getTenRowsPageSelector()).click();
+            const tableRows = await observability.alerts.common.getTableCellsInRows();
+            expect(tableRows.length).to.not.be.greaterThan(10);
+          });
+        });
+
+        it('Shows up to 25 rows per page', async () => {
+          await retry.try(async () => {
+            await (await observability.alerts.pagination.getPageSizeSelector()).click();
+            await (await observability.alerts.pagination.getTwentyFiveRowsPageSelector()).click();
+            const tableRows = await observability.alerts.common.getTableCellsInRows();
+            expect(tableRows.length).to.not.be.greaterThan(25);
+          });
+        });
+      });
+
+      describe('Pagination controls', () => {
+        before(async () => {
+          await (await observability.alerts.pagination.getPageSizeSelector()).click();
+          await (await observability.alerts.pagination.getTenRowsPageSelector()).click();
+        });
+        beforeEach(async () => {
+          await observability.alerts.pagination.goToFirstPage();
+        });
+
+        it('Renders previous page button', async () => {
+          await observability.alerts.pagination.getPrevPageButtonOrFail();
+        });
+
+        it('Renders next page button', async () => {
+          await observability.alerts.pagination.getNextPageButtonOrFail();
+        });
+
+        it('Previous page button is disabled', async () => {
+          const prevButtonDisabledValue =
+            await observability.alerts.pagination.getPrevButtonDisabledValue();
+          expect(prevButtonDisabledValue).to.be('true');
+        });
+
+        it('Goes to next page', async () => {
+          await observability.alerts.pagination.goToNextPage();
+          const tableRows = await observability.alerts.common.getTableCellsInRows();
+          expect(tableRows.length).to.be(2);
+        });
+
+        it('Goes to previous page', async () => {
+          await (await observability.alerts.pagination.getPaginationButtonTwo()).click();
+          await observability.alerts.pagination.goToPrevPage();
+          const tableRows = await observability.alerts.common.getTableCellsInRows();
+
+          expect(tableRows.length).to.be(10);
+        });
+      });
+    });
+  });
+};
diff --git a/x-pack/test/observability_functional/apps/observability/alerts/workflow_status.ts b/x-pack/test/observability_functional/apps/observability/alerts/workflow_status.ts
index d491e239c6035b..a68636b8cb0c00 100644
--- a/x-pack/test/observability_functional/apps/observability/alerts/workflow_status.ts
+++ b/x-pack/test/observability_functional/apps/observability/alerts/workflow_status.ts
@@ -8,6 +8,8 @@
 import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
+const OPEN_ALERTS_ROWS_COUNT = 12;
+
 export default ({ getService }: FtrProviderContext) => {
   const esArchiver = getService('esArchiver');
 
@@ -19,7 +21,7 @@ export default ({ getService }: FtrProviderContext) => {
 
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/observability/alerts');
-      await observability.alerts.navigateToTimeWithData();
+      await observability.alerts.common.navigateToTimeWithData();
     });
 
     after(async () => {
@@ -28,61 +30,61 @@ export default ({ getService }: FtrProviderContext) => {
 
     it('is filtered to only show "open" alerts by default', async () => {
       await retry.try(async () => {
-        const tableRows = await observability.alerts.getTableCellsInRows();
-        expect(tableRows.length).to.be(12);
+        const tableRows = await observability.alerts.common.getTableCellsInRows();
+        expect(tableRows.length).to.be(OPEN_ALERTS_ROWS_COUNT);
       });
     });
 
     it('can be set to "acknowledged" using the row menu', async () => {
-      await observability.alerts.setWorkflowStatusForRow(0, 'acknowledged');
+      await observability.alerts.common.setWorkflowStatusForRow(0, 'acknowledged');
 
       await retry.try(async () => {
-        const tableRows = await observability.alerts.getTableCellsInRows();
+        const tableRows = await observability.alerts.common.getTableCellsInRows();
         expect(tableRows.length).to.be(11);
       });
     });
 
     it('can be filtered to only show "acknowledged" alerts using the filter button', async () => {
-      await observability.alerts.setWorkflowStatusFilter('acknowledged');
+      await observability.alerts.common.setWorkflowStatusFilter('acknowledged');
 
       await retry.try(async () => {
-        const tableRows = await observability.alerts.getTableCellsInRows();
+        const tableRows = await observability.alerts.common.getTableCellsInRows();
         expect(tableRows.length).to.be(3);
       });
     });
 
     it('can be set to "closed" using the row menu', async () => {
-      await observability.alerts.setWorkflowStatusForRow(0, 'closed');
+      await observability.alerts.common.setWorkflowStatusForRow(0, 'closed');
 
       await retry.try(async () => {
-        const tableRows = await observability.alerts.getTableCellsInRows();
+        const tableRows = await observability.alerts.common.getTableCellsInRows();
         expect(tableRows.length).to.be(2);
       });
     });
 
     it('can be filtered to only show "closed" alerts using the filter button', async () => {
-      await observability.alerts.setWorkflowStatusFilter('closed');
+      await observability.alerts.common.setWorkflowStatusFilter('closed');
 
       await retry.try(async () => {
-        const tableRows = await observability.alerts.getTableCellsInRows();
+        const tableRows = await observability.alerts.common.getTableCellsInRows();
         expect(tableRows.length).to.be(4);
       });
     });
 
     it('can be set to "open" using the row menu', async () => {
-      await observability.alerts.setWorkflowStatusForRow(0, 'open');
+      await observability.alerts.common.setWorkflowStatusForRow(0, 'open');
 
       await retry.try(async () => {
-        const tableRows = await observability.alerts.getTableCellsInRows();
+        const tableRows = await observability.alerts.common.getTableCellsInRows();
         expect(tableRows.length).to.be(3);
       });
     });
 
     it('can be filtered to only show "open" alerts using the filter button', async () => {
-      await observability.alerts.setWorkflowStatusFilter('open');
+      await observability.alerts.common.setWorkflowStatusFilter('open');
 
       await retry.try(async () => {
-        const tableRows = await observability.alerts.getTableCellsInRows();
+        const tableRows = await observability.alerts.common.getTableCellsInRows();
         expect(tableRows.length).to.be(12);
       });
     });
diff --git a/x-pack/test/observability_functional/apps/observability/index.ts b/x-pack/test/observability_functional/apps/observability/index.ts
index b823e1ee0869b8..019fb0994715ef 100644
--- a/x-pack/test/observability_functional/apps/observability/index.ts
+++ b/x-pack/test/observability_functional/apps/observability/index.ts
@@ -13,5 +13,6 @@ export default function ({ loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./feature_controls'));
     loadTestFile(require.resolve('./alerts'));
     loadTestFile(require.resolve('./alerts/workflow_status'));
+    loadTestFile(require.resolve('./alerts/pagination'));
   });
 }
diff --git a/yarn.lock b/yarn.lock
index ca51f99108518a..ac54144a8fc11c 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1397,10 +1397,10 @@
   dependencies:
     "@elastic/ecs-helpers" "^1.1.0"
 
-"@elastic/elasticsearch@npm:@elastic/elasticsearch-canary@^8.0.0-canary.20":
-  version "8.0.0-canary.20"
-  resolved "https://registry.yarnpkg.com/@elastic/elasticsearch-canary/-/elasticsearch-canary-8.0.0-canary.20.tgz#7e9826f693be409b83b3827d9eb14cb8326a5916"
-  integrity sha512-bma25umW+Wio6r10Ixhz/V2F10ZdMdBqNGjKRoOL9E5sU8CfyVSDL/A0j8Rt+FaY+JdagtF1EYT5ikVC4iRfLg==
+"@elastic/elasticsearch@npm:@elastic/elasticsearch-canary@^8.0.0-canary.21":
+  version "8.0.0-canary.21"
+  resolved "https://registry.yarnpkg.com/@elastic/elasticsearch-canary/-/elasticsearch-canary-8.0.0-canary.21.tgz#6572a547071a17cf511a42fd93738780266a9f89"
+  integrity sha512-J/qRGYkTj+YeEJh5xci9eLlVPrfwSEURK/P+ZZ6ZKymFLz7VQvK1vvha2YJJBjpM3ERnLNDL0y/HTEjYkR3VtQ==
   dependencies:
     debug "^4.3.1"
     hpagent "^0.1.1"
@@ -1430,10 +1430,10 @@
   resolved "https://registry.yarnpkg.com/@elastic/eslint-plugin-eui/-/eslint-plugin-eui-0.0.2.tgz#56b9ef03984a05cc213772ae3713ea8ef47b0314"
   integrity sha512-IoxURM5zraoQ7C8f+mJb9HYSENiZGgRVcG4tLQxE61yHNNRDXtGDWTZh8N1KIHcsqN1CEPETjuzBXkJYF/fDiQ==
 
-"@elastic/eui@37.6.0":
-  version "37.6.0"
-  resolved "https://registry.yarnpkg.com/@elastic/eui/-/eui-37.6.0.tgz#dc4fb2431e223047fa52b9035627c05a22197887"
-  integrity sha512-CeaKhwZCbTaq2h0cn3s9t0kGr+P+khVtYNa72zAVsH1Vhb6Ox0Z7cnvmn49qyjb3GnOHSYtQlbyrAcxqstfwbw==
+"@elastic/eui@38.0.1":
+  version "38.0.1"
+  resolved "https://registry.yarnpkg.com/@elastic/eui/-/eui-38.0.1.tgz#de03c4436cd1b58327f54f57e4248183d681c0f8"
+  integrity sha512-yzV56rGVwhALnLVXsw2LGsFksh7c27BwIQOl2memDfm15VprzX5Fd+u6TpX8TkpFbTTgnYfyhI11W3eKVUYt1g==
   dependencies:
     "@types/chroma-js" "^2.0.0"
     "@types/lodash" "^4.14.160"
@@ -8362,7 +8362,7 @@ better-opn@^2.0.0:
   dependencies:
     open "^7.0.3"
 
-big-integer@^1.6.16, big-integer@^1.6.48:
+big-integer@^1.6.16:
   version "1.6.48"
   resolved "https://registry.yarnpkg.com/big-integer/-/big-integer-1.6.48.tgz#8fd88bd1632cba4a1c8c3e3d7159f08bb95b4b9e"
   integrity sha512-j51egjPa7/i+RdiRuJbPdJ2FIUYYPhvYLjzoYbcMMm62ooO6F94fETG4MTs46zPAF9Brs04OajboA/qTGuz78w==
@@ -17523,6 +17523,11 @@ js-sha3@0.8.0:
   resolved "https://registry.yarnpkg.com/js-sha3/-/js-sha3-0.8.0.tgz#b9b7a5da73afad7dedd0f8c463954cbde6818840"
   integrity sha512-gF1cRrHhIzNfToc802P800N8PpXS+evLLXfsVpowqmAFR9uwbi89WvXg2QspOmXL8QL86J4T1EpFu+yUkwJY3Q==
 
+js-sql-parser@^1.4.1:
+  version "1.4.1"
+  resolved "https://registry.yarnpkg.com/js-sql-parser/-/js-sql-parser-1.4.1.tgz#775516b3187dd5872ecec04bef8ed4a430242fda"
+  integrity sha512-J8zi3+/yK4FWSnVvLOjS2HIGfJhR6v7ApwIF8gZ/SpaO/tFIDlsgugD6ZMn6flXiuMsCjJxvhE0+xBgbdzvDDw==
+
 js-string-escape@^1.0.1:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/js-string-escape/-/js-string-escape-1.0.1.tgz#e2625badbc0d67c7533e9edc1068c587ae4137ef"
@@ -20096,13 +20101,6 @@ node-sass@^6.0.1:
     stdout-stream "^1.4.0"
     "true-case-path" "^1.0.2"
 
-node-sql-parser@^3.6.1:
-  version "3.6.1"
-  resolved "https://registry.yarnpkg.com/node-sql-parser/-/node-sql-parser-3.6.1.tgz#6f096e9df1f19d1e2daa658d864bd68b0e2cd2c6"
-  integrity sha512-AseDvELmUvL22L6C63DsTuzF+0i/HBIHjJq/uxC7jV3PGpAUib5Oe6oz4sgAniSUMPSZQbZmRore6Na68Sg4Tg==
-  dependencies:
-    big-integer "^1.6.48"
-
 nodemailer@^6.6.2:
   version "6.6.2"
   resolved "https://registry.yarnpkg.com/nodemailer/-/nodemailer-6.6.2.tgz#e184c9ed5bee245a3e0bcabc7255866385757114"